Replicate collects and stores any data you upload to train AI models, and acknowledges this data could include sensitive personal information — but doesn't specify what protections apply to it.
If you upload training data containing sensitive personal information (e.g., medical records, biometrics, financial data), that information is collected by Replicate with no disclosed special safeguards — exposing both you and any individuals in that dataset to privacy risk.
Cross-platform context
See how other platforms handle Training Data Collection Including Sensitive Information and similar clauses.
Compare across platforms →Users may unknowingly upload personal or sensitive data about third parties, and the policy provides no detail on access controls, retention limits, or consent requirements for such data — creating privacy and legal risk for both users and individuals whose data is included.
(1) REGULATORY FRAMEWORK: This provision implicates CPRA Cal. Civ. Code §1798.121 (sensitive personal information rights), GDPR Art. 9 (special categories of personal data requiring explicit consent or another Art. 9(2) basis), Illinois BIPA (740 ILCS 14) if biometric identifiers are included in training sets, HIPAA 45 CFR Part 164 if health information is processed, and FTC Act Section 5 for failure to implement reasonable security for sensitive data. Enforcement authorities include the California Privacy Protection Agency, EU supervisory authorities, Illinois AG, HHS OCR, and FTC. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.