The policy provides specific rights disclosures for EU, UK, and California users, including rights to access, correct, delete, and port their personal data, and to object to or restrict certain processing activities. These rights are exercisable by contacting Leonardo AI.
This analysis describes what Leonardo AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Knowing your data rights is essential for controlling how your personal information is used, and the existence of regional-specific rights means the protections available to you depend significantly on where you are located.
Interpretive note: The specific verbatim rights disclosure language was not extractable from the provided HTML; the analysis reflects standard GDPR, UK GDPR, and CCPA rights disclosures typical of platforms with Leonardo AI's user base and jurisdictional scope.
This generic provision was replaced with the more detailed and actionable 'User Data Rights and Opt-Out Mechanisms' provision that specifies rights and contact procedures.
View full change record →EU and UK users have GDPR rights including access, rectification, erasure, restriction, portability, and objection. California residents have CCPA/CPRA rights including the right to know, delete, correct, and opt out of sale or sharing. The practical effectiveness of these rights depends on Leonardo AI's response processes and timelines.
How other platforms handle this
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
Leonardo AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 15-22 (data subject rights) for EU users, UK GDPR equivalent provisions for UK users, CCPA/CPRA Sections 1798.100-1798.125 for California residents, and the Australian Privacy Act APP 12 (access) and APP 13 (correction) for Australian users. Enforcement is by the relevant national data protection authority for EU users, the ICO for UK users, the California Privacy Protection Agency and California AG for California residents, and the OAIC for Australian users. GOVERNANCE EXPOSURE: Medium. Operationalizing data subject rights across multiple jurisdictions requires documented response workflows, identity verification procedures, and compliance with statutory response timelines (30 days under GDPR, 45 days under CCPA). Failure to respond within required timeframes creates regulatory exposure. JURISDICTION FLAGS: EU users have the broadest and most enforceable rights framework under GDPR, with complaints routable to national DPAs and significant administrative fine exposure. California users have state-level enforcement by the CPPA. Australian users have OAIC oversight. The adequacy of the rights exercise process for each jurisdiction should be independently verified. CONTRACT AND VENDOR IMPLICATIONS: Data subject rights requests that require action by sub-processors (e.g., data deletion from cloud infrastructure providers) require contractual flow-down obligations in data processing agreements. Compliance teams should verify that deletion requests can be operationally fulfilled across all data stores including AI training data repositories. COMPLIANCE CONSIDERATIONS: Response workflow documentation, identity verification procedures, and escalation paths for complex requests should be reviewed. The ability to fulfill deletion requests for data that may have been incorporated into AI model training is a specific operational challenge that warrants legal and technical assessment.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Knowing your data rights is essential for controlling how your personal information is used, and the existence of regional-specific rights means the protections available to you depend significantly on where you are located.
EU and UK users have GDPR rights including access, rectification, erasure, restriction, portability, and objection. California residents have CCPA/CPRA rights including the right to know, delete, correct, and opt out of sale or sharing. The practical effectiveness of these rights depends on Leonardo AI's response processes and timelines.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Leonardo AI.