The privacy policy explicitly excludes documents uploaded to the platform, AI inputs, and AI outputs from its scope. Those categories are governed by the Customer Agreement between Harvey and the employing organization, and data subject requests for that content must be directed to the employer, not Harvey.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a structural bifurcation of data controller and data processor responsibilities that directly determines the path for data subject rights requests. End users whose employers are Harvey Customers may find that their rights regarding platform-submitted content must be exercised through their employer rather than through Harvey's publicly disclosed privacy mechanisms.
Under this clause, individuals using Harvey through an employer or organization do not have a direct privacy rights relationship with Harvey for the content they submit to and receive from the platform. The agreement directs queries about input, output, and uploaded document data to the employer or organization that holds the Customer Agreement with Harvey.
Cross-platform context
See how other platforms handle Customer Data Exclusion from Policy Scope and similar clauses.
Compare across platforms →"This Privacy Policy does not apply to any input or output generated on our online platform, or documents uploaded to our platform. We process this data on behalf of Customers and we call it ("Customer Data" and "Content"). Harvey's use of Customer Data and Content received through the Services is governed by the relevant Customer Agreement. Harvey processes Customer Data and Content received through the Services as a Data Processor so any queries related to this data should be directed to our Customers who are the Data Controllers.Excerpt from Harvey AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 28 (processor obligations), UK GDPR equivalent provisions, and CCPA service provider designations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a structural bifurcation of data controller and data processor responsibilities that directly determines the path for data subject rights requests. End users whose employers are Harvey Customers may find that their rights regarding platform-submitted content must be exercised through their employer rather than through Harvey's publicly disclosed privacy mechanisms.
Under this clause, individuals using Harvey through an employer or organization do not have a direct privacy rights relationship with Harvey for the content they submit to and receive from the platform. The agreement directs queries about input, output, and uploaded document data to the employer or organization that holds the Customer Agreement with Harvey.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.