Is Harvey safe with your data?

Inputs and outputs sit outside the policy

The policy states it does not apply to any input or output generated on the platform or to documents uploaded to it, so how prompts and uploaded legal documents are used is governed only by a customer agreement that is not published.

No retention period is named

Retention is described as lasting as long as necessary for the purposes in the policy, with deletion deferred to the terms of a customer agreement, and no number of days, months or years appears anywhere.

Advertising sharing may count as a sale

Harvey states it does not sell personal data for payment, then acknowledges that sharing email addresses, device information and website interactions with advertising partners may be considered a sale or sharing under the CCPA, with opt-out offered through a Your Privacy Choices page and the Global Privacy Control signal.

Transfers and privacy contact are concrete

International transfers name the Standard Contractual Clauses issued on 4 June 2021 under Article 46(2) GDPR plus EU-U.S., UK and Swiss Data Privacy Framework certification, and the policy names an external data protection officer with a postal address and dedicated mailbox.