Loading report

{
  "assessmentStatus": "checked",
  "checklistItemId": "privacy_notice_availability",
  "coverageArea": "Privacy notice link/surface discovered",
  "evidenceState": "observed",
  "explanation": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "note": "Whether a reachable privacy notice or privacy policy link/surface was retained. This row does not by itself confirm that substantive notice content was available.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.privacy_notice_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.privacy_notice_availability"
  },
  "statusBasis": "Privacy notice evidence was retained in public policy-surface evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Excerpt: Data transfers. or more information or to obtain a copy of the appropriate safeguards we have in place when transferring Personal Data, please contact us at [email protected]. 11. Changes to the privacy policy We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law. 12",
      "Evidence: privacy policy surface retained",
      "Policy URL: https://openai.com/policies/privacy-policy"
    ],
    "signalObserved": true,
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy",
      "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
      "artifactRefs": [
        "policy_excerpt_a7464154_f70a177e",
        "policy_surface_text_a7464154_60782e6c"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "lastUpdatedText": "Updated: August 24, 2026",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "EU at OpenAI OpenAI",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "policySurfaceSummary": {
      "scanStartedAt": "2026-10-12T19:30:53.247Z",
      "observedTopics": [
        "cookies",
        "analytics",
        "advertising",
        "sale_or_share",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "dpo_contact",
        "supervisory_authority",
        "ai_features",
        "contact_privacy"
      ],
      "cookiePolicyUrls": [],
      "cookieDisclosures": [],
      "mentionedControls": [
        "consent_withdrawal"
      ],
      "privacyPolicySize": {
        "url": "https://openai.com/policies/privacy-policy",
        "completeness": "complete",
        "documentFormat": "text",
        "compressedBytes": 538191,
        "measurementScope": "selected_usable_privacy_policy",
        "decompressedBytes": 538191
      },
      "privacyPolicyUrls": [
        "https://openai.com/policies/privacy-policy"
      ],
      "cookie_disclosures": [],
      "policySectionCount": 19,
      "policySurfaceCount": 1,
      "cookiePolicyPresent": false,
      "scannedPageLanguage": "en",
      "privacyPolicyPresent": true,
      "policyPrimaryLanguage": "en",
      "policyLastUpdatedTexts": [
        "Updated: August 24, 2026"
      ],
      "policyTextCoverageMode": "section_targeted",
      "retainedPolicySections": [
        {
          "charEnd": 897,
          "heading": "data controller",
          "quality": "strong",
          "charStart": 648,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10."
        },
        {
          "charEnd": 14099,
          "heading": "data controller",
          "quality": "strong",
          "charStart": 950,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data controller 13. How to contact us 14. Useful resources ( Previous version ⁠ ) For individuals outside the European Economic Area, United Kingdom, and Switzerland, you can read this version ⁠ of our Privacy Policy. At OpenAI, our mission is to ensure that artificial general intelligence benefits everyone. We build tools like ChatGPT to help people learn, create, and solve problems. We at OpenAI (together with our affiliates, “OpenAI”, “we”, “our” or “us”) are committed to respecting your privacy and are strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to personal data that we collect from or about you, and how we use it when you use our website, applications, and services (collectively, “Services”). This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our API. Our use of that data is governed by our customer agreements covering access to and use of those offerings."
        },
        {
          "charEnd": 15180,
          "heading": "retain personal data",
          "quality": "strong",
          "charStart": 14099,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account. For example, you can delete specific, or all, of your ChatGPT conversations, delete specific Memories ⁠ (opens in a new window) , or delete your account. Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to improve our models ⁠ (opens in a new window) . Information we delete automatically: In some cases, Personal Data will be deleted automatically. For example, Temporary Chats ⁠ (opens in a new window) will be automatically deleted within 30 days (unless we have to retain them for safety or legal reasons, as described further below). Information we retain for longer for legitimate security, safety, or legal reasons: In some cases, we need to"
        },
        {
          "charEnd": 18199,
          "heading": "retain personal data",
          "quality": "strong",
          "charStart": 15180,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes. For instance: If specific Content, or your account, is banned because of violations of our usage policies ⁠ , we may retain that data for to protect our services from fraud, abuse, or other violations of our policies; If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation; When we are a party to a financial transaction (for instance, when we process your payment for a ChatGPT Plus or Pro account, or facilitate a purchase on ChatGPT), we may retain payment and transaction related information to meet our accounting, dispute resolution, and regulatory compliance purposes; When you ask us to delete your Personal Data, we retain the audit record of the erasure request to be able to verify that we have complied with the request."
        },
        {
          "charEnd": 18325,
          "heading": "right to data portability",
          "quality": "partial",
          "charStart": 18199,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the"
        },
        {
          "charEnd": 19185,
          "heading": "Legal basis",
          "quality": "strong",
          "charStart": 18325,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "legal basis for processing. Lodge a complaint with your local data protection authority (see below). You have the following rights to object: Object to our processing of your Personal Data for direct marketing. Object to how we process your Personal Data when our processing is based on legitimate interests. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section. If you are unable to exercise your rights through your account, please submit your request through privacy.openai.com ⁠ (opens in a new window) or send it to [email protected] ⁠ . If you have any other concerns regarding our processing of your Personal Data, you can write to us at [email protected]. We hope that we are able to address any questions or concerns you may have. If you have any unresolved complaints with us or our"
        },
        {
          "charEnd": 22342,
          "heading": "data protection officer",
          "quality": "strong",
          "charStart": 19185,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data Protection Officer: If you reside in the European Economic Area, you can reach out to the Irish Data Protection Commission ⁠ (opens in a new window) as our lead supervisory authority, or your local supervisory authority ⁠ (opens in a new window) ; If you reside in the UK, you can reach out to the Information Commissioner’s Office ⁠ (opens in a new window) ; If you reside in Switzerland, you can reach out to the Federal Data Protection and Information Commissioner ⁠ (opens in a new window) . A note about accuracy: Services like ChatGPT generate responses by reading a user’s request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our models. If you notice that ChatGPT output contains factually inaccurate information about you and you would like to request a correction or removal of the information, you can submit these requests through privacy.openai.com or to [email protected], and we will consider your request based on applicable law and the technical capabilities of our models."
        },
        {
          "charEnd": 31557,
          "heading": "Legal basis",
          "quality": "strong",
          "charStart": 22342,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Legal basis, depending on the process activity To provide, analyse, and maintain our Services For example, We use your email address and password to authenticate your login. We use your payment card details to process subscription charges or purchases on ChatGPT. We use your prompts and other Content to provide you with responses. We conduct analytics, measurement, and other types of analysis to understand how our Services are used, for example, we analyze usage data to ensure uptime and the reliability and safety of our Services. Account Information User Content Communication Information Other Information You Provide Log Data Usage Data Device Information Location Information Cookies and Similar Technologies Where necessary to perform a contract with you, such as processing your prompts and other Content to provide a response. To personalise and customise your experience across our Services for you. For example, If Memory (opens in a new window) is on, we may remember details you’ve shared across conversations to provide more personalised and consistent responses in future chats."
        },
        {
          "charEnd": 33257,
          "heading": "Data transfers",
          "quality": "strong",
          "charStart": 31557,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data transfers OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK for the purposes described in this policy. This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located. While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to comply with applicable data protection law, such as: We rely on the European Commission’s adequacy decisions ⁠ (opens in a new window) and the UK Secretary of State’s adequacy regulations pursuant to Article 45(1) EU and UK GDPR ( “GDPR” ) when transferring your Personal Data to any country that has been considered to provide an adequate level of protection."
        },
        {
          "charEnd": 34085,
          "heading": "data controller",
          "quality": "strong",
          "charStart": 33257,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data controller If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy. If you live anywhere else, OpenAI OpCo, LLC, with its registered office at 1455 Third Street, San Francisco, California 94158, United States, is the controller and is responsible for the processing of your Personal Data as described in this policy. 13. How to contact us Please contact support ⁠ (opens in a new window) if you have any questions or concerns not already addressed in this policy. Alternatively, you can write to us at [email protected] or the address above under Section 12 ("
        },
        {
          "charEnd": 35746,
          "heading": "data protection officer",
          "quality": "strong",
          "charStart": 34123,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health Privacy Notice ⁠ Research Research Index Research Overview Economic Research Latest Advancements GPT-6.1 Sol GPT-6 Astra GPT-5.6 GPT-5.5 Safety Safety Approach Deployment Safety (opens in a new window) Security & Privacy Trust & Transparency Products ChatGPT (opens in a new window) ChatGPT Business (opens in a new window) ChatGPT Enterprise (opens in a new window) ChatGPT for Education (opens in a new window) Codex Dots (opens in a new window) Release Notes API Platform Overview API Log In (opens in a new window) Docs (opens in a new window) Business Overview Solutions Resources Plugins Customer Stories Partner Network Contact Sales Developers Apps SDK (opens in a new window) Open Models Docs (opens in a new window) Resources (opens in a new window) Developer Forum (opens in a new window) Company About Us Our Charter Careers"
        },
        {
          "charEnd": 19131,
          "heading": "right to data portability",
          "quality": "strong",
          "charStart": 18153,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below). You have the following rights to object: Object to our processing of your Personal Data for direct marketing. Object to how we process your Personal Data when our processing is based on legitimate interests. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section. If you are unable to exercise your rights through your account, please submit your request through privacy.openai.com ⁠ (opens in a new window) or send it to [email protected] ⁠ . If you have any other concerns regarding our processing of your Personal Data, you can write to us at [email protected]. We hope that we are able to address any questions or concerns you may have."
