Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
For European users, the policy provides a legal basis table mapping processing purposes to GDPR legal bases including contractual necessity, legitimate interests, and consent. AI model training and service improvement are stated to rely on the legitimate interests basis.
This analysis describes what Inflection AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the specific GDPR legal bases for each processing purpose, including the reliance on legitimate interests for AI model training. The document also identifies DataRep as the appointed EU and UK representative, and states that international transfers rely on appropriate safeguards such as contractual clauses.
The updated policy establishes broader data collection practices than previously disclosed. The terms now explicitly state the company collects voice and audio inputs alongside text, whereas prior language specified only text and other materials. Additionally, the policy now discloses collection of precise geolocation information with user consent and authorization to access contacts, emails, calendars, and documents from third-party platforms. You can stop collection of precise location information at any time through the Your Choices section.
View change record →Under this provision, EU and UK users have access to a legal basis table setting out the GDPR basis for each processing activity. The use of legitimate interests as the basis for AI model training means EU and UK users have a right to object to that processing under GDPR Article 21, in addition to the account settings opt-out described elsewhere in the policy.
Cross-platform context
See how other platforms handle EU and UK GDPR Legal Basis for Processing and similar clauses.
Compare across platforms →Monitoring
Inflection AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The table below sets out the purposes for which we process your information, the type of personal information we process and our legal basis for processing. [...] Where necessary for our legitimate interests and those of third parties and broader society, including in developing, improving, or promoting our Services, such as when we develop and train our models.Excerpt from Inflection AI's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages GDPR and UK GDPR, requiring that each processing purpose be supported by a valid legal basis under Article 6 and Article 9. The reliance on legitimate interests for model training requires a documented balancing test demonstrating that Inflection AI's interests do not override data subject rights and reasonable expectations. EU and UK Data Protection Authorities are the primary enforcement bodies. The document's reference to contractual clauses for international transfers engages GDPR Chapter V transfer rules and the EU Standard Contractual Clauses framework. 2. GOVERNANCE EXPOSURE: High for EU and UK compliance. The legitimate interests basis for AI model training is an area of active regulatory scrutiny. The document states that data subjects may contact DataRep as the EU and UK representative, and may lodge complaints with their local Data Protection Authority if concerns remain unresolved, which reflects a standard GDPR accountability structure. 3. JURISDICTION FLAGS: EU and EEA users and UK users are directly affected. Switzerland is referenced in the international transfers section as a jurisdiction for which Inflection AI takes steps to ensure adequate protection. Users in these jurisdictions have access to additional rights and remedies beyond those available to U.S. users. 4. CONTRACT AND VENDOR IMPLICATIONS: The statement that contractual clauses are used for international transfers but may be redacted for confidentiality creates a potential transparency issue for data subjects requesting access to transfer safeguards. Data processing agreements with sub-processors should be reviewed to confirm alignment with the stated legal bases and transfer mechanisms. 5. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that legitimate interests balancing tests have been documented for each processing purpose citing that basis, particularly AI model training. The appointment of DataRep as EU and UK representative should be verified as current and operationally active. Data subject rights request procedures, including the appeals process described in the policy, should be tested for operational effectiveness and documented in compliance records.
This provision discloses the specific GDPR legal bases for each processing purpose, including the reliance on legitimate interests for AI model training. The document also identifies DataRep as the appointed EU and UK representative, and states that international transfers rely on appropriate safeguards such as contractual clauses.
Under this provision, EU and UK users have access to a legal basis table setting out the GDPR basis for each processing activity. The use of legitimate interests as the basis for AI model training means EU and UK users have a right to object to that processing under GDPR Article 21, in addition to the account settings opt-out described …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Inflection AI.