Act-On
Based exclusively on public evidence • 20 criteria (Privacy + AI)
Last review: 21 Feb 2026
AI Trust Summary
- •Regarding AI: it does not document the retention of AI prompts and responses, which creates privacy uncertainties.
- •Regarding Basic Privacy: it does not mention a Data Processing Agreement (DPA), which could compromise legal compliance in the processing of contact data.
Safer Alternatives
Higher-rated software in the same category
Attention Points in AI (3)
AI criteria that require attention. Buy the Premium Analysis to see all 3 criteria.
- •Act-On
- •Retention of AI prompts and responses is not defined, which creates privacy uncertainties.
- •Features that use AI are not identified, raising distrust about data usage.
- •Require a specific clause on AI data retention in the contract.
AI data retention (prompts and responses) is not disclosed
There is no information about the retention of contact data used in AI interactions, which can create privacy uncertainties.
Features using AI are not identified in the policy
The lack of description about which features use AI can generate distrust about the use of contact data.
Ethical AI principles and anti-bias measures not documented
The absence of ethical commitments regarding the use of AI can raise concerns about bias and discrimination in contact data.
Source: vendor public documents
Compliances in AI (3)
AI criteria the company meets. Buy the Premium Analysis to see all 3 criteria.
- •Act-On
- •Purposes for processing contact data are clearly listed, facilitating transparency.
- •Retention periods for contact data are specified, ensuring security.
- •These practices strengthen due diligence by demonstrating a commitment to user privacy.
Use of artificial intelligence clearly disclosed in policies
The policy mentions automated functionalities, which is relevant for understanding how Act-On uses technology in marketing.
Automated AI decisions explained in an understandable way
The policy offers a basic explanation of how automated decisions are made, helping to understand the use of contact data.
Contestation and human review of AI decisions available
The policy allows users to contest automated decisions, which is important for protecting consumer rights.
Source: vendor public documents
Highlights in Privacy (3)
Most relevant criteria for this category. Buy the Premium Analysis to see all 3 criteria.
Data Processing Agreement (DPA) not available for customers
The lack of a DPA can create uncertainties about legal compliance in the processing of contact data.
Processing purposes clearly listed by data category
The policy connects contact data categories with specific purposes, ensuring transparency for marketing campaigns.
Data retention period clearly stated
The policy informs specific retention periods for contact data, which helps ensure compliance and security.
Source: vendor public documents
Critical Alerts
- •Funcionalidades que utilizam IA não são identificadas na política: Crucial para a transparência sobre o uso de tecnologia em marketing..
- •Acordo de Processamento de Dados (DPA) não disponível para clientes: Crucial para a segurança jurídica e proteção dos dados de contato dos clientes.
Conformance analysis (20)
Purposes for processing contact data clearly listed
Reference: ISO/IEC 27701 (7.3)
Contact data retention period clearly informed
Reference: ISO/IEC 27701 (7.4.6)
Recipients of contact data clearly identified
Reference: ISO/IEC 27701 (7.3)
Source: vendor public documents
Follow this company and access all 20 criteria
Track score changes, get alerts on policy updates, and view the full conformance analysis
Don't miss any update
Sign up to follow this company and track changes in privacy and AI scores
Why trust the AITS Index: Open Community Audit
Public transparency, peer review and open evidence trails — all verifiable by the community
Trust guarantees
Peer review
users, professionals and experts confirm or contest items online.
Public history
vendor and index changes are versioned and accessible.
Participate
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
Act-On Marketing Automation: Privacy and Security Insights
Transparency in Data Processing Purposes
Act-On excels in providing clear information regarding the purposes for which it processes contact data. This transparency is crucial for users who want to understand how their data is being utilized. With an OPTI Base (Privacy) Score of 61%, Act-On ensures that users can easily access information about data processing activities, which is essential for compliance with regulations like GDPR and LGPD. Knowing the specific purposes helps users make informed decisions about their data sharing, fostering trust between the platform and its users.
Clear Data Retention Periods
Another strength of Act-On is its explicit communication of data retention periods. Users can find detailed information on how long their contact data will be stored, which is vital for compliance with privacy laws. This clarity allows users to manage their data more effectively and ensures that they are not retaining unnecessary information longer than needed. By understanding retention policies, users can align their data management practices with legal requirements, minimizing risks associated with data breaches or non-compliance.
Uncertainty in AI Data Retention
Despite its strengths, Act-On has notable weaknesses, particularly concerning its handling of AI-generated data. The platform does not specify retention periods for prompts and responses generated by its AI functionalities. This lack of clarity can lead to uncertainties regarding user