        },
        {
          "charEnd": 20024,
          "heading": "data protection officer",
          "quality": "strong",
          "charStart": 19132,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "If you have any unresolved complaints with us or our Data Protection Officer: If you reside in the European Economic Area, you can reach out to the Irish Data Protection Commission ⁠ (opens in a new window) as our lead supervisory authority, or your local supervisory authority ⁠ (opens in a new window) ; If you reside in the UK, you can reach out to the Information Commissioner’s Office ⁠ (opens in a new window) ; If you reside in Switzerland, you can reach out to the Federal Data Protection and Information Commissioner ⁠ (opens in a new window) . A note about accuracy: Services like ChatGPT generate responses by reading a user’s request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our models."
        },
        {
          "charEnd": 15069,
          "heading": "retain personal data",
          "quality": "strong",
          "charStart": 14087,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "How long we retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account. For example, you can delete specific, or all, of your ChatGPT conversations, delete specific Memories ⁠ (opens in a new window) , or delete your account. Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to improve our models ⁠ (opens in a new window) . Information we delete automatically: In some cases, Personal Data will be deleted automatically. For example, Temporary Chats ⁠ (opens in a new window) will be automatically deleted within 30 days (unless we have to retain them for safety or legal reasons, as described further below)."
        },
        {
          "charEnd": 1547,
          "heading": "data controller",
          "quality": "strong",
          "charStart": 648,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources ( Previous version ⁠ ) For individuals outside the European Economic Area, United Kingdom, and Switzerland, you can read this version ⁠ of our Privacy Policy. At OpenAI, our mission is to ensure that artificial general intelligence benefits everyone. We build tools like ChatGPT to help people learn, create, and solve problems. We at OpenAI (together with our affiliates, “OpenAI”, “we”, “our” or “us”) are committed to respecting your privacy and are strongly committed to keeping secure any information we obtain from you or about you."
        },
        {
          "charEnd": 19055,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 18071,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Delete your Personal Data from our records. Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below). You have the following rights to object: Object to our processing of your Personal Data for direct marketing. Object to how we process your Personal Data when our processing is based on legitimate interests. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section. If you are unable to exercise your rights through your account, please submit your request through privacy.openai.com ⁠ (opens in a new window) or send it to [email protected] ⁠ . If you have any other concerns regarding our processing of your Personal Data, you can write to us at [email protected]."
        },
        {
          "charEnd": 10802,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 9943,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "3. Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers. We also work with service providers who help us with age and identity verification, and you can learn more here ⁠ (opens in a new window) . Based on our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us."
        },
        {
          "charEnd": 19131,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 18271,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below). You have the following rights to object: Object to our processing of your Personal Data for direct marketing. Object to how we process your Personal Data when our processing is based on legitimate interests. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section. If you are unable to exercise your rights through your account, please submit your request through privacy.openai.com ⁠ (opens in a new window) or send it to [email protected] ⁠ . If you have any other concerns regarding our processing of your Personal Data, you can write to us at [email protected]. We hope that we are able to address any questions or concerns you may have."
        },
        {
          "charEnd": 34216,
          "heading": "Policy section",
          "quality": "strong",
          "charStart": 33593,
          "sourceUrl": "https://openai.com/policies/privacy-policy/",
          "textExcerpt": "If you live anywhere else, OpenAI OpCo, LLC, with its registered office at 1455 Third Street, San Francisco, California 94158, United States, is the controller and is responsible for the processing of your Personal Data as described in this policy. 13. How to contact us Please contact support ⁠ (opens in a new window) if you have any questions or concerns not already addressed in this policy. Alternatively, you can write to us at [email protected] or the address above under Section 12 (Data Controller). You can contact our Data Protection Officer at [email protected] in matters related to Personal Data processing. 14."
        }
      ],
      "cookieDisclosurePresent": true,
      "policyCookieDisclosures": [],
      "privacyPolicyDiscovered": true,
      "processingErrorObserved": false,
      "observedPolicyTopicHints": [
        "cookies",
        "analytics",
        "advertising",
        "sale_or_share",
        "third_party_disclosures",
        "vendor_list",
        "consent_withdrawal",
        "data_retention",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories",
        "data_subject_rights",
        "international_transfers",
        "dpo_contact",
        "supervisory_authority",
        "ai_features",
        "contact_privacy"
      ],
      "policyDocumentProvenance": [
        {
          "sourceUrl": "https://openai.com/policies/privacy-policy",
          "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
          "artifactRefs": [
            "policy_excerpt_a7464154_f70a177e",
            "policy_surface_text_a7464154_60782e6c"
          ],
          "effectiveDate": null,
          "observationId": "policy_surface_a7464154",
          "discoveryMethod": "page_text_link",
          "lastUpdatedText": "Updated: August 24, 2026",
          "detectedLanguage": "en",
          "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
          "targetRelationship": "target_controller",
          "translationApplied": false,
          "documentOwnerEntity": "EU at OpenAI OpenAI",
          "ownershipConfidence": 0.98,
          "translationTargetLanguage": null,
          "directlyLinkedFromScannedPage": true
        }
      ],
      "policy_cookie_disclosures": [],
      "article13DisclosureSignals": [
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "retain personal data",
          "evidenceText": "retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account.",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "data_retention",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_retention",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "right to data portability",
          "evidenceText": "Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below).",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "data_subject_rights",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_data_subject_rights",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below).",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "international or cross-border transfer disclosure",
          "evidenceText": "While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to comply with applicable data protection law, such as: We rely on the European Commission’s adequacy decisions ⁠ (opens in a new window) and the UK Secretary of State’s adequacy regulations pursuant to Article 45(1) EU and UK GDPR ( “GDPR” ) when",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "international_transfers",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_international_transfers",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to comply with applicable data protection law, such as: We rely on the European Commission’s adequacy decisions ⁠ (opens in a new window) and the UK Secretary of State’s adequacy regulations pursuant to Article 45(1) EU and UK GDPR ( “GDPR” ) when",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "supervisory-authority complaint disclosure",
          "evidenceText": "Lodge a complaint with your local data protection authority (see below).",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "supervisory_authority",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_supervisory_authority",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Lodge a complaint with your local data protection authority (see below).",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "data protection officer",
          "evidenceText": "Data Protection Officer at [email protected]",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "dpo_contact",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_dpo_contact",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Data Protection Officer at [email protected]",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "evidenceText": "Data controller If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy.",
          "disclosureType": "controller_contact",
          "evidenceSource": "deterministic",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "supportingContactContext": null,
          "selectedPolicySectionExcerpt": "Data controller If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy.",
          "selectedPolicySectionHeading": "data controller"
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "specific personal-data processing purpose",
          "evidenceText": "Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health Privacy Notice ⁠ Research Research Index Research Overview Economic Research Latest Advancements GPT-6.1 Sol GPT-6 Astra GPT-5.6 GPT-5.5 Safety Safety Approach Deployment Safety (opens in a new window) Security & Privacy Trust & Transparency Products ChatGPT (opens in a new windo",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "processing_purposes",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_processing_purposes",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health Privacy Notice ⁠ Research Research Index Research Overview Economic Research Latest Advancements GPT-6.1 Sol GPT-6 Astra GPT-5.6 GPT-5.5 Safety Safety Approach Deployment Safety (opens in a new window) Security & Privacy Trust & Transparency Products ChatGPT (opens in a new windo",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "processing legal-basis clause",
          "evidenceText": "Object to how we process your Personal Data when our processing is based on legitimate interests.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "legal_basis",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_legal_basis",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Object to how we process your Personal Data when our processing is based on legitimate interests.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.86,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "named recipient or meaningful recipient category",
          "evidenceText": "Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers.",
          "matchStrength": "equivalent",
          "matchedLocale": "en",
          "disclosureType": "recipients_or_vendor_categories",
          "evidenceSource": "canonical_retained_article13_signal",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_recipients_or_vendor_categories",
            "match_strength_equivalent",
            "variant_semantic_clause"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers.",
          "sourceCandidateProductionCredit": false
        },
        {
          "source": "deterministic",
          "status": "observed",
          "confidence": 0.9,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "matchedTerm": "data controller",
          "evidenceText": "Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10.",
          "matchStrength": "direct",
          "matchedLocale": "en",
          "disclosureType": "controller_contact",
          "evidenceSource": "gdpr_transparency_topic_candidate",
          "productionCredit": true,
          "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
          "classifierReasonCodes": [
            "matched_controller_contact",
            "match_strength_direct"
          ],
          "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
