Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Personal Data may be transferred to and processed in jurisdictions outside the user's own, including jurisdictions with different data protection standards, and characterizes policy acceptance as agreement to such transfer; the European section additionally identifies standard contractual clauses as the transfer safeguard for EEA, Swiss, and UK users.
This analysis describes what Together AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The consent-as-transfer-mechanism framing for general users may require evaluation under GDPR, where valid cross-border transfer requires specific legal mechanisms under Chapter V rather than general policy acceptance; the policy separately identifies standard contractual clauses for EEA, Swiss, and UK users, which is the operative transfer mechanism for those populations.
Interpretive note: Whether policy acceptance constitutes a valid GDPR-compliant transfer mechanism for non-EEA users subject to GDPR depends on regulatory interpretation; the standard contractual clauses assertion for EEA users is the operative mechanism and is on stronger legal footing.
Under this provision, Personal Data may be processed outside the user's jurisdiction, including in countries with different data protection standards. For EEA, Swiss, and UK users, the policy asserts that standard contractual clauses are used to safeguard such transfers.
Cross-platform context
See how other platforms handle Cross-Border Data Transfer and similar clauses.
Compare across platforms →Monitoring
Together AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. Your consent to this Policy followed by your submission of such information represents your agreement to that transfer.Excerpt from Together AI's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V regarding international data transfers, which requires specific transfer mechanisms such as adequacy decisions, standard contractual clauses, or binding corporate rules; the policy's assertion that general consent to the policy constitutes agreement to transfer may be insufficient under GDPR for non-EEA users who are nonetheless protected by GDPR. The UK GDPR and Swiss Federal Act on Data Protection impose parallel requirements. (2) GOVERNANCE EXPOSURE: Medium. The reliance on standard contractual clauses for EEA, Swiss, and UK users is consistent with current GDPR transfer requirements; however, the broader consent-based framing for other users may be insufficient in jurisdictions that impose independent transfer restrictions. (3) JURISDICTION FLAGS: EEA, Swiss, and UK users have heightened exposure; standard contractual clauses require accompanying transfer impact assessments where destination countries present elevated risk. California residents should note that CCPA does not impose the same cross-border transfer restrictions as GDPR. (4) CONTRACT AND VENDOR IMPLICATIONS: B2B customers acting as GDPR data controllers should assess whether their data processing agreements with Together AI include adequate transfer mechanism documentation, including transfer impact assessments where required. (5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that Together AI's standard contractual clauses are the current European Commission-approved versions and that accompanying transfer impact assessments have been conducted for relevant destination countries.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The consent-as-transfer-mechanism framing for general users may require evaluation under GDPR, where valid cross-border transfer requires specific legal mechanisms under Chapter V rather than general policy acceptance; the policy separately identifies standard contractual clauses for EEA, Swiss, and UK users, which is the operative transfer mechanism for those populations.
Under this provision, Personal Data may be processed outside the user's jurisdiction, including in countries with different data protection standards. For EEA, Swiss, and UK users, the policy asserts that standard contractual clauses are used to safeguard such transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Together AI.