Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Harvey receives Personal Data about individuals from third-party marketing vendors, advertising vendors including social media services, and market research firms and event organizers. This information includes contact details, professional affiliations, employment information, and behavioral data about interactions with Harvey's marketing materials and advertisements.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Harvey collects Personal Data about individuals who have not directly interacted with Harvey, sourced from third-party marketing vendors, research firms, and event organizers. This category of indirect data collection may affect individuals who are not aware they are in Harvey's data ecosystem.
Under this provision, individuals' contact details, professional affiliations, and behavioral marketing data may be collected and held by Harvey based on information provided by third-party marketing vendors, market research firms, or event organizers, without a direct relationship or interaction with Harvey. The document states this information may be used for marketing Harvey's services and for improving product development.
Cross-platform context
See how other platforms handle Third-Party Marketing and Market Research Data Collection and similar clauses.
Compare across platforms →Monitoring
Harvey AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We also receive certain information about you from our trusted partners, such as: b) marketing vendors who provide us with information about potential customers of our services, such as contact details, like name, email address, physical address, and phone number, and information about professional affiliations and employment; c) advertising vendors, including social media services who may provide us with information such as interactions with our marketing emails, social media posts, and other advertisements; and d) market research firms, survey companies, and event organisers (for example, trade shows, professional events, conferences, and seminars we attend) that may provide us with information about you, including contact details (such as your name, email address, physical address, and phone number), information about your professional affiliations and employment, and information relating to your use of our Services and Websites, your business, and your use of artificial intelligence.Excerpt from Harvey AI's Privacy Policy
(1) REGULATORY LANDSCAPE: Collection of Personal Data about individuals from third-party sources without direct notice engages GDPR Articles 13 and 14, which require controllers to provide privacy notices to data subjects whose data is obtained from third parties within a reasonable timeframe. The FTC has examined third-party data broker and marketing data practices under its unfair and deceptive practices authority. CCPA provisions on data collection from third parties and the right to know about data sources are also implicated. (2) GOVERNANCE EXPOSURE: Medium. The policy discloses third-party data sourcing but does not specify the identities of marketing vendors or market research firms from which this data is obtained. GDPR Article 14 requires that individuals whose data is obtained from third sources be informed of the processing, the data categories collected, and the identity of the controller within one month of collection. The practical implementation of Article 14 notices for this data category warrants review. (3) JURISDICTION FLAGS: EU and UK data subjects have explicit GDPR and UK GDPR rights under Article 14 to be informed when their data is obtained from third parties. California residents may exercise CCPA right-to-know requests to identify the categories of data collected about them from third parties. The Canadian section of this policy requires adequate notice for collection, which extends to third-party sourced data. (4) CONTRACT AND VENDOR IMPLICATIONS: Contracts with marketing vendors and market research firms should include representations that the data provided was collected lawfully and with appropriate notice or consent. Procurement teams should assess whether vendor contracts include indemnification for unlawful third-party data provision. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should implement Article 14 notice mechanisms for individuals whose data is received from third-party marketing sources. Data mapping should identify the specific vendors and the categories of data received from each. The Service Provider page linked in the policy may provide additional detail but is not reproduced in this document.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that Harvey collects Personal Data about individuals who have not directly interacted with Harvey, sourced from third-party marketing vendors, research firms, and event organizers. This category of indirect data collection may affect individuals who are not aware they are in Harvey's data ecosystem.
Under this provision, individuals' contact details, professional affiliations, and behavioral marketing data may be collected and held by Harvey based on information provided by third-party marketing vendors, market research firms, or event organizers, without a direct relationship or interaction with Harvey. The document states this information may be used for marketing Harvey's services and for improving product development.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.