Replicate Privacy Policy

This is Replicate's privacy policy, explaining what personal data the AI platform company collects from users — including account details, payment information, GitHub credentials, and any training data you upload to build AI models. The most important thing to know is that any training data you upload — which could include sensitive personal information — is collected and stored by Replicate, with limited specificity about how it is protected or who can access it. To protect yourself, review what data you upload as training data, and contact privacy@replicate.com to request deletion or access to your personal information.

This Privacy Policy governs Replicate, LLC's collection, use, disclosure, and retention of personal information across its website (replicate.com) and related AI platform services, without citing a specific statutory legal basis (e.g., GDPR Art. 6 or CCPA §1798.100) within the document itself. The most significant obligations created include Replicate's commitment to honor user rights to access, deletion, and correction of personal data upon request to privacy@replicate.com, and its self-designation as a 'processor' or 'service provider' under U.S. state privacy law frameworks when handling customer personal information. Notable and potentially unusual provisions include the explicit acknowledgment that Training Data uploaded by users 'may include any type of information, some of which could be deemed sensitive under various privacy laws,' without detailing any specific safeguards, access controls, or consent mechanisms for such sensitive data — creating meaningful compliance and reputational risk. The policy engages CCPA/CPRA (California), and potentially other U.S. state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA), as well as GDPR and UK GDPR for any EU/UK users, and COPPA for its under-16 exclusion; however, the absence of a dedicated GDPR section, Data Protection Officer identification, legal basis specification, or cross-border transfer mechanisms represents a material gap for EU/UK regulatory compliance. The policy's change notification mechanism — placing only an effective date at the top with no proactive user notice obligation — is also below the standard expected under several state privacy laws and the GDPR.