Harvey
Good disclosure · high confidence
Carves user inputs and outputs out of training and processes them as a data processor, restricting training to public legal material, with full rights and named transfer safeguards but vague retention and no breach clause.
What the policy says
Inputs not used for training
The policy does not apply to platform input or output, which Harvey processes as a data processor under the customer agreement. AI training is restricted to publicly available material such as judgments, decisions, and public filings.
Full rights coverage
Section 10 names access, correction, deletion, portability in a standardised format, objection, restriction, and consent withdrawal. Canada and Quebec add their own access, correction, and portability rights.
Named transfer safeguards
The international transfers section relies on adequacy decisions, the 4 June 2021 Standard Contractual Clauses under Article 46(2) GDPR, and certified EU-U.S., UK, and Swiss Data Privacy Framework adherence.
Retention stays vague
Retention is described only as for as long as necessary, with deletion in accordance with your Customer Agreement. There is no day count, no deletion-timeline number, and no breach notification clause.
Score by area
Details
- Category
- Legal
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2025-12-23
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.