Claude by Anthropic

"Anthropic retains your personal data for as long as reasonably necessary for the purposes and criteria outlined in this Privacy Policy and explained further in our privacy center. When the personal data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws."

The retention policy uses vague language like 'as long as reasonably necessary' without specifying concrete timelines, giving Anthropic broad discretion over how long personal data is kept.

"Anthropic discloses the categories of personal data described above between and among its affiliates and related entities. Anthropic may disclose the categories of personal data described above with service providers and business partners for a variety of business purposes, including website and data hosting, ensuring compliance with industry standards, research, auditing, data processing, and providing you with the services."

Anthropic shares all categories of personal data with affiliates, service providers, and business partners for broad purposes including research and auditing, without specifying limits on the number or identity of these third parties.

"Anthropic may update this Privacy Policy from time to time. We will notify you of any material changes to this Privacy Policy, as appropriate, and update the Effective Date at the top of https://www.anthropic.com/legal/privacy."

Anthropic reserves the right to update the privacy policy at any time, with notification only for 'material' changes and only 'as appropriate,' leaving discretion on what constitutes a material change and how users are notified.

"Device and Connection Information. Consistent with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location."

Anthropic collects device and advertising identifiers, probabilistic identifiers, and other unique online identifiers, which can be used to track users across services and devices and build unified profiles.

"This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location."

Anthropic collects device location and derives location from IP addresses. The legal basis table also references 'precise device location' consent, indicating location tracking capabilities beyond basic IP geolocation.

"This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location."

Anthropic collects extensive device information including advertising identifiers, probabilistic identifiers, mobile network details, and ISP information, which goes beyond what is strictly necessary for providing an AI chat service.

"You also are able to delete individual conversations, which will be removed immediately from your conversation history and automatically deleted from our back-end within 30 days. Learn more here."

When users delete conversations, the data persists in Anthropic's backend systems for up to 30 days. The policy also lacks clear information about complete account deletion procedures and timelines.