What can I do about this clause?

{'method': 'EMAIL', 'recipient': 'privacy@stability.ai', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'EU and UK users concerned about cross-border transfers can email privacy@stability.ai to request details of the transfer mechanisms in place for their data and, if unsatisfied, request deletion of their personal data under GDPR Art. 17.', 'deadline_days': 30, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'State_AG', 'reason': 'EU and UK users should escalate cross-border transfer concerns to their national data protection authority (e.g., UK ICO); US-based users can reference their State Attorney General for applicable state privacy law enforcement.', 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Cross-Border Data Transfers clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Do other platforms have similar clauses?

Yes. ConductAtlas has identified similar Cross-Border Data Transfers clauses across approximately 55 other tracked platforms. You can compare how platforms differ on this clause type in the cross-platform comparison view.

Cross-Border Data Transfers — Stability AI

Share 𝕏 Share in Share 🔒 PDF

What it is

Your personal data may be transferred to and processed in the United States, which has different (and in some cases weaker) data protection standards than the EU, UK, or other countries where you may live.

Consumer impact (what this means for users)

If you are based in the EU or UK, your personal data is transferred to the United States for processing, which requires Stability AI to rely on mechanisms like Standard Contractual Clauses (SCCs) or the UK-US Data Bridge to ensure your data remains legally protected.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data
Within 30 days
EU and UK users concerned about cross-border transfers can email privacy@stability.ai to request details of the transfer mechanisms in place for their data and, if unsatisfied, request deletion of their personal data under GDPR Art. 17.

Cross-platform context

See how other platforms handle Cross-Border Data Transfers and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

EU and UK users have strong legal protections for their personal data, but transferring data to the US requires specific legal safeguards that may not always be clearly disclosed or robustly implemented.

View original clause language

Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including personal data, to the United States and process it there.

Institutional analysis (Compliance & legal intelligence)

REGULATORY FRAMEWORK: GDPR Chapter V (Arts. 44-49) governs international data transfers and requires an adequacy decision, SCCs (Commission Implementing Decision 2021/914), or other appropriate safeguards. UK GDPR requires reliance on the UK-US Data Bridge (effective October 2023) or UK IDTA for transfers to US processors. The Schrems II decision (C-311/18) mandates transfer impact assessments (TIAs) for SCCs. FTC enforcement of the EU-US Data Privacy Framework is conducted by the FTC and Department of Transportation.

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

State AG

EU and UK users should escalate cross-border transfer concerns to their national data protection authority (e.g., UK ICO); US-based users can reference their State Attorney General for applicable state privacy law enforcement.
File a complaint →

Provision details

Document information

Document

Stability AI Privacy Policy

Entity

Stability AI

Document last updated

April 29, 2026

Tracking information

First tracked

April 28, 2026

Last verified

April 28, 2026

Record ID

CA-P-003729

Document ID

CA-D-00330

Evidence Provenance

Source URL

https://stability.ai/privacy-policy

Wayback Machine

View archived versions →

SHA-256

ab8463c1a698bccc246c55dd2af2b3ea094ea7c70c2ca61b926c6b9eac014966

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Stability AI | Document: Stability AI Privacy Policy | Record: CA-P-003729
Captured: 2026-04-28 05:31:08 UTC | SHA-256: ab8463c1a698bccc…
URL: https://conductatlas.com/platform/stability-ai/stability-ai-privacy-policy/cross-border-data-transfers/
Accessed: May 2, 2026

Classification

Severity

High

Cross-Border Data Transfers