          "selectedPolicySectionExcerpt": "Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10.",
          "sourceCandidateProductionCredit": false
        }
      ],
      "policyTextExtractionHealth": {
        "policyUrls": [
          "https://openai.com/policies/privacy-policy"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0004755776870139316,
          "policyTermCount": 15,
          "alphabeticWordRatio": 0.7809832707408672,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 186
        },
        "policyUrlRetained": true,
        "extractedTextLength": 35746,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "privacyPolicyEvidencePaths": [],
      "discoveredPrivacyPolicyUrls": [
        "https://openai.com/policies/privacy-policy/"
      ],
      "article13CoverageAssessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "dedicatedCookiePolicyPresent": false,
      "policyTextEvidenceProjection": {
        "scanId": "14324058-98b5-4981-9f9c-cf5a76fb78d8",
        "documents": [
          {
            "finalUrl": "https://openai.com/policies/privacy-policy/",
            "artifactId": "policy_surface_text_a7464154_60782e6c",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/14324058-98b5-4981-9f9c-cf5a76fb78d8/auxiliary/policy_surface_text_a7464154_60782e6c.txt",
            "contentType": "text/html; charset=utf-8",
            "documentRole": "policy_document",
            "requestedUrl": "/policies/privacy-policy/",
            "observationId": "policy_surface_a7464154",
            "redirectChain": [
              "https://openai.com/policies/privacy-policy"
            ],
            "artifactSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 35746,
              "retainedSectionCount": 19,
              "extractedSectionCount": 25,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_a7464154_60782e6c.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 35943,
            "retainedTextChars": 35746,
            "documentFetchState": "fetched",
            "retainedTextSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "EU at OpenAI OpenAI",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 35746,
              "retainedTextChars": 35746
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "405ab9b724029c5a61e1f9c29dc76622014326c684e8c6d79cba80b00e90a5f7",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "c9b9cd96972efe60bd3d8b819cae66d24503d44c29767fc8fe636c42971a4af8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "424d2b5338022ed7f636211aabd68f22e2a4c9f6c2ff7e91febbe68adfa7aed4",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "9a110d4782eb9d8915c5ed65d8fd32738930d8c056568f6d96321d31bd774328",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "5e7c4cd4e32e6728e79edb6cdba4a1adabd501e43e8d41de6c845cb07aef10f8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "6a0495caed2380bad264d116cc4cbd1891c33464c1d540e4213d572b7547ae1c",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "7b5c703e11b48fc692f862963c1693c83a3a4c49895006c49f935ca68a696aea",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "2449087cfcf3764e7ed91176b14fe08dc5a133f52e94ade5b3ba112bec7df966",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "48b0c8476940949a28142f3210b9a452610d82e4a9a376473059e441deb639ca",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:31:13.069Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/14324058-98b5-4981-9f9c-cf5a76fb78d8/CanonicalEvidenceBundle.json",
          "sha256": "578980d38c9e7998b0a8af3211cb11865174b1fc20a5a293a11b504892b8ef09",
          "sizeBytes": 1866010,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyEvaluationState": "fetched_usable",
      "legalFrameworkValidityMatches": [],
      "missingExpectedPolicySections": [
        "Your privacy controls",
        "Exporting and deleting your information",
        "Retaining your information",
        "Compliance and cooperation with regulators",
        "European requirements"
      ],
      "policy_text_extraction_health": {
        "policyUrls": [
          "https://openai.com/policies/privacy-policy"
        ],
        "nanoInvoked": false,
        "contractVersion": "certscore.policy-text-extraction-health.v2",
        "policyTextQuality": {
          "usable": true,
          "codeSignalCount": 0,
          "codeSymbolRatio": 0.0004755776870139316,
          "policyTermCount": 15,
          "alphabeticWordRatio": 0.7809832707408672,
          "accessChallengeSignalCount": 0,
          "naturalLanguageSentenceCount": 186
        },
        "policyUrlRetained": true,
        "extractedTextLength": 35746,
        "policySurfaceObserved": true,
        "detectedPolicyLanguage": "en",
        "minimumTextLengthRequired": 500,
        "policyTextExtractionStatus": "ok",
        "verifiedPolicyDocumentCount": 1,
        "detectedPolicyLanguageSource": "policy_surface",
        "supportedGdprTransparencyLocales": [
          "en",
          "de",
          "fr",
          "es",
          "it",
          "nl",
          "pl",
          "pt",
          "ru",
          "ja",
          "zh",
          "ar",
          "sv",
          "ro",
          "cs",
          "el",
          "hu",
          "da",
          "fi",
          "sk",
          "bg",
          "hr",
          "nb",
          "sl",
          "lt",
          "lv",
          "et",
          "uk",
          "tr",
          "fa",
          "vi",
          "id",
          "ko",
          "th",
          "he",
          "sr",
          "ca",
          "hi",
          "az",
          "gl"
        ],
        "gdprTransparencyLanguageSupported": true,
        "policyTextEvidenceProjectionStatus": "verified_complete",
        "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
      },
      "retainedPolicySectionHeadings": [
        "data controller",
        "retain personal data",
        "right to data portability",
        "Legal basis",
        "data protection officer",
        "Data transfers",
        "Policy section"
      ],
      "selectedPrivacyPolicyDocument": {
        "documentUrl": "https://openai.com/policies/privacy-policy",
        "observationId": "policy_surface_a7464154",
        "traversalDepth": 0,
        "parentSurfaceUrl": null,
        "parentObservationId": null,
        "selectionReasonCodes": []
      },
      "article13_coverage_assessments": [
        {
          "topic": "automated_decision_making_or_profiling",
          "status": "insufficient_retained_evidence",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "policy_absence_coverage_preconditions_not_met",
            "typed_topic_coverage_diagnostic_missing_or_limited",
            "policy_document_content_coverage_incomplete"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "controller_contact",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_retention",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "data_subject_rights",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "dpo_contact",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "international_transfers",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "legal_basis",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "processing_purposes",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "recipients_or_vendor_categories",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        },
        {
          "topic": "supervisory_authority",
          "status": "observed",
          "sourceUrls": [
            "https://openai.com/policies/privacy-policy/"
          ],
          "reasonCodes": [
            "row_specific_disclosure_observed"
          ],
          "coverageStatus": "insufficient",
          "policyDocumentIds": [
            "policy_surface_a7464154"
          ],
          "policyDocumentRoles": [
            "policy_document"
          ],
          "policyDocumentSha256": [
            "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
          ],
          "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
          "unresolvedMaterialPolicyChildUrls": []
        }
      ],
      "discoveredPrivacyPolicyDetails": [
        {
          "url": "https://openai.com/policies/privacy-policy/",
          "status": "fetched",
          "documentFetchState": "fetched",
          "fetchFailureReason": null,
          "linkObservationState": "observed",
          "documentEvaluationState": "usable"
        }
      ],
      "article13DisclosureTypesPartial": [],
      "discoveredPrivacyPolicyStatuses": [
        "fetched"
      ],
      "gdprTransparencyEvidenceProfile": "gdpr_transparency_multilingual_article13_v1",
      "policy_text_evidence_projection": {
        "scanId": "14324058-98b5-4981-9f9c-cf5a76fb78d8",
        "documents": [
          {
            "finalUrl": "https://openai.com/policies/privacy-policy/",
            "artifactId": "policy_surface_text_a7464154_60782e6c",
            "artifactUri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/14324058-98b5-4981-9f9c-cf5a76fb78d8/auxiliary/policy_surface_text_a7464154_60782e6c.txt",
            "contentType": "text/html; charset=utf-8",
            "documentRole": "policy_document",
            "requestedUrl": "/policies/privacy-policy/",
            "observationId": "policy_surface_a7464154",
            "redirectChain": [
              "https://openai.com/policies/privacy-policy"
            ],
            "artifactSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
            "documentFormat": "text",
            "limitationKeys": [
              "policy_section_inventory_bounded",
              "policy_section_text_bounded"
            ],
            "contentCoverage": {
              "status": "truncated",
              "limitationKeys": [
                "policy_section_inventory_bounded",
                "policy_section_text_bounded"
              ],
              "sourceTextChars": 35746,
              "retainedSectionCount": 19,
              "extractedSectionCount": 25,
              "retainedTableRowCount": 0
            },
            "artifactFileName": "policy_surface_text_a7464154_60782e6c.txt",
            "extractionStatus": "complete",
            "artifactSizeBytes": 35943,
            "retainedTextChars": 35746,
            "documentFetchState": "fetched",
            "retainedTextSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
            "targetRelationship": "target_controller",
            "documentOwnerEntity": "EU at OpenAI OpenAI",
            "ownershipConfidence": 0.98,
            "documentTextCoverage": {
              "status": "complete",
              "limitationKeys": [],
              "sourceTextChars": 35746,
              "retainedTextChars": 35746
            },
            "documentEvaluationState": "usable",
            "documentRoleReasonCodes": [
              "multiple_substantive_disclosure_signals_retained"
            ],
            "governingPolicySelection": {
              "rank": 1,
              "score": 85,
              "state": "primary",
              "reasonCodes": [
                "highest_ranked_eligible_governing_policy",
                "target_controller_document",
                "policy_content_coverage_truncated",
                "complete_policy_text_retention",
                "multiple_substantive_disclosure_signals_retained"
              ],
              "contractVersion": "governing_policy_selection.v1"
            },
            "artifactVerificationStatus": "verified",
            "gdprTransparencyTopicCoverageDiagnostics": [
              {
                "topic": "controller_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "405ab9b724029c5a61e1f9c29dc76622014326c684e8c6d79cba80b00e90a5f7",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "processing_purposes",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "c9b9cd96972efe60bd3d8b819cae66d24503d44c29767fc8fe636c42971a4af8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "legal_basis",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "424d2b5338022ed7f636211aabd68f22e2a4c9f6c2ff7e91febbe68adfa7aed4",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "recipients_or_vendor_categories",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "9a110d4782eb9d8915c5ed65d8fd32738930d8c056568f6d96321d31bd774328",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "data_retention",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "5e7c4cd4e32e6728e79edb6cdba4a1adabd501e43e8d41de6c845cb07aef10f8",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "data_subject_rights",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "6a0495caed2380bad264d116cc4cbd1891c33464c1d540e4213d572b7547ae1c",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "canonical_topic_window"
              },
              {
