Privacy policies
The document that tells you, in the fifteenth paragraph, that the answer is yes. Sale to partners, session recording, sensitive categories, and training a model on what you wrote.
12 traps
Every trap Redline looks for
Data leaves the relationship entirely — brokers resell it to insurers, employers and lenders (GM driving data reached insurers' risk scores; Avast's 'anonymised' browsing data went to 100+…
Consent to unnecessary processing is extracted as the price of the service, so 'consent' covers advertising, resale and profiling; withdrawing appears to mean losing the service; a…
Data you gave for one transaction sits forever waiting for the breach, the subpoena, the acquisition or the AI-training pivot (children's voice recordings and browsing histories were kept…
Sensitive context (health portals, therapy sign-ups, fertility apps, loan applications) leaks to ad networks and is joined to your profile; session replay captures what you type before you…
Confidential documents, faces, voices, client data and private chats become permanent model weights that cannot be deleted or 'un-trained'; may breach NDAs, professional secrecy and GDPR…
Third parties who never agreed (your contacts) get profiled; always-on microphones and cameras produce recordings employees can view (Ring); TVs and cars report second-by-second behaviour…
Your data becomes reachable by foreign surveillance and courts, out of reach of your regulator, and camera footage, messages and location go to police or private litigants on the company's…
This is the data that gets people fired, denied insurance, outed or targeted; once it reaches ad platforms or brokers it is effectively permanent (BetterHelp, Grindr, Flo); genetic data…
Unstoppable spam, your number sold to 'partners' who spam further, collectors calling relatives and employers, data sold to lead generators (МФО spam); withdrawing often requires a letter…
You are judged by scores you cannot see, built from data you did not provide (broker enrichment), and security data becomes marketing data (Twitter $150M); errors and discrimination are…
Children's data is collected and monetised anyway and parents cannot get it deleted; children's and adults' data is exposed to strangers, scrapers and facial-recognition firms while 'you…
Consent that is one click to give and a registered letter to withdraw is not consent; deletion promises that exclude 'backups', 'legal purposes' or 'derived data' leave everything in…
What it looks like in a contract
Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.
- we may sellData sold to third parties
- by creating an account you agree to our Privacy Policy and consent toBundled consent, cookie wall
- for as long as necessaryIndefinite data retention
- cookies, web beacons, pixels and similar technologiesThird-party trackers & session replay
- to train, tune and improve our machine learning and artificial intelligence modelsContent used for AI training
- access your contacts / address bookExcess data collection (contacts, mic, location)
Is it enforceable where you are
In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.
- Cited
- CCPA
- CPRA
- FTC Act §5
- GDPR Art 6
- CMA37
- GDPR
- ICO
- PECR
- 152-ФЗ
- 233-ФЗ
- ст. 13.11 КоАП
- ст. 14.8 КоАП
- ст. 15
- ст. 6 ч. 3
Check your own contract
A lease hides different things from a loan agreement, and a privacy policy hides different things again. Pick the document on your desk and see what usually goes wrong in it.