Replicate Privacy Policy

This document is Replicate LLC's privacy policy (last updated April 1, 2026) governing the collection, use, sharing, and retention of personal information across its website and AI model deployment services. The policy states that Replicate collects account registration data, billing and payment information, training data uploaded by users (which may include sensitive information under various privacy laws), website analytics and metadata, and third-party sourced professional enrichment data; the terms authorize sharing this information with corporate affiliates, vendors, payment processors, and prospective acquirers in business transitions. Notably, the policy states that Replicate does not 'sell' or 'share' personal information as defined by U.S. state privacy laws and designates itself as a 'processor' or 'service provider' in relation to customer personal information, though the breadth of the training data collection provision and the policy change mechanism (revision without prior notice, update reflected only by effective date) warrant scrutiny. The policy engages CCPA and analogous U.S. state privacy frameworks, COPPA (minors under 16), and potentially GDPR where EU-based users interact with the platform, though the document does not address GDPR-specific mechanisms such as lawful basis, data transfer safeguards, or a designated EU representative. Compliance teams should note the absence of explicit data retention schedules, the self-designation as processor or service provider without elaboration on sub-processor obligations, and the lack of a structured policy change notification mechanism.