Privacy Policy Analyzer

Klang AI collects potentially sensitive audio and video content, shares it with multiple AI providers, and reserves the right to use your uploaded data to improve its own algorithms without offering an opt-out — though it does keep most processing in the EU and enforces zero data retention with its AI sub-processors.

Apple's Messages privacy disclosure shows strong encryption and short data retention but leaves critical EU compliance gaps—no mention of international transfers, GDPR user rights, or whether message metadata trains AI models.

Tuta is a highly privacy-friendly encrypted email provider that stores all user data end-to-end encrypted in Germany, collects minimal metadata, uses no cookies, and shares data with third parties only for payment processing or under court order.

Qwant offers strong privacy by default without tracking cookies, but creating an account or consenting to cookies shares significant data with Microsoft, and the policy lacks clarity on international transfers and AI training.

GDPRchat offers exceptionally strong EU-centric privacy with no tracking and self-service data controls, but users should be aware that image prompts may be used for AI training by a third-party provider.

Proton offers strong privacy by default with end-to-end encryption, minimal data collection, and no ad tracking, though some user data does flow to US-based processors for support and payments.

GreenPT offers strong EU data sovereignty and minimal tracking, but its policy is suspiciously silent on whether your chat data is used to train AI models, and it relies on a weak safeguard for US-based search transfers.

Hotels.com (Expedia Group) collects an unusually broad range of personal data — including sensitive data, voice recordings, and co-traveler info — shares it widely with advertisers and Expedia Group brands, and uses it for extensive AI purposes with no opt-out, making this a data-hungry policy despite decent transfer safeguards.

Signal genuinely collects almost nothing and encrypts everything, but its legal documentation is outdated and missing critical GDPR-mandated disclosures like transfer safeguards, retention periods, and user rights procedures.

WhatsApp collects extensive metadata on your usage and device and shares it widely across Meta's family of companies, making it a concerning privacy choice despite its end-to-end encrypted messaging.

Grindr collects deeply sensitive data—including HIV status, precise geolocation, and biometric information—from a vulnerable community, ships it all to the US with no EU establishment, and reserves the right to keep training AI on it even after you opt out.

Tinder collects a massive amount of highly sensitive personal data—including sexual orientation, biometric face data, and precise location—and shares it widely across Match Group companies and advertising partners, making it a concerning privacy choice despite offering standard EU rights.

Mastodon GmbH's mastodon.social privacy policy page was not actually provided for analysis — only navigation chrome and marketing copy were included, making it impossible to assess compliance and leaving users without verifiable assurances.

Bluesky collects broad behavioral data and stores your direct messages unencrypted, but earns points for refusing to sell your data for targeted ads and providing solid GDPR rights infrastructure.

Cursor (Anysphere) promises not to use your code inputs for AI training by default and doesn't sell your data, but it collects a sweeping range of personal and usage data, ships it to the US with vague transfer safeguards, and leaves key details like retention periods and legal bases unspecified.

Scaleway talks a big game on European data sovereignty, but this marketing page provides zero actual privacy policy substance to back those claims up.

eustella makes strong privacy promises — no data selling, no third-party sharing, no AI training on your data, and all processing stays in the EU — but this is marketing copy, not a binding privacy policy, and critical details on data collection, retention, sub-processors, and user rights are absent from the provided text.

LinkedIn collects a vast amount of your data—including from your contacts, calendar, and across the web—uses it to train AI models with no clear opt-out, shares it extensively with Microsoft and advertisers, and retains it broadly, though EU users get some extra protections.

Slack collects a wide range of personal and usage data, relying heavily on broad legitimate interests to process it and transfer it globally, though it does provide standard GDPR rights and safeguards like Standard Contractual Clauses.

The Berlin Senate Chancellery's privacy policy is generally strong, using two-click consent for third-party media and anonymizing IPs, though it relies on standard contractual clauses for some sub-processors outside the EEA and lacks clarity on AI training.

