The policy states that Personal Data may be transferred to and processed in jurisdictions outside the user's own, including jurisdictions with different data protection standards, and characterizes policy acceptance as agreement to such transfer; the European section additionally identifies standard contractual clauses as the transfer safeguard for EEA, Swiss, and UK users.
This analysis describes what Together AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The consent-as-transfer-mechanism framing for general users may require evaluation under GDPR, where valid cross-border transfer requires specific legal mechanisms under Chapter V rather than general policy acceptance; the policy separately identifies standard contractual clauses for EEA, Swiss, and UK users, which is the operative transfer mechanism for those populations.
Interpretive note: Whether policy acceptance constitutes a valid GDPR-compliant transfer mechanism for non-EEA users subject to GDPR depends on regulatory interpretation; the standard contractual clauses assertion for EEA users is the operative mechanism and is on stronger legal footing.
Under this provision, Personal Data may be processed outside the user's jurisdiction, including in countries with different data protection standards. For EEA, Swiss, and UK users, the policy asserts that standard contractual clauses are used to safeguard such transfers.
Cross-platform context
See how other platforms handle Cross-Border Data Transfer and similar clauses.
Compare across platforms →"Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. Your consent to this Policy followed by your submission of such information represents your agreement to that transfer.Excerpt from Together AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V regarding international data transfers, which requires specific transfer mechanisms such as adequacy decisions, standard contractual clauses, or binding corporate rules; the policy's assertion that general consent …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
The consent-as-transfer-mechanism framing for general users may require evaluation under GDPR, where valid cross-border transfer requires specific legal mechanisms under Chapter V rather than general policy acceptance; the policy separately identifies standard contractual clauses for EEA, Swiss, and UK users, which is the operative transfer mechanism for those populations.
Under this provision, Personal Data may be processed outside the user's jurisdiction, including in countries with different data protection standards. For EEA, Swiss, and UK users, the policy asserts that standard contractual clauses are used to safeguard such transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Together AI.