Summarize with AI
An AI data privacy page for your website should answer five questions in plain sentences: what customer data reaches the model, whether you train on it, how long you keep it, which companies process it, and where your security audit stands today. Put it at /trust or /security, link it from the footer and the pricing page, and print the date you last changed it.
For an AI startup this page is not paperwork. The person who reads it is usually not the person who found you. It is the IT or security lead who has to approve a new vendor, and he opens it before he ever looks at pricing. If the page gives him nothing he can write down, the deal stops at his desk, and nobody tells you that is where it stopped.
An HR answers bot and the one person who has to approve it
Picture an example company. Its product is a Slack app that answers employees' HR questions. Someone types how many days of parental leave do I get, and the bot replies from the company handbook, with the page it used. Anything it cannot answer goes to a person on the People team. It is not a client of ours. It is a common shape for an AI product right now.
The buyer is the head of people at a 300-person logistics company. She ran a 14-day trial with one warehouse office, and her team stopped answering the same leave question five times a day. She wants it. But the company has a rule: any tool that touches customer data needs a yes from IT, and IT is one man.
He does not open pricing. He scrolls to the footer and clicks Trust. The page is headed Your data, protected. Under it sits a padlock illustration and three cards: Encrypted end to end, Privacy first, Enterprise ready. At the bottom, one line: We take your privacy seriously. Questions? Email privacy@. There is no date. The word train appears nowhere. Neither does the name of a model provider, or the word delete, or a number of days.
He knows what people type into an HR channel when they think only HR is reading. A sick note. A pay dispute. A pregnancy, before the manager has been told. He needs to know where that text goes once it leaves Slack. He adds the vendor to his approvals sheet, sets the status to Waiting, and types a note: sends staff questions to an AI model, not sure which one, not sure if they keep it. Then he goes back to the twenty other things in his queue.
Why it looks like a price problem from the founder's chair
The founder watches the trial from his admin panel. The head of people logged in eleven times in week one, twice in week two, and then not at all. The trial ends. He extends it by fourteen days. He sends a calendar link. He offers 20 percent off the first year. The reply is polite and short: still waiting on internal approval.
He knows every answer the IT manager wanted. They do not train on anyone's questions, and their contract with the model provider says the provider will not either. Question history is deleted a month after a customer disconnects. An audit firm is booked for SOC 2. All of it lives in his head and in a Slack thread with his CTO. The page says We take your privacy seriously, a line he wrote late at night before launch and has not read since.
That is the whole problem in one picture. He knows his product and nobody else does, and the one reader who can say no was shown a padlock.
What a parked approval costs an AI company
A stalled approval never shows up as a lost deal. It shows up as a trial that went quiet. Product-led SaaS benchmarks put opt-in free trial conversion around 18 percent, and every trial that dies in an IT queue counts against that number. The founder reads it as weak activation or a price objection, so he fixes onboarding or cuts the price. Neither one reaches the man with the approvals sheet.
The discount hurts more than it looks. AI product builders average around 52 percent gross margin, against 70 to 80 percent for traditional software, because model calls sit inside the cost of every answer. A 20 percent discount offered to fix a trust gap comes out of that thinner margin, and the trust gap is still there afterwards.
Then there is the raise. Carta's Q1 2026 data puts the Series A bar for AI startups around 3.5 million in ARR, up from roughly one million three years earlier. Across all sectors, the median gap from seed to Series A is around 616 days. Mid-size customers are how a company like this one gets there, and each of them sends the link to someone like him.
Not yet, said plainly, beats a page with nothing on it
The usual advice is to wait. Finish the audit, then put up a trust center with a row of badges. I think that gets the order backwards. The IT manager's job is to find the gaps. A page that names its own gaps lets him finish in ten minutes. A page with no visible gaps tells him they are hidden somewhere, and he goes looking by email.
Be exact about what you have. A SOC 2 Type I report is a point in time check that your controls are designed correctly. Type II tests whether they actually ran over a period of months. So a line like SOC 2 Type I: audit underway with an independent firm, report expected Q1 2027 is something he can copy into his sheet word for word. For a cautious team he may still answer not yet. But he answers today, with a reason, and you know when to come back.
One question is specific to AI, and it is the one where silence costs most. A normal software privacy page never had to say whether customer data trains a model. On an AI product it is the first thing a careful reader checks, and if the page does not answer it, he assumes the answer is yes.
The same page, rewritten line by line
Here is the example company's Trust page after a rewrite. It is the same length as a long email, and it reads top to bottom in this order.
The header says Trust: how we handle your employees' questions, with Last updated 2 October 2026 underneath. The first block is titled What we send. When an employee asks a question, we send the question and the three handbook passages that match it to our model provider to write the answer. We do not send the employee's name, email or Slack profile.
Next comes Training. We do not train any model on your employees' questions or on your handbook, and our contract with our model provider does not allow them to. Then Retention, by type of data. Questions and answers are kept for three months so your People team can review them, then deleted. Your handbook copy is deleted a month after you disconnect. System logs hold message IDs but no message text, and they are kept for two weeks.
Then a small table headed Who processes your data, with three rows. The model provider, named, writes answers in the United States. The cloud host, named, stores the handbook and question history in the US or the EU, your choice. The error tracker, named, receives crash reports with no message text. Under the table: we email account owners a month before we add a new company to this list. Buyers with European customers look for that line, because Article 28 of the GDPR expects a processor to tell its customer about new subprocessors in time to object. Ask your own lawyer what applies to you. This post is not legal advice.
Then Audit status, three rows. SOC 2 Type I: underway, report expected Q1 2027. SOC 2 Type II: not started. Penetration test: completed August 2026, summary on request. Last, Contact: questions go to the CTO by name at a security@ address, and the same address takes vulnerability reports, with a reply within two working days.
Every line on that page is something the IT manager can check, quote or ask a follow-up about. The row that reads not started does more for the deal than the padlock ever did, because it proves the rest of the page is not decoration. Every detail above is an illustration. Write only what is true for your own product, and change the page the day any of it changes.
Six things to write before Friday
- Ask whoever answers security emails for the last ten questions buyers sent. That list is the outline of your page.
- Write one sentence on training. If the true answer depends on the plan, say which plan and what changes.
- Write retention as a number of days for each kind of data: inputs, outputs, logs, backups.
- List every company that touches customer data, starting with your model provider, with what it does and where. Put a date above the list.
- Write your audit status as rows, including the ones that say not started, and give each finished item a month and each planned one a quarter.
- Link the page from the footer, from the pricing page next to the plan IT will approve, and from the screen where a customer connects their data.
Then read the page as the IT manager would. Could he fill in his approvals sheet without emailing you? If not, the missing answer is your next line.
The page is for the second reader, and so is the rest of the site
The trust page is one place where a site has to speak to two rooms at once. We designed and built the Mi-VAD website around that problem: a heart pump company whose site talks to investors deciding whether it is real and to clinicians deciding whether it is safe. The champion and the approver are the same pair in different clothes.
The same questions come back inside the product once the pilot starts, and designing AI products for security and healthcare buyers covers the screens a reviewer opens there. If you sell a security product, the whole site carries this load, and what a cybersecurity website must prove goes further than a single page.
Studio Maydit is the web and product design studio we run for AI founders in the US, UK and Europe, building in Framer, Webflow or custom code. Our website design work is about making a stranger understand what kind of company you are, and for a company selling to teams with an IT department, that stranger is often the one reading your trust page. Most projects run as a fixed scope of three to four weeks. If your trials keep going quiet while someone waits on internal approval, book a 30 minute call.