                "topic": "international_transfers",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "7b5c703e11b48fc692f862963c1693c83a3a4c49895006c49f935ca68a696aea",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "dpo_contact",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "2449087cfcf3764e7ed91176b14fe08dc5a133f52e94ade5b3ba112bec7df966",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "supervisory_authority",
                "reasonCodes": [
                  "row_specific_disclosure_observed",
                  "evidence_hash_binding_verified",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "observed",
                "sourceDocumentSha256": "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33",
                "evidenceSectionSha256": "48b0c8476940949a28142f3210b9a452610d82e4a9a376473059e441deb639ca",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated",
                "sectionExtractionMethod": "visible_text_heading"
              },
              {
                "topic": "automated_decision_making_or_profiling",
                "reasonCodes": [
                  "row_specific_disclosure_not_confirmed",
                  "policy_content_coverage_truncated"
                ],
                "coverageState": "limited",
                "contractVersion": "gdpr_transparency_topic_coverage_diagnostic.v1",
                "evaluationState": "unknown",
                "documentRetentionState": "complete",
                "sectionExtractionState": "truncated"
              }
            ]
          }
        ],
        "generatedAt": "2026-10-12T19:31:13.069Z",
        "sourceBundle": {
          "uri": "s3://certscore-v2-dag-local-artifacts-eu-west-1-199536052647/v2-dag-lambda/local/14324058-98b5-4981-9f9c-cf5a76fb78d8/CanonicalEvidenceBundle.json",
          "sha256": "578980d38c9e7998b0a8af3211cb11865174b1fc20a5a293a11b504892b8ef09",
          "sizeBytes": 1866010,
          "schemaVersion": "certscore.v2.alpha.1",
          "verificationStatus": "verified"
        },
        "limitationKeys": [
          "policy_section_inventory_bounded",
          "policy_section_text_bounded"
        ],
        "contractVersion": "certscore.policy-text-evidence-projection.v1",
        "projectionStatus": "verified_complete"
      },
      "privacyPolicyTextCharacterCount": 35746,
      "retainedCookiePolicyTextExcerpt": "",
      "validatedDisclosureTypesPartial": [],
      "article13DisclosureTypesObserved": [
        "data_retention",
        "data_subject_rights",
        "international_transfers",
        "supervisory_authority",
        "dpo_contact",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "retainedArticle13SectionEvidence": [
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "data_retention",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account.",
          "selectedPolicySectionHeading": "retain personal data"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "data_subject_rights",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below).",
          "selectedPolicySectionHeading": "Policy section"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "international_transfers",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to comply with applicable data protection law, such as: We rely on the European Commission’s adequacy decisions ⁠ (opens in a new window) and the UK Secretary of State’s adequacy regulations pursuant to Article 45(1) EU and UK GDPR ( “GDPR” ) when",
          "selectedPolicySectionHeading": "Data transfers"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "supervisory_authority",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Lodge a complaint with your local data protection authority (see below).",
          "selectedPolicySectionHeading": "Legal basis"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "dpo_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Data Protection Officer at [email protected]",
          "selectedPolicySectionHeading": "data protection officer"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "controller_contact",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Data controller If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy.",
          "selectedPolicySectionHeading": "data controller"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "processing_purposes",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "extractionLimitation": "selected_policy_section_truncated_by_retention_limit",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health Privacy Notice ⁠ Research Research Index Research Overview Economic Research Latest Advancements GPT-6.1 Sol GPT-6 Astra GPT-5.6 GPT-5.5 Safety Safety Approach Deployment Safety (opens in a new window) Security & Privacy Trust & Transparency Products ChatGPT (opens in a new window) ChatGPT Business (opens in a new window) ChatGPT Enterprise (opens in a n",
          "selectedPolicySectionHeading": "data protection officer"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "legal_basis",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Object to how we process your Personal Data when our processing is based on legitimate interests.",
          "selectedPolicySectionHeading": "Legal basis"
        },
        {
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "coverageArea": "recipients_or_vendor_categories",
          "evidenceSource": "deterministic",
          "signalObserved": "observed",
          "selectedEvidenceStrength": "strong",
          "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/",
          "selectedPolicySectionExcerpt": "Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers.",
          "selectedPolicySectionHeading": "Policy section"
        }
      ],
      "retainedPrivacyPolicyTextExcerpt": "EU Privacy Policy at OpenAI | OpenAI Skip to main content Research Products Business Developers Company Foundation (opens in a new window) Log in Try ChatGPT (opens in a new window) Research Products Business Developers Company Foundation (opens in a new window) Try ChatGPT (opens in a new window) Login OpenAI Select language … Updated: August 24, 2026 Europe privacy policy 1. Personal Data we collect 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources ( Previous version ⁠ ) For individuals outside the European Economic Area, United Kingdom, and Switzerland, you can read this version ⁠ of our Privacy Policy. At OpenAI, our mission is to ensure that artificial general intelligence benefits everyone. We build tools like ChatGPT to help people learn, create, and solve problems. We at OpenAI (together with our affiliates, “OpenAI”, “we”, “our” or “us”) are committed to respecting your privacy and are strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to personal data that we collect from or about you, and how we use it when you use our website, applications, and services (collectively, “Services”). This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our API. Our use of that data is governed by our customer agreements covering access to and use of those offerings. For information about how we collect and use training information to develop our language models that power ChatGPT and other Services, and your choices with respect to that information, please see this policy as well as this help center article ⁠ (opens in a new window) . 1. Personal Data we collect We collect personal data relating to you (“Personal Data”) as follows: Personal Data You Provide: We collect Personal Data if you create an account to use our Services or communicate with us as follows: Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, date of birth, payment information, and transaction history, (collectively, “Account Information”). Some of our Services may also allow you to upload a profile picture, a username, or other information as part of your Account Information. User Content: We collect Personal Data that you provide in the input to our Services (“Content”), including your prompts and other content you upload, such as files ⁠ (opens in a new window) , images ⁠ (opens in a new window) , audio and video ⁠ (opens in a new window) , and data from connected services ⁠ (opens in a new window) , depending on the features you use. Some of our Services allow you to interact with other users, such as post, comment, or send messages, and we treat those interactions as Content, too. Communication Information : If you communicate with us, such as via email or our pages on social media sites, we may collect Personal Data like your name, contact information, and the contents of the messages you send (“Communication Information”). Contact Data: If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services. If any of your contacts aren’t yet using our Services, we’ll update you if they sign up for our Services later. Learn more ⁠ (opens in a new window) about connecting your contacts and how we use uploaded contact information ⁠ (opens in a new window) of people who don’t use our Services. Other Information You Provide : We collect other information that you provide to us, such as when you participate in our events or surveys, or when you provide us or a vendor operating on our behalf with information to establish your identity or age (collectively, “Other Information You Provide”). Personal Data We Receive from Your Use of the Services: When you visit, use, or interact with the Services, we receive the following information about your visit, use, or interactions: Log Data : We collect information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services. Usage Data : We collect information about your use and activity across the Services, such as the types of content that you view or engage with, the features you use and the actions you take, when you submit feedback to a model response, the people with whom you interact, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection. For Free ⁠ (opens in a new window) and Go ⁠ (opens in a new window) users, we also collect information about your ads history and interests, such as the types of ad content that you view or engage with. If you use the in-app browser we may also collect your browser data according to your controls and use of the service. Device Information : We collect information about the device you use to access the Services, such as the name of the device, operating system, device identifiers, and browser you are using. Information collected depends on the type of device you use and its settings. Location Information: We determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to make your product experience better, for example to protect your account by detecting unusual login activity or to provide more accurate responses. In addition, some of our Services allow you to choose to provide more precise location information from your device, such as location information from your device’s GPS. Cookies and Similar Technologies : We use cookies and similar technologies to operate and administer our Services, and improve your experience. We store some of the information described in this Policy with cookies, for example to help maintain your preferences across sessions if you’re not logged in, or to assist with authentication and customer support. For details about our use of cookies, please read our Cookie Notice ⁠ . Information We Receive from Other Sources: We receive information from other sources, such as our trusted security and safety partners to protect safety and prevent fraud, abuse, and other threats to our Services, and from marketing vendors who provide us with information about potential customers of our business services. We receive information from advertisers and other data partners, which we use for purposes described in this Policy including to help us measure and improve the effectiveness of our Services, including to help us show more relevant ads to Free and Go users on our Services. For example, we could receive information about purchases you make from these advertisers. We also collect information from other sources, like information that is publicly available on the internet, to develop the models that power our Services. For more information on the sources of information used to develop the models that power ChatGPT and other Services, please see this help center article ⁠ (opens in a new window) . 