Replicate says it does not sell your personal data under U.S. state privacy laws, and when it handles customer data, it acts as a processor or service provider rather than the data controller.
While this designation limits Replicate's direct obligations to end data subjects, it shifts compliance responsibility onto business customers — meaning individual consumers may need to direct data rights requests to the businesses using Replicate, not Replicate directly.
Cross-platform context
See how other platforms handle No-Sale / Service Provider Designation and similar clauses.
Compare across platforms →This designation affects which legal obligations apply to Replicate and which remain with the customer — if Replicate is a 'processor,' the customer (the business using the platform) bears primary responsibility for ensuring lawful data use under CCPA and GDPR.
(1) REGULATORY FRAMEWORK: This provision directly engages CCPA §1798.140(ag) ('service provider' definition), CPRA §1798.100, Virginia CDPA §59.1-571 ('processor' definition), Colorado CPA §6-1-1303, and GDPR Art. 4(8) ('processor') and Art. 28 (processor obligations). The California Privacy Protection Agency and state AGs are primary enforcement authorities. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.