Claude

Users retain whatever rights they already hold in the Inputs they submit; ownership is not transferred to Anthropic. The user is, however, responsible for having the rights and permissions necessary for Anthropic to process those Inputs.

Anthropic assigns to the user whatever right, title and interest it may have in Outputs, so users own the generated content subject to compliance with the Terms. The Terms caution that Outputs may be inaccurate, but that does not affect ownership.

By default Anthropic uses consumer Inputs and Outputs to train and improve its models unless the user opts out through account settings. Even after opting out, materials that are Feedback-rated or flagged for safety review will still be used for training, so opt-out is not absolute.

Users can delete individual conversations, which are removed from history immediately and auto-deleted from back-end systems within 30 days, and may request deletion of personal data subject to exceptions. Beyond the 30-day conversation window, the policy states retention only as 'as long as reasonably necessary' with no concrete schedule or deletion SLA disclosed in the supplied text.

Anthropic discloses data to affiliates, service providers, and to Third-Party Services the user chooses to connect, and states it does not 'sell' personal data. Sharing with connected Third-Party Services is integral to the connector/agentic features the user enables, but the disclosure is broad and users are told to review third-party policies themselves.

The policy provides an explicit opt-out of model training via account settings, a targeted-advertising opt-out with honoring of global privacy controls, and marketing unsubscribe and consent-withdrawal mechanisms. The opt-out is limited (safety-flagged and Feedback content remain in scope), but meaningful opt-out mechanisms clearly exist.

The consumer Terms and Privacy Policy reference GDPR/UK GDPR, CCPA-style rights, LGPD and Korean PIPA obligations, and rely on SCCs and adequacy decisions, but name no security certifications (SOC 2, ISO 27001, ISO 42001) and no NIST CSF or EU AI Act alignment. For the universal baseline the consumer documents establish privacy-law alignment but no attested certifications, and are silent on the key security/AI-governance frameworks.

Anthropic positions itself as a safety and interpretability research company and states it does not engage in solely-automated decision-making producing legal effects, which offers some assurance. However the consumer documents provide no user-facing explainability tooling or enterprise audit access for individuals, and repeatedly warn that Outputs may be inaccurate.

The Privacy Policy states appropriate technical and organizational measures are in place and points to a Trust Center, but the supplied consumer text names no specifics such as encryption at rest/in transit, penetration testing, or bug bounty, and warranties of security are expressly disclaimed. No breach history is disclosed.

The consumer Privacy Policy explicitly excludes business/Enterprise content and notes that employer-linked accounts can be monitored and controlled by an organization administrator, implying a materially different data-handling regime for enterprise. The consumer documents themselves confirm a delta exists but do not describe the enterprise terms; those are assessed separately in the enterprise object.

Anthropic reserves the right to use human review of content flagged for safety or policy violations, and may re-identify flagged Inputs/Outputs to enforce its Terms against the responsible user. Content moderation may use algorithmic and human review, so staff can access user materials in defined circumstances.

The Terms and Privacy Policy disclose that Anthropic may comply with government, court and law enforcement requests and may report user Inputs/Outputs/Actions to law enforcement. Disputes are governed by California law with exclusive jurisdiction in San Francisco courts; no specific litigation is disclosed.

Anthropic collects a broad set of PII (name, email, phone, IP/location, device and advertising identifiers, usage data) and can collect SPI including government ID images, facial geometry that may be biometric data, and the full content of Inputs/Outputs which may contain any personal data users submit. Collection is disclosed with purpose and legal-basis mapping and controls, warranting YELLOW rather than RED.

The Privacy Policy demonstrably covers current AI-first capabilities — model training, agentic sessions, connectors/Third-Party Services, and biometric age verification visible in the product surface — which is strong coverage evidence. However, no effective or last-updated date appears anywhere in the supplied policy text (the policy points readers to a date maintained externally), so recency cannot be confirmed and the rating is capped below GREEN.

Three consumer documents were supplied (two Terms of Service instances and a Privacy Policy). The Terms and Privacy Policy are mutually consistent on training use, opt-out mechanics, ownership, and third-party sharing; the two Terms documents are duplicates of the same instrument. No cross-document contradictions were found among the consumer documents.