Privacy Policy

What is a privacy policy?

A privacy policy is a public page that explains how a company collects, uses, shares and keeps personal data. Personal data means any information about an identifiable person, such as a name, email address, IP address or usage history.

When you buy software, the vendor's privacy policy tells you what it does with information about you and your team. That includes your account details, billing contacts, support tickets, product usage and what its website collects when you visit.

A privacy policy is mostly a notice, not a contract you negotiate. But it still binds the vendor in a practical way. If a company says one thing in its policy and does another, regulators can treat that as deceptive.

Laws set much of what goes in it. Under the GDPR, Article 13 lists what a company must tell people when it collects their data. The list includes the purposes and legal basis for using the data, who receives it, transfers outside the EU, how long it is kept, and the rights people have. In California, the CCPA rules say a privacy policy must give a comprehensive description of a business's online and offline data practices. The CCPA also requires the policy to be updated at least once every 12 months.

A typical privacy policy covers:

• What is collected: data you give, data collected automatically (like cookies and logs), and data bought or received from others.
• Why it is used: running the service, security, marketing, product improvement and, more and more, building AI features.
• Who gets it: service providers, affiliates, advertising partners and authorities.
• How long it is kept: a fixed period or the rules used to decide.
• Your choices and rights: access, deletion, opting out of sale or targeted ads.
• Changes: how the company will tell you when it updates the policy.

A vendor may also run more than one policy. A separate policy can cover job applicants, a mobile app or a specific product, and each one can change on its own date.

One point causes confusion. The data you upload into a product, such as your customers' records, is a different case. There the vendor acts on your instructions as a data processor, and the main rules for that data sit in the data processing agreement. The comparison DPA vs privacy policy explains the split.

What it looks like in a vendor's terms

A typical clause reads like this:

We use the information we collect to provide, maintain and improve our Services, including to develop new features and train our models. We may share information with our affiliates, service providers and advertising partners. We keep information for as long as needed for the purposes described in this policy. We may update this policy from time to time and will notify you of significant changes.

• "Improve our Services": a broad purpose that can cover a lot, including analytics on how you use the product.
• "Train our models": your data may help build the vendor's AI. Check whether this applies to content or only to usage data, and whether you can opt out.
• "Advertising partners": data may go to ad networks. Under California law this can count as a "sale" or "sharing."
• "As long as needed": no fixed retention period, so the vendor decides.
• "Significant changes": only changes the vendor thinks are significant get a direct notice.

For a real example, Atlassian's privacy policy says it may use information for "development, training, or fine-tuning of machine learning and artificial intelligence models." Its US state disclosures also list "Third Party Advertising Providers" as recipients of sales or sharing.

A real change we caught

Venpo flagged a change where Zoom now says it may sell business contact data. In September 2026, Zoom narrowed its "we do not sell" statement to data covered by its main Privacy Statement and added that sales of business contact data may happen through Zoom Common Room, a sales intelligence company it agreed to buy. Business contact data means names, work emails, phone numbers and job titles.

A change like this lives in one or two sentences of a long page. The rest of the policy can look the same, and the only visible sign may be a new "last updated" date at the top.

The sentences worth watching

Privacy policies are long, but a few sentences carry most of the risk. Real changes have shown up in each of these areas, in privacy policies and in the notices linked to them:

• AI use: Amazon's privacy notice now says it uses data to develop generative AI. See AI training on customer data.
• Sale of data: the Zoom change above. See sale of personal information.
• Advertising: Uber now says its ad partners may combine your data with other sources. See targeted advertising.
• Retention: StreamYard can now keep personal data for three years after you leave. See data retention.
• Moved protections: Perplexity moved three protections out of its privacy policy, so the promises now live in a different document.

Why it matters to you

Your vendors hold data about your team and often about your customers. What their privacy policy says becomes part of what you can promise others.

• Your own promises: if your privacy policy tells customers you do not sell their data, a vendor that starts selling contact data can put you in a tough spot.
• Your team's data: your employees' names, emails, call recordings and usage habits sit with each vendor. A new use, such as transcribing calls or training AI, applies to them too.
• Security reviews: customers and auditors ask how your vendors use data. A changed policy can make last year's answers wrong.
• California rules: under the CCPA, a "sale" covers sharing data for money or other valuable consideration, not just cash. "Sharing" means giving data out for cross-context behavioral advertising, which is ads based on activity across different sites, even with no payment.
• Opt-out signals: the California Attorney General says businesses must honor Global Privacy Control as a valid request to opt out of sale or sharing. See Global Privacy Control.

Regulators also care how changes happen. A February 2024 FTC staff blog post warned that adopting more permissive data practices through a quiet, retroactive change to a privacy policy could be unfair or deceptive. It is guidance from FTC staff, not a formal rule.

What to check

• AI training: search for "train," "model" and "machine learning." Note what data is covered and whether there is an opt-out.
• Sale and sharing: look for the US state section and any list of recipients of "sales" or "sharing."
• Advertising partners: check whether data goes to ad networks and whether cookies or pixels feed them.
• Retention: look for a real number of days or years, especially after you close your account.
• Change notice: check how the vendor tells you about updates and whether changes apply to data it already collected.
• Your uploaded data: confirm the vendor has a DPA, and ask for it if it is not public.
• The date and the archive: note the "last updated" date and check whether the vendor keeps old versions, so you can compare what changed.

Privacy Notice

"Privacy notice" is often just another name for a privacy policy. Amazon, for example, calls its main document a privacy notice, as in the change where Amazon's privacy notice now says it uses data to develop generative AI. Some privacy professionals prefer "notice" because the document informs people. It is not a deal they negotiate.

Sometimes a notice is a separate, shorter document. The clearest case is California's "notice at collection." Under the CCPA regulations, a business must tell people what it collects and why at or before the moment it collects the data. Online, it can do this with a link to the specific section of its privacy policy that has the details.

Many companies also publish a US state privacy notice, a separate page or section for residents of states with privacy laws. These pages list data categories, rights and opt-out links. Atlassian, for example, puts this content in a "U.S. State privacy disclosures" section inside its main policy.

When you review a vendor, find every notice, not just the main policy. A promise about AI or ads can sit in a regional notice, and that notice can change on its own schedule.

How Venpo helps

Venpo watches the privacy policies and privacy notices of the vendors you use and emails you a plain-English alert when they change, with what changed and why it matters. The Fine Print Scan answers four questions for each vendor: whether it trains AI on your data, how long it keeps data, whether it sells data or uses it for ads, and whether it can raise prices.