DuckDuckGo lives up to its no-tracking promise for core search and browsing, but its growing optional features (Duck.ai, Sync & Backup) and the Microsoft ad partnership introduce data flows the policy doesn't fully explain, especially around AI training and international transfer safeguards.

Startpage offers exceptional privacy by design, collecting virtually no personal data and explicitly rejecting tracking, profiling, and search logging, though minor data flows to third-party ad and analytics providers exist.

PeerPush has strong anonymization practices for its public analytics but falls short on GDPR basics by failing to disclose legal bases, lacking an EU representative, and using vague language around international data transfers.

Best European Alternatives genuinely minimizes data and avoids cookies, but uses US-based processors without addressing international transfer safeguards and omits key GDPR rights and legal details.

Europe Alternatives is a privacy-friendly directory that collects almost no personal data, but clicking partner links can send your data to third parties—including potentially outside the EU—with no clear safeguards described.

European Alternatives collects minimal data and uses privacy-friendly tools, but its privacy policy is an unfinished template with placeholder text for critical sections like data storage, retention, and deletion — making it non-compliant as-is.

Free collects a vast and vaguely defined array of personal data—including profiling scores and detailed usage metrics—shares it widely with ad networks and the Iliad group, and transfers some outside the EU, though it does clearly outline standard GDPR rights.

LHV Bank collects a sweeping range of personal and financial data, shares it widely with fraud prevention agencies and payment intermediaries, and relies heavily on legitimate interest for marketing and analytics — but it does cover GDPR rights and uses manual review for profiling decisions.

Tella collects sensitive video data and shares it with numerous US-based AI and analytics providers without clearly stating if your data trains their models, making it a mixed bag for EU users.

Calendly collects a wide range of personal and usage data, shares it with advertising partners, and while it offers standard EU rights and transfer mechanisms, its vague retention periods and silence on AI training for its Notetaker feature are concerning.

Cal.com provides standard GDPR rights and a subprocessor list, but fails to specify the legal basis for EU-to-US data transfers and remains silent on AI training data usage.

Gemini collects extensive personal and financial data as a regulated crypto exchange, shares it widely with third parties for marketing and analytics, and transfers it globally, though it provides standard GDPR rights and SCCs for EU users.

This is only a navigation page for Anthropic's Privacy Center — no actual privacy policy text was provided, so a meaningful compliance assessment is impossible.

Zoom's privacy portal demonstrates significant investment in compliance infrastructure and EU-specific safeguards, but the page itself is a navigation hub rather than a substantive policy, leaving critical details about data collection, AI training, and third-party sharing behind links that weren't provided for analysis.

CAKE.com provides standard EU data rights and transfer safeguards but collects highly intrusive workplace surveillance data—like screenshots, background location, and app usage—on behalf of employers, who act as the data controllers for their employees.

Langdock is a privacy-conscious EU-based AI platform that explicitly bans using your content to train AI models and keeps data in the EU, though it relies on some US sub-processors and has vague retention periods in places.

Nineties Engineering OÜ's website EU Alternative is a model of privacy-by-design, collecting almost no personal data, avoiding all tracking, and keeping everything hosted exclusively in the EU.

One of the strongest privacy policies in the AI chat space — fully EU-hosted, transparent subprocessor list, no AI training on user data, and no US-based providers.

Robotstxt generally respects EU privacy but lacks clear details on legal bases, third‑party processors and AI use.

Kolsetu generally respects EU privacy rules, but it over‑collects usage data, lacks a public DPO, and provides limited detail on some international transfers.

Google collects a very wide range of personal data, shares it broadly, and uses it for AI training with limited opt‑out options, making its privacy stance mixed at best.

pCloud lets you choose EU or US storage but still shares extensive personal and usage data with many parties and lacks clear limits on AI training or US‑transfer safeguards.

Fenritec generally respects EU privacy rules but lacks clear limits on data use for AI, proactive sub‑processor disclosure and detailed data‑minimisation statements.

Qdrant’s policy leans heavily on legitimate‑interest and US third‑party transfers, gives consent options for newsletters, but lacks clear limits on data collection and any mention of AI model training, making it only moderately privacy‑friendly.