Four checks to see whether your LLM vendor retains prompts, and what your privacy docs should say

The article argues that SaaS privacy policies often omit how LLM vendors handle customer data, which GDPR and CCPA reviewers and enterprise security questionnaires now ask about. It lists four checks: naming the model provider as a subprocessor, stating prompt retention duration, confirming a training opt-out in writing, and listing the vendor with its purpose and region. The author says small AI-chat SaaS trust pages commonly pass only one or two of these, most often missing retention and opt-out terms. Suggested fixes include adding a sentence per failing check sourced from the vendor's API data-usage page and updating the subprocessor list. The piece also promotes a paid command-line tool that automates the scoring, which the author discloses as their own product.