VirusTotal
- The policy allows AI training; it does not describe an opt-out.
- Your data is used to target ads at you; you can opt out.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
Google’s privacy policy plus Cloud terms: lots of activity and ads data, you keep your files, fees often non-refundable.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
Account info, what you upload, device IDs, activity, location, and data from partner sites.
Read the exact line
Privacy policy
“We collect information about the apps, browsers, and devices you use to access Google services, which helps us provide features like automatic product updates”
Training
They use it to run products, personalize ads, measure ads, and they train AI on public data.
Read the exact line
Privacy policy
“we use publicly available information to help train Google’s AI models and build products and features like Google Translate, Gemini Apps, and Cloud AI capabilities.”
Sharing
They say they do not sell personal info; they share with providers, partners, and if the law requires.
Read the exact line
Privacy policy
“Google does not sell your personal information. Google also does not “share” your personal information as that term is defined in the ().”
Kept
The documents do not say a fixed number of days they keep data after you delete it.
Read the exact line
Privacy policy
“We explain how Google retains information in Retaining your information. You can also learn more about how Google data.”
Controls
You can review activity, ads, and delete or export data in your Google Account tools.
Read the exact line
Privacy policy
“These tools allow you to access, review, update and delete your information, as well as export and download a copy of it.”
Fine print
Cloud fees can auto-renew, usually no refunds; you may have to cover their legal costs; California courts.
Read the exact line
Terms of service
“Unless expressly stated otherwise in this Agreement or required by law, termination or non-renewal under any section of this Agreement (including the Cloud Data Processing Addendum or any Order Form) will not oblige Google to refund any Fees.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off or limit personalized ads
My Ad Center / ad settings in your Google Account
Review and delete saved activity
My Activity in your Google Account
Export or delete your information
Google Account privacy tools described in the privacy policy
Cancel auto-renew in Admin Console
Admin Console, at least 15 days before some Order Terms end
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They say they train AI on information that is already public, not clearly on your private VirusTotal uploads.
Read the exact line
Privacy policy
“we use publicly available information to help train Google’s AI models and build products and features like Google Translate, Gemini Apps, and Cloud AI capabilities.”
For example, a news article about you could be used to train a Google AI product.
Your activity can be used to pick ads unless you change ad settings.
Read the exact line
Privacy policy
“Depending on your settings, we may also show you personalized ads based on your interests and activity across Google services.”
For example, searching for bikes on Google could lead to bike ads on YouTube.
If someone sues Google because of your data or how you used the service, you may have to pay Google’s legal costs.
Read the exact line
Terms of service
“Customer will defend Google and its Affiliates providing the Services and them against Liabilities in any Third-Party Legal Proceeding”
For example, if a file you uploaded leads to a lawsuit, you might have to cover Google’s lawyers.
If you cancel, they usually keep the money you already paid.
Read the exact line
Terms of service
“Unless expressly stated otherwise in this Agreement or required by law, termination or non-renewal under any section of this Agreement (including the Cloud Data Processing Addendum or any Order Form) will not oblige Google to refund any Fees.”
For example, you cancel mid-month and they do not give unused days back.
They collect location, including precise location depending on settings, which is more than a file scanner needs.
Read the exact line
Privacy policy
“Your location informationWe collect location information when you use our services, which helps us offer features like driving directions, search results for things near you, and ads based on your location.”
For example, GPS or nearby Wi-Fi can be used for ads near you.
Under Cloud terms, you still own the data you put in.
Read the exact line
Terms of service
“As between the parties, Customer retains all Intellectual Property Rights in Customer Data and Customer Applications, and Google retains all Intellectual Property Rights in the Services and Software.”
For example, a report you upload stays yours, not Google’s copyright.
They claim they do not sell personal information under California’s definition of sale.
Read the exact line
Privacy policy
“Google does not sell your personal information. Google also does not “share” your personal information as that term is defined in the ().”
For example, they say they will not sell your name to a data broker as a “sale.”
For generative AI on Cloud, they may log prompts to check for abuse.
Read the exact line
Terms of service
“Google uses automated safety tools to detect abuse of Generative AI Services.”
For example, a prompt that looks like abuse can be stored so they can review it.
Many customers must sue in California courts.
Read the exact line
Terms of service
“ALL CLAIMS ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SERVICES WILL BE GOVERNED BY CALIFORNIA LAW, EXCLUDING THAT STATE'S RULES, AND WILL BE LITIGATED EXCLUSIVELY IN THE FEDERAL OR STATE COURTS OF SANTA CLARA COUNTY, CALIFORNIA, USA”
For example, a dispute over billing would go to Santa Clara County, not your local court.
You can change personalized ads in Google’s ad settings.
Read the exact line
Privacy policy
“You can control what information we use to show you ads by visiting your ad settings in My Ad Center.”
For example, you open My Ad Center and turn off personalized ads.
Words to know
Legal words from the lines above, in plain English.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- governing law
- Which country's or state's laws are used to settle any dispute, no matter where you live. For example, a user in Ohio may find the terms are judged under California law.
- venue
- The specific court or city where any lawsuit must be filed, which may be far from where you live. For example, a user in Florida may have to travel to a court in San Francisco to sue.
How we got here · grade C · score 43/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
Google’s policy collects device IDs, activity, location (including GPS depending on settings), partner-site activity, and more than a scanner needs.
Does it record your voice, face or body, and what happens to that?
They collect audio and similar media from interactions and biometric data if you choose to provide it; voice can be recorded for activation commands.
Are your chats and uploads used to train AI models, and is that off by default?
They say they use publicly available information to train AI models and use collected information to develop new services; no VirusTotal-specific training opt-out is described.
Can employees or contractors read your conversations, and when?
They analyze content to detect abuse such as spam, malware, and illegal content; Cloud generative AI tools may log prompts to check abuse.
Are you profiled or tracked for advertising?
They show personalized ads from your activity and let you control this in My Ad Center.
Do they sell or share your data, and can you opt out?
They say they do not sell or CCPA-share personal information, but they process data for advertising and share with providers and partners; ad controls exist.
What rights do they take over what you type and what the AI makes?
Cloud terms say you keep intellectual property rights in Customer Data; Google keeps rights in the services.
How long do they keep your data after you delete it, and can you delete it in the app?
They offer Google Account tools to access, delete, and export information, but these documents do not give a 30- or 90-day wipe deadline.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They save activity and ad-interest inferences; you can manage activity in My Activity and ads in My Ad Center.
Do they commit to basic security, and have they leaked data?
Cloud terms say Google maintains technical, organizational, and physical measures described in a data processing addendum.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
Cloud terms may be updated by posting; material URL-term updates often take effect after 30 days. The privacy text has no date line.
Can they close your account without warning, and can you get your data out first?
Google may terminate Cloud services for convenience with 30 days’ notice; access to customer data then ends unless otherwise stated.
If something goes wrong, who pays?
Services are as-is with capped liability, and you must indemnify Google for claims from your data or AUP breaches.
Do subscriptions renew on their own, and can you get a refund?
Some Cloud plans auto-renew; they say termination generally does not require them to refund fees.
The privacy policy is 7,149 words at a professional or legal expert level (Flesch reading ease 19.9); the terms are 8,469 words at a college level.