2. How we use Personal Data We use Personal Data for the following purposes: To provide, analyse, and maintain our Services, for example to respond to your questions for ChatGPT; To improve and develop our Services and conduct research, for example to develop new features; To personalize and customize your experience across our Services, for example to provide you with more relevant Content; For Free and Go users, to the extent it is available to you, to personalise the ads you see on our Services (subject to your choices and controls), and to measure the effectiveness of ads shown on our Services. Learn more ⁠ (opens in a new window) about ads on our services; To communicate with you, including to respond to your questions, and send you information about our Services and events, for example about changes or improvements to the Services; Identify your contacts who use our Services when you choose to connect your contacts and update you if they join our Services later; To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services, including by monitoring any Content submitted or exchanged on our platforms (learn more here ⁠ ); and To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, OpenAI, or third parties, for instance to prevent harm to you or others, or to estimate your age to give you an age-appropriate experience. We also aggregate or de-identify Personal Data so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law. As noted above, we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT. Read our instructions ⁠ (opens in a new window) on how you can opt out of our use of your Content to train our models. 3. Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers. We also work with service providers who help us with age and identity verification, and you can learn more here ⁠ (opens in a new window) . Based on our instructions, these parties will access, process, or store Personal Data only in the course of performing their duties to us. Business Transfers : If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a “Transaction”), your Personal Data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets. Government Authorities or Other Third Parties : We may share your Personal Data, including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so to comply with a legal obligation, or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, users, or the public, or (vi) to protect against legal liability. Affiliates : We disclose Personal Data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use this Personal Data in a manner consistent with this policy. Business Account Administrators : When you join a ChatGPT Enterprise or business account, the administrators of that account may access and control your OpenAI account, including being able to access your Content. In addition, if you create an account using an email address belonging to your employer or another organization, we may share the fact that you have an account and certain account information, such as your email address, with your employer or organization to, for example, enable you to be added to their business account. Parent or Guardian of a Teen : Teen users and their parents or guardians can choose to link their accounts, allowing the parent or guardian to manage certain settings, and receive alerts if we detect a serious safety concern. These accounts can be unlinked at any time. Learn more ⁠ (opens in a new window) about account linking. Other Users and Third Parties You Interact or Share Information With : Certain Services allow you to interact or share information with other users or third parties. For example, you can share content like ChatGPT conversations ⁠ (opens in a new window) , or share information with third-party search ⁠ (opens in a new window) and shopping ⁠ (opens in a new window) partners. Information you share with third-party partners is governed by their own terms and privacy policies, and you should make sure you understand those terms and policies before sharing information with them. We also aggregate or de-identify Personal Data so that it no longer identifies you and share it with third parties for the purposes described above, such as to help improve our Services. 4. Retention We’ll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account. For example, you can delete specific, or all, of your ChatGPT conversations, delete specific Memories ⁠ (opens in a new window) , or delete your account. Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to improve our models ⁠ (opens in a new window) . Information we delete automatically: In some cases, Personal Data will be deleted automatically. For example, Temporary Chats ⁠ (opens in a new window) will be automatically deleted within 30 days (unless we have to retain them for safety or legal reasons, as described further below). Information we retain for longer for legitimate security, safety, or legal reasons: In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes. For instance: If specific Content, or your account, is banned because of violations of our usage policies ⁠ , we may retain that data for to protect our services from fraud, abuse, or other violations of our policies; If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation; When we are a party to a financial transaction (for instance, when we process your payment for a ChatGPT Plus or Pro account, or facilitate a purchase on ChatGPT), we may retain payment and transaction related information to meet our accounting, dispute resolution, and regulatory compliance purposes; When you ask us to delete your Personal Data, we retain the audit record of the erasure request to be able to verify that we have complied with the request. In determining these retention periods, we consider a number of factors, such as: Our purpose for processing the Personal Data (such as whether we need to retain it to provide our Services); The amount, nature, and sensitivity of the information; The potential risk of harm from unauthorized use or disclosure; Any legal requirements that we are subject to. 5. Data controls Our Services provide you with a number of controls over your Personal Data and how it is used and retained. You can always change these settings in your account. These include the following controls: You can easily choose whether your Content can be used to improve and train our models ⁠ (opens in a new window) . You can decide whether we will remember details between chats to make Content more personalized and relevant. You can export your ChatGPT history and data ⁠ (opens in a new window) in your account’s data controls. You can delete or archive chats in ChatGPT, or delete your account ⁠ (opens in a new window) entirely. If you enable Temporary Chat ⁠ (opens in a new window) in ChatGPT, those conversations with ChatGPT will not appear in your history or be used to improve OpenAI’s models. Depending on applicable law, you may be able to choose which cookies are used when you use our Services. Free and Go users can use the advertising controls in account settings to control what data we use to personalize the ads we show you on our Services. You can unsubscribe from marketing communications you receive from us by using the choices provided in those communications. You can find more information on data controls here ⁠ (opens in a new window) and by visiting [email protected] 6. Your rights You have the following statutory rights in relation to your Personal Data: Access your Personal Data and information relating to how it is processed. Delete your Personal Data from our records. Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data. Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority (see below). You have the following rights to object: Object to our processing of your Personal Data for direct marketing. Object to how we process your Personal Data when our processing is based on legitimate interests. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section. If you are unable to exercise your rights through your account, please submit your request through privacy.openai.com ⁠ (opens in a new window) or send it to [email protected] ⁠ . If you have any other concerns regarding our processing of your Personal Data, you can write to us at [email protected]. We hope that we are able to address any questions or concerns you may have. If you have any unresolved complaints with us or our Data Protection Officer: If you reside in the European Economic Area, you can reach out to the Irish Data Protection Commission ⁠ (opens in a new window) as our lead supervisory authority, or your local supervisory authority ⁠ (opens in a new window) ; If you reside in the UK, you can reach out to the Information Commissioner’s Office ⁠ (opens in a new window) ; If you reside in Switzerland, you can reach out to the Federal Data Protection and Information Commissioner ⁠ (opens in a new window) . A note about accuracy: Services like ChatGPT generate responses by reading a user’s request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our models. If you notice that ChatGPT output contains factually inaccurate information about you and you would like to request a correction or removal of the information, you can submit these requests through privacy.openai.com or to [email protected], and we will consider your request based on applicable law and the technical capabilities of our models. For information on how to exercise your rights with respect to data we have collected from the internet to train our models, please see this notice ⁠ (opens in a new window) . 7. Children Our Services are not directed to, or intended for, children under 13. We do not knowingly collect Personal Data from children under 13. If you have reason to believe that a child under 13 has provided Personal Data to OpenAI through the Services, please email us at [email protected]. We will investigate any notification and, if appropriate, delete the Personal Data from our systems. Users under 18 must have permission from their parent or guardian to use our Services. Learn more ⁠ (opens in a new window) about how teens and parents or guardians can choose to link their accounts. 8. Security We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you provide to the Services. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites. 9. Legal bases for processing The Personal Data we process, the purposes for which we process it, and the legal bases on which we rely depend on how you use our Services, the features and settings you choose, and the circumstances of the processing. The table below provides more information about these purposes, the categories of Personal Data involved, and the applicable legal bases. In some circumstances, we may ask for your consent to process Personal Data for a specific purpose. Where we rely on consent, you may withdraw your consent at any time. Purpose of processing Type of Personal Data processed, depending on the processing activity Legal basis, depending on the process activity To provide, analyse, and maintain our Services For example, We use your email address and password to authenticate your login. We use your payment card details to process subscription charges or purchases on ChatGPT. We use your prompts and other Content to provide you with responses. We conduct analytics, measurement, and other types of analysis to understand how our Services are used, for example, we analyze usage data to ensure uptime and the reliability and safety of our Services. Account Information User Content Communication Information Other Information You Provide Log Data Usage Data Device Information Location Information Cookies and Similar Technologies Where necessary to perform a contract with you, such as processing your prompts and other Content to provide a response. To personalise and customise your experience across our Services for you. For example, If Memory (opens in a new window) is on, we may remember details you’ve shared across conversations to provide more personalised and consistent responses in future chats. Using information you add in Custom Instructions (opens in a new window) (such as “I like concise answers”) to tailor how the model responds to you. Suggesting conversation topics based on subjects you’ve previously discussed or saved in your Memory (opens in a new window) To give you an age-appropriate experience. Account Information User Content Other Information You Provide Log Data Usage Data Device Information Location Information Cookies and Similar Technologies Where necessary to perform a contract with you, such as following your Custom Instructions to respond to your prompts. Where necessary for our legitimate interests and those of third parties to provide you with a better user experience. For example, to personalise features and content or make suggestions for topics that you may be interested in. Where necessary to comply with a legal obligation (or, where not under a specific legal obligation, where necessary for our legitimate interests and those of third parties), such as to provide you with an age-appropriate experience. When you provide your consent, to personalise the ads you see on our Services. For example: Where ads personalisation is available and “on”, we use past chats to make the ads you see more relevant. Using information about the ads you’ve viewed or interacted with (for example, ads you hide or engage with) to tailor the ads you are shown. Using information provided by advertisers to serve more relevant ads. Our ads system uses the context of your current chat as well as other available information to select the most relevant ads for a given query. Account Information User Content Usage Data (including ads data) Device Information Your consent, for Free and Go users, when we ask for it to personalize the ads you see on our Services. To show you generic ads on our Services where you select the generic ads experience (where you do not have a ChatGPT Plus or Pro account and do not consent to processing for personalised advertising or choose the free, no-ads option with additional limits) For example: Using limited information (e.g. the context of your current ChatGPT chat, location and time of day) to show you ads. Location information Time of day Context of the current chat Device type As necessary for our legitimate interests and those of third parties. For example, displaying generic ads to make powerful and safe AI accessible to everyone and to support the interests of advertisers in reaching users who might be interested in their products/services. To provide measurement and reporting services to advertisers. For example, for Free and Go users we collect and use information such as the types of ad content that you view or engage with to understand on an aggregate basis how users interact with our ads. Advertisers will receive aggregate reporting, such as ad views or clicks. Usage Data (including ads data) Where necessary for our legitimate interests and those of third parties. For example, it is in our interest and the interests of advertisers to provide accurate reporting to enable advertisers to understand how their ads have performed. To improve and develop our Services, and conduct research For example, If training is enabled (see your data controls here (opens in a new window) ) or if you provide feedback, we use the content you share with us to help our models become more accurate and better at solving your specific problems and help improve their general capabilities and safety. We use publicly available content that is freely and openly accessible on the internet, as well as data from third-party partners, to train our models. For Free and Go users, we process your information such as the types of ad content that you view or engage with, to assess the effectiveness of our marketing and advertising efforts in order to improve ad quality. Account Information User Content Communication Information Other Information You Provide Information We Receive From Other Sources Log Data Usage Data (including ads data) Device Information Cookies and Similar Technologies Where necessary for our legitimate interests and those of third parties and broader society, including in developing and improving our Services, such as when we train and improve our models for everyone. See here ⁠ (opens in a new window) for more information. To communicate with you, including to send you information about our Services and events, and to promote our Services to you. Sending updates about feature changes or outages. Sending certain forms of marketing communications. Responding to a request you send through the Help Center. Sending surveys to ask for feedback or input about our products and services. Account Information Communication Information Information We Receive From Other Sources Other Information You Provide Log Data Usage Data Device Information Cookies and Similar Technologies Where necessary to perform a contract with you, such as processing your contact information to send you a technical announcement about the Services. Your consent when we ask for it to process your Personal Data for a specific purpose that we communicate to you. Where necessary for our legitimate interests and those of third parties, for example when sending surveys to ask for feedback, or when sending certain forms of marketing and communications. To identify your contacts who use our Services when you choose to connect your contacts, and to update you if they join our Services later. Contact Data Log Data Device Information Where necessary to perform a contract with you when you choose to connect your contacts on our Services. Where necessary for our legitimate interests and those of third parties, to enable you to connect your contacts and collaborate with people you may know on our Services. To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services For example, Monitoring for suspicious sign-in attempts or unusual activity on your account. Using IP addresses and device identifiers to detect abuse. Retaining information about accounts that violate policies. Account Information User Content Communication Information Other Information You Provide Information We Receive From Other Sources Log Data Usage Data Device Information Cookies and Similar Technologies Where necessary to comply with a legal obligation. Where we are not under a specific legal obligation, where necessary for our legitimate interests and those of third parties, including in protecting our Services from abuse, fraud, or security risks, such as processing data from trusted partners to protect against fraud, abuse and security threats in our Services. To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, OpenAI, or third parties For example, Retaining billing information to comply with financial requirements. Providing information to law enforcement when required by a valid legal request. Investigating and enforcing violations of our Terms of Use, including by monitoring content submitted or exchanged on our platforms (learn more here ). Taking steps to prevent harm, for example notifying parents/guardians when we detect a risk of harm to teen users with linked accounts. Estimating your age to give you an age-appropriate experience. Account Information User Content Communication Information Other Information You Provide Information We Receive From Other Sources Log Data Usage Data Device Information Cookies and Similar Technologies Where necessary to comply with a legal obligation, such as retaining billing information to comply with financial requirements. Where we are not under a specific legal obligation, where necessary for our legitimate interests and those of third parties and broader society, including in protecting our or our affiliates’, users’, or third parties’ rights, safety, and property, such as analyzing log data to identify fraud and abuse in our Services. When necessary to protect the vital interests of you or another person, for example when teen safety alerts are triggered. 10. Data transfers OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK for the purposes described in this policy. This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located. While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to comply with applicable data protection law, such as: We rely on the European Commission’s adequacy decisions ⁠ (opens in a new window) and the UK Secretary of State’s adequacy regulations pursuant to Article 45(1) EU and UK GDPR ( “GDPR” ) when transferring your Personal Data to any country that has been considered to provide an adequate level of protection. For other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission pursuant to Article 46(2)(c) GDPR ( “SCCs” ) and on the UK International Data Transfer Addendum to the SCCs. For more information or to obtain a copy of the appropriate safeguards we have in place when transferring Personal Data, please contact us at [email protected]. 11. Changes to the privacy policy We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law. 12. Data controller If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy. If you live anywhere else, OpenAI OpCo, LLC, with its registered office at 1455 Third Street, San Francisco, California 94158, United States, is the controller and is responsible for the processing of your Personal Data as described in this policy. 13. How to contact us Please contact support ⁠ (opens in a new window) if you have any questions or concerns not already addressed in this policy. Alternatively, you can write to us at [email protected] or the address above under Section 12 (Data Controller). You can contact our Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health Privacy Notice ⁠ Research Research Index Research Overview Economic Research Latest Advancements GPT-6.1 Sol GPT-6 Astra GPT-5.6 GPT-5.5 Safety Safety Approach Deployment Safety (opens in a new window) Security & Privacy Trust & Transparency Products ChatGPT (opens in a new window) ChatGPT Business (opens in a new window) ChatGPT Enterprise (opens in a new window) ChatGPT for Education (opens in a new window) Codex Dots (opens in a new window) Release Notes API Platform Overview API Log In (opens in a new window) Docs (opens in a new window) Business Overview Solutions Resources Plugins Customer Stories Partner Network Contact Sales Developers Apps SDK (opens in a new window) Open Models Docs (opens in a new window) Resources (opens in a new window) Developer Forum (opens in a new window) Company About Us Our Charter Careers News Support Help Center (opens in a new window) OpenAI Status (opens in a new window) More Stories Academy Supply Co. Livestreams Podcast RSS Terms & Policies Terms of Use Privacy Policy Other Policies (opens in a new window) (opens in a new window) (opens in a new window) (opens in a new window) (opens in a new window) (opens in a new window) (opens in a new window) OpenAI © 2015–2026 Manage Cookies English United States",
      "validatedDisclosureTypesObserved": [
        "data_retention",
        "data_subject_rights",
        "international_transfers",
        "supervisory_authority",
        "dpo_contact",
        "controller_contact",
        "processing_purposes",
        "legal_basis",
        "recipients_or_vendor_categories"
      ],
      "privacyNoticeAvailabilityObserved": true,
      "evaluatedPrivacyPolicySurfaceCount": 1,
      "discardedArticle13DisclosureSignals": [
        {
          "source": "deterministic",
          "confidence": 0.88,
          "surfaceUrl": "https://openai.com/policies/privacy-policy",
          "evidenceText": "record of the erasure request to be able to verify that we have complied with the request. In determining these retention periods, we consider a number of factors, such as: Our purpose for processing the Personal Data (such as whether we need to retain it to provide our Services); The amount, nature, and sensitivity",
          "rejectReason": "insufficient_row_specific_terms",
          "disclosureType": "processing_purposes"
        }
      ],
      "staleLegalFrameworkReferenceObserved": false,
      "policyEvidenceProvenanceContractVersion": "certscore.policy-evidence-provenance.v1",
      "gdprTransparencyProductionEvidenceEnabled": true,
      "gdprTransparencyProductionEvidenceDiagnostics": {
        "sourceCandidateCount": 9,
        "candidateDispositions": [
          {
            "topic": "data_subject_rights",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "dpo_contact",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "data_retention",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "controller_contact",
            "confidence": 0.9,
            "disposition": "accepted",
            "matchStrength": "direct",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "international_transfers",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "legal_basis",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "recipients_or_vendor_categories",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "processing_purposes",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          },
          {
            "topic": "supervisory_authority",
            "confidence": 0.86,
            "disposition": "accepted",
            "matchStrength": "equivalent",
            "matchedLocale": "en",
            "rejectionReason": null,
            "sourceObservationId": "policy_surface_a7464154"
          }
        ],
        "acceptedCandidateCount": 9,
        "rejectedCandidateCount": 0,
        "discardedCandidateCount": 0,
        "diagnosticCandidateCount": 0,
        "productionCreditSignalCount": 9
      }
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "legal_basis_disclosure_observed",
  "coverageArea": "Legal basis disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a canonical legal-basis disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.legal_basis_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.legal_basis_disclosure_observed"
  },
  "statusBasis": "Legal basis disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Legal basis disclosure",
      "Excerpt: Object to how we process your Personal Data when our processing is based on legitimate interests.",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.95,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "Object to how we process your Personal Data when our processing is based on legitimate interests.",
      "matchedLocale": null,
      "disclosureType": "legal_basis",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "legal_basis_language_present",
        "verified_retained_topic_evidence",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "legal_basis",
      "originKey": "gdpr_transparency.article13.legal_basis",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.legal_basis",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "retention_disclosure_observed",
  "coverageArea": "Retention disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "note": "Whether retained privacy-policy evidence included a data-retention disclosure signal.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.retention_disclosure_observed.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.retention_disclosure_observed"
  },
  "statusBasis": "Retention disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Retention disclosure",
      "Excerpt: retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account.",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.98,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "retain Personal Data depends on the type of data, how we use it, and in many cases your settings: Information we retain until you delete it: Some of our Services allow you to delete Personal Data stored in your account.",
      "matchedLocale": null,
      "disclosureType": "data_retention",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "retention_period_or_criteria_present",
        "verified_retention_passage_selected",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_retention",
      "originKey": "gdpr_transparency.article13.data_retention",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_retention",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "controller_contact_disclosure",
  "coverageArea": "Controller/contact disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "note": "Whether retained privacy-policy evidence included a controller, privacy contact, or equivalent contact point.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.controller_contact_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.controller_contact_disclosure"
  },
  "statusBasis": "Controller/contact disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Controller/contact disclosure",
      "Excerpt: Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10.",
      "Locale: en",
      "Policy URL: https://openai.com/policies/privacy-policy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://openai.com/policies/privacy-policy",
      "evidenceText": "Children 8. Security 9. Legal bases for processing 10. Data transfers 11. Changes to the privacy policy 12. Data controller 13. How to contact us 14. Useful resources 1. Personal Data we collect 2. How we use Personal Data 3. Disclosure of Personal Data 4. Retention 5. Data controls 6. Your rights 7. Children 8. Security 9. Legal bases for processing 10.",
      "matchStrength": "direct",
      "matchedLocale": "en",
      "disclosureType": "controller_contact",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_controller_contact",
        "match_strength_direct"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy",
      "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
      "artifactRefs": [
        "policy_excerpt_a7464154_f70a177e",
        "policy_surface_text_a7464154_60782e6c"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "lastUpdatedText": "Updated: August 24, 2026",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "EU at OpenAI OpenAI",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "controller_contact",
      "originKey": "gdpr_transparency.article13.controller_contact",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.controller_contact",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "processing_purposes_disclosure",
  "coverageArea": "Processing purposes disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "note": "Whether retained privacy-policy evidence described the purposes for processing personal data.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.processing_purposes_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.processing_purposes_disclosure"
  },
  "statusBasis": "Processing purposes disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Processing purposes disclosure",
      "Excerpt: Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.97,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "Data Protection Officer at [email protected] in matters related to Personal Data processing. 14. Useful resources How your data is used to improve model performance ⁠ (opens in a new window) Data Controls FAQ ⁠ (opens in a new window) Privacy Portal ⁠ (opens in a new window) Memories FAQ ⁠ (opens in a new window) Voice Mode FAQ ⁠ (opens in a new window) Health",
      "matchedLocale": null,
      "disclosureType": "processing_purposes",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "processing_purpose_disclosed",
        "verified_retained_topic_evidence",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "processing_purposes",
      "originKey": "gdpr_transparency.article13.processing_purposes",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.processing_purposes",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "recipients_vendor_categories_disclosure",
  "coverageArea": "Recipients/vendor categories disclosed",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "note": "Whether retained privacy-policy evidence described recipient, vendor, or 3rd party categories.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.recipients_vendor_categories_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.recipients_vendor_categories_disclosure"
  },
  "statusBasis": "Recipients/vendor categories disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Recipients/vendor categories disclosure",
      "Excerpt: Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud service",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.98,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "Disclosure of Personal Data We disclose your Personal Data in the following circumstances: Vendors and Service Providers : To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud service",
      "matchedLocale": null,
      "disclosureType": "recipients_or_vendor_categories",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "named_recipient_categories_present",
        "verified_retained_topic_evidence",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "recipients_or_vendor_categories",
      "originKey": "gdpr_transparency.article13.recipients_or_vendor_categories",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.recipients_or_vendor_categories",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "data_subject_rights_disclosure",
  "coverageArea": "Data subject rights disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "note": "Whether retained privacy-policy evidence described data subject rights or a rights request path.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.data_subject_rights_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.data_subject_rights_disclosure"
  },
  "statusBasis": "Data subject rights disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Data subject rights disclosure",
      "Excerpt: Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data.",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.97,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "Rectify or update your Personal Data. Transfer your Personal Data to a third party (right to data portability). Restrict how we process your Personal Data.",
      "matchedLocale": null,
      "disclosureType": "data_subject_rights",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "substantive_rights_signals_present",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "data_subject_rights",
      "originKey": "gdpr_transparency.article13.data_subject_rights",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.data_subject_rights",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "international_transfers_disclosure",
  "coverageArea": "International transfer disclosure",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "note": "Whether retained privacy-policy evidence described international transfers or transfer-relevant endpoint/vendor context.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.international_transfers_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.international_transfers_disclosure"
  },
  "statusBasis": "International transfer disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: International transfer disclosure",
      "Excerpt: While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to co",
      "Policy URL: https://openai.com/policies/privacy-policy/"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.96,
      "surfaceUrl": "https://openai.com/policies/privacy-policy/",
      "evidenceText": "While data protection law varies by country and these countries may not offer the same level of data protection as your home country, we apply the protections described in this policy to your Personal Data regardless of where it is processed. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on valid transfer mechanisms to co",
      "matchedLocale": null,
      "disclosureType": "international_transfers",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "mini_policy_semantic_review.v2",
      "classifierReasonCodes": [
        "international_transfer_disclosure_present",
        "verified_retained_topic_evidence",
        "policy_review_invariants_applied_v1"
      ],
      "productionCreditProfile": "gdpr_transparency_mini_review_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy/"
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy/",
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "detectedLanguage": "en",
      "translationApplied": false
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "international_transfers",
      "originKey": "gdpr_transparency.article13.international_transfers",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.international_transfers",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "dpo_contact_point_disclosure",
  "coverageArea": "DPO contact point (where applicable)",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "note": "Whether retained privacy-policy evidence identified a designated data protection officer or equivalent statutory DPO contact. A generic privacy mailbox is credited under controller/contact disclosure and does not by itself establish a DPO designation.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.dpo_contact_point_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.dpo_contact_point_disclosure"
  },
  "statusBasis": "DPO contact point (where applicable) evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: DPO contact point (where applicable)",
      "Excerpt: Data Protection Officer at [email protected]",
      "Locale: en",
      "Policy URL: https://openai.com/policies/privacy-policy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.9,
      "surfaceUrl": "https://openai.com/policies/privacy-policy",
      "evidenceText": "Data Protection Officer at [email protected]",
      "matchStrength": "direct",
      "matchedLocale": "en",
      "disclosureType": "dpo_contact",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_dpo_contact",
        "match_strength_direct"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy",
      "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
      "artifactRefs": [
        "policy_excerpt_a7464154_f70a177e",
        "policy_surface_text_a7464154_60782e6c"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "lastUpdatedText": "Updated: August 24, 2026",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "EU at OpenAI OpenAI",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "dpo_contact",
      "originKey": "gdpr_transparency.article13.dpo_contact",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.dpo_contact",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "supervisory_authority_complaint_disclosure",
  "coverageArea": "Supervisory authority complaint",
  "evidenceState": "observed",
  "explanation": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "note": "Whether retained privacy-policy evidence referenced a right to complain to a supervisory authority.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.supervisory_authority_complaint_disclosure.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.supervisory_authority_complaint_disclosure"
  },
  "statusBasis": "Supervisory authority complaint disclosure evidence was retained through adapter-approved multilingual GDPR Transparency Article 13 evidence.",
  "retainedEvidence": {
    "remediation": {
      "kind": "none",
      "steps": [],
      "message": "No remediation is established by this check alone. Retain its evidence and reassess after relevant changes."
    },
    "evidenceRefs": [
      "Evidence: Supervisory authority complaint disclosure",
      "Excerpt: Lodge a complaint with your local data protection authority (see below).",
      "Locale: en",
      "Policy URL: https://openai.com/policies/privacy-policy"
    ],
    "signalObserved": true,
    "article13Signal": {
      "source": "normalized_concern",
      "status": "observed",
      "confidence": 0.86,
      "surfaceUrl": "https://openai.com/policies/privacy-policy",
      "evidenceText": "Lodge a complaint with your local data protection authority (see below).",
      "matchStrength": "equivalent",
      "matchedLocale": "en",
      "disclosureType": "supervisory_authority",
      "evidenceSource": "normalized_gdpr_transparency_article13_concern",
      "productionCredit": true,
      "classifierProvenance": "gdpr_transparency_topic_classifier.v1",
      "classifierReasonCodes": [
        "matched_supervisory_authority",
        "match_strength_equivalent",
        "variant_semantic_clause"
      ],
      "productionCreditProfile": "gdpr_transparency_multilingual_article13_v1",
      "selectedEvidenceStrength": "strong",
      "selectedPolicySectionUrl": "https://openai.com/policies/privacy-policy",
      "selectedPolicySectionHeading": null
    },
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "policyEvidenceAssessment": {
      "result": "disclosure_observed",
      "scoreEffect": "canonical_policy",
      "topicRelevance": "direct",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy",
      "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
      "artifactRefs": [
        "policy_excerpt_a7464154_f70a177e",
        "policy_surface_text_a7464154_60782e6c"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "lastUpdatedText": "Updated: August 24, 2026",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "EU at OpenAI OpenAI",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "gdprTransparencyArticle13Concern": {
      "state": "sufficient",
      "topic": "supervisory_authority",
      "originKey": "gdpr_transparency.article13.supervisory_authority",
      "canonicalConcernKey": "runtime_artifact:gdpr_transparency.article13.supervisory_authority",
      "regulatoryChecklistEligibility": "observed"
    }
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "coverage_limitation",
  "checklistItemId": "automated_decision_making_profiling_disclosure",
  "coverageArea": "Profiling / automated decisions disclosure",
  "evidenceState": "not_testable",
  "explanation": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "note": "Whether adapter-approved Article 13 evidence retained automated decision-making or profiling disclosure context for review.",
  "status": "Not confirmed",
  "tone": "neutral",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.automated_decision_making_profiling_disclosure.not_confirmed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.automated_decision_making_profiling_disclosure"
  },
  "statusBasis": "No production-approved topic match was established. This neutral result does not establish that the disclosure is absent.",
  "retainedEvidence": {
    "remediation": {
      "kind": "steps",
      "steps": [
        "Review the governing policy section for the applicable automated decision-making or profiling disclosures; retain the exact excerpt and source URL.",
        "If relevant wording exists, record it for review and investigate extraction coverage. Unconfirmed evidence alone does not establish a missing disclosure.",
        "Retest the same policy version or record the revised version; verify that the extracted passage supports this specific topic, rather than nearby or unrelated wording."
      ]
    },
    "signalObserved": "not_confirmed_canonical_projection_unavailable",
    "missingEvidenceNeeded": [],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "canonicalProjectionState": "normalized_concern_unavailable",
    "policyEvidenceAssessment": {
      "result": "extraction_incomplete",
      "scoreEffect": "none",
      "topicRelevance": "unknown",
      "contractVersion": "certscore.policy-topic-evidence-assessment.v1"
    },
    "policyEvidenceProvenance": {
      "sourceUrl": "https://openai.com/policies/privacy-policy",
      "policyTitle": "EU Privacy Policy at OpenAI | OpenAI",
      "artifactRefs": [
        "policy_excerpt_a7464154_f70a177e",
        "policy_surface_text_a7464154_60782e6c"
      ],
      "bannerLanguage": "en",
      "contractVersion": "certscore.policy-evidence-provenance.v1",
      "discoveryMethod": "page_text_link",
      "lastUpdatedText": "Updated: August 24, 2026",
      "detectedLanguage": "en",
      "retrievalTimestamp": "2026-10-12T19:31:07.645Z",
      "targetRelationship": "target_controller",
      "translationApplied": false,
      "documentOwnerEntity": "EU at OpenAI OpenAI",
      "ownershipConfidence": 0.98,
      "directlyLinkedFromScannedPage": true
    },
    "selectedEvidenceStrength": "missing",
    "policyTextExtractionHealth": {
      "policyUrls": [
        "https://openai.com/policies/privacy-policy"
      ],
      "nanoInvoked": false,
      "contractVersion": "certscore.policy-text-extraction-health.v2",
      "policyTextQuality": {
        "usable": true,
        "codeSignalCount": 0,
        "codeSymbolRatio": 0.0004755776870139316,
        "policyTermCount": 15,
        "alphabeticWordRatio": 0.7809832707408672,
        "accessChallengeSignalCount": 0,
        "naturalLanguageSentenceCount": 186
      },
      "policyUrlRetained": true,
      "extractedTextLength": 35746,
      "policySurfaceObserved": true,
      "detectedPolicyLanguage": "en",
      "minimumTextLengthRequired": 500,
      "policyTextExtractionStatus": "ok",
      "verifiedPolicyDocumentCount": 1,
      "detectedPolicyLanguageSource": "policy_surface",
      "supportedGdprTransparencyLocales": [
        "en",
        "de",
        "fr",
        "es",
        "it",
        "nl",
        "pl",
        "pt",
        "ru",
        "ja",
        "zh",
        "ar",
        "sv",
        "ro",
        "cs",
        "el",
        "hu",
        "da",
        "fi",
        "sk",
        "bg",
        "hr",
        "nb",
        "sl",
        "lt",
        "lv",
        "et",
        "uk",
        "tr",
        "fa",
        "vi",
        "id",
        "ko",
        "th",
        "he",
        "sr",
        "ca",
        "hi",
        "az",
        "gl"
      ],
      "gdprTransparencyLanguageSupported": true,
      "policyTextEvidenceProjectionStatus": "verified_complete",
      "policyTextEvidenceProjectionContractVersion": "certscore.policy-text-evidence-projection.v1"
    },
    "selectedEvidenceArtifactId": "coverage_policy",
    "article13CoverageAssessment": {
      "topic": "automated_decision_making_or_profiling",
      "status": "insufficient_retained_evidence",
      "sourceUrls": [
        "https://openai.com/policies/privacy-policy/"
      ],
      "reasonCodes": [
        "policy_absence_coverage_preconditions_not_met",
        "typed_topic_coverage_diagnostic_missing_or_limited",
        "policy_document_content_coverage_incomplete"
      ],
      "coverageStatus": "insufficient",
      "policyDocumentIds": [
        "policy_surface_a7464154"
      ],
      "policyDocumentRoles": [
        "policy_document"
      ],
      "policyDocumentSha256": [
        "58aefc3d4dc7d314034598d4a5b7c1d6a503e233f95bcaf4d5c1bd40c0e5af33"
      ],
      "assessmentContractVersion": "gdpr_transparency_article13_coverage_assessment.v1",
      "unresolvedMaterialPolicyChildUrls": []
    },
    "gdprTransparencyReportStatusContract": "observed_not_confirmed_no_match_found.v1"
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}

{
  "assessmentStatus": "checked",
  "checklistItemId": "cookie_notice_policy_availability",
  "coverageArea": "Cookie notice / cookie policy availability",
  "evidenceState": "observed",
  "explanation": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "note": "Whether a cookie notice, cookie policy, cookie settings surface, or equivalent cookie disclosure surface was retained.",
  "status": "Observed",
  "tone": "warning",
  "pipeline": {
    "projectionStage": "coverage_policy",
    "concernPolicyKey": "gdpr_eprivacy_coverage.cookie_notice_policy_availability.observed",
    "ws01EvidenceRole": "observed runtime signal identification, evidence capture, and logging",
    "wc01NormalizedConcernKey": "gdpr_eprivacy.coverage.cookie_notice_policy_availability"
  },
  "statusBasis": "A durable cookie disclosure surface was retained in the tested context; a granular named-cookie inventory or preference interface was not confirmed.",
  "retainedEvidence": {
    "evidenceRefs": [
      "Evidence: cookie policy or cookie disclosure surface retained",
      "Not confirmed: granular named-cookie inventory",
      "Not confirmed: cookie preference interface",
      "Policy URL: https://openai.com/policies/privacy-policy"
    ],
    "cookiePolicyUrls": [
      "https://openai.com/policies/privacy-policy"
    ],
    "cookiePolicyPresent": true,
    "cookieNoticeObserved": true,
    "observedPolicyTopics": [
      "cookies",
      "analytics",
      "advertising",
      "sale_or_share",
      "third_party_disclosures",
      "vendor_list"
    ],
    "missingEvidenceNeeded": [],
    "observedPolicyControls": [
      "consent_withdrawal"
    ],
    "selectedEvidenceReason": "Selected the strongest retained canonical coverage evidence available for this row.",
    "weakerArtifactsIgnored": [],
    "selectedEvidenceStrength": "moderate",
    "selectedEvidenceArtifactId": "coverage_policy",
    "preferenceInterfaceConfirmed": false,
    "granularCookieInventoryConfirmed": false
  },
  "projectedFindings": [],
  "missingOrIncompleteSourceSignals": []
}