What a privacy policy should answer
Updated on 23 September 2026: the earlier analysis of ten privacy policies has been removed because the date and method were not documented. The patterns are now presented as review notes; statements about named providers are based on their own documentation.
This article shows which information you should find in an AI provider's privacy policy and gives you a seven-question checklist for your review.
The questions behind this are simple: Which language model is used? Where does the data go? Who has access?
Some privacy policies contain only general wording instead of specific names: “external AI service providers” without names, or “third-country transfers cannot be ruled out”, far back in the text. At the same time, the homepage says in large letters: GDPR-compliant.
No managing director should have to fight through 15 pages of legalese to find out whether their customer data ends up with a model provider outside the EU.
What should lie behind the term GDPR-compliant
The term GDPR-compliant is widespread. What matters is which information and documents support it: language model, processing locations, data processing agreement and the register of service providers.
Sometimes the term mainly stands for a statement about the server location in the EU. That is important information, but it does not yet answer who processes the data.
This is because EU hosting alone does not make processing GDPR-compliant. If the language model runs via the API of a provider based in the USA, that provider is a recipient of the data, even if it offers European regions. OpenAI describes European data residency for eligible customers, with product-specific requirements (OpenAI: Introducing data residency in Europe). Whether a specific installation uses it must be demonstrated by the platform provider. For providers subject to US law, the CLOUD Act (18 U.S.C. § 2713) also applies, regardless of where the data is stored.
Art. 13 and 14 GDPR require that data subjects are informed about the recipients or categories of recipients of their data. Specific companies, with their registered office and purpose, make the processing easy for you to follow.
You should therefore check whether your provider's privacy policy names the language model and its provider.
The 5-minute checklist: 7 questions for every AI provider
Before you engage an AI provider, ask these seven questions. If you do not get a clear answer to more than two of them, that is a warning sign.
1. Which language model (LLM) do you use? If the answer is “proprietary” or “we cannot say for competitive reasons”, ask for details. Without this information, the processing cannot be assessed.
2. Where is the LLM provider based? If the provider is based in the USA, the US CLOUD Act (18 U.S.C. § 2713) applies: US authorities can demand the disclosure of data, even if it is stored in the EU.
3. Is customer data used for AI training? “Not by us” is not enough. What does the LLM provider do with the data?
4. Where is voice and text data processed? “EU servers” alone does not answer the question if the API call still goes to a provider outside the EU. Ask specifically: does my data leave the EU's jurisdiction at any point?
5. Is there a DPA with the LLM provider? Art. 28(4) GDPR requires your provider to impose by contract the same data protection obligations on every further processor. This applies not only to the chatbot provider that sends you the invoice, but also to the company that operates the language model.
6. Is the subprocessor list public? If not: why not? Any reputable provider can tell you in 30 seconds which companies have access to your data. Anyone who cannot or will not do so has a transparency problem.
7. Can you tell me in one sentence where my data ends up? If the answer takes longer than 30 seconds or contains phrases such as “in principle”, “as a rule” or “depending on the configuration”, ask for details.
Key takeaway: Take the seven questions with you to your next provider meeting, or pass them on to your management, your data protection officer or your purchasing department.
Patterns worth asking about
When reading privacy policies, a few patterns stand out that are worth asking about more closely:
Pattern 1: “External AI providers” without naming them. The privacy policy mentions “external AI service providers” or “third-party providers for language processing” without naming them. Art. 13(1)(e) GDPR requires the recipients or categories of recipients to be specified. Specific names make the processing easier for you to follow.
Pattern 2: “GDPR-compliant” on the homepage, “third-country transfers possible” in the privacy policy. The homepage prominently advertises GDPR compliance, while the privacy policy states in the small print that “data transfers to third countries cannot be ruled out”.
Pattern 3: “Zero Data Retention available depending on the provider”. Sounds good. What it means: it depends on which LLM is used and how it is configured. “Available” does not mean “guaranteed”. And “depending on the provider” means: the provider does not have sole control.
Pattern 4: No DPA, no subprocessor list, no register. The website offers neither a DPA to download nor a public list of subprocessors. Art. 28 GDPR makes the DPA an obligation, not an option.
Pattern 5: A model in the EU region of a US provider as a “European solution”. Some providers use models via the EU region of a US cloud provider and call this a “European AI solution”. Microsoft, for example, describes processing within the geography selected at deployment for models from the Azure Model Catalog (Microsoft Learn: Data, privacy, and security for models through the Model Catalog, retrieved on 23 September 2026). This answers the question of the processing location. The question of the applicable law remains separate: for providers based in the USA, the CLOUD Act applies regardless of server location.
What real transparency looks like
Transparency is not complicated. One paragraph must make it clear: which LLM, where it is hosted, who has access, whether data is used for training.
This is how we do it at Nexoria: files, the knowledge index and semantic search run on dedicated servers in Germany. Answer generation by Nex uses Mistral AI with processing in France. The data transmitted by Nexoria to Mistral AI is not used for model training. This exclusion is agreed in the data processing agreement between Nexoria and Mistral AI. The statement refers to the Nexoria configuration and the contract with Mistral AI; it is not a general statement about all Mistral AI offerings. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply. Other services and activated integrations are listed under Security.
This also includes:
- List of subprocessors: publicly available in the processing register, with the registered office and purpose of each service provider
- Data processing agreement: publicly available at DPA, without prior request
- Processing register: under Art. 30 GDPR, publicly accessible
- Data protection impact assessment: documented under Art. 35 GDPR for AI-based processing, with the Data protection impact assessment available to view
This way, you can verify this information yourself.
Why this matters for your company
Yes, there are fines. Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5) GDPR).
The fine is not the biggest risk here. The biggest risk is the loss of trust.
Imagine this: your AI chatbot processes customer enquiries. Perhaps complaints, perhaps contract details, perhaps health data. And then it turns out that this data was processed by a provider outside the EU, without your customers knowing about it.
“We did not know which LLM our provider uses” is no defence. Not before the supervisory authority, not before your customers, not before the press. You are responsible for the service providers you engage. Art. 28 GDPR makes this unmistakably clear.
The good news: you can do better. Above all, it requires asking the right questions before you sign. The Checklist for GDPR-compliant chatbots will help you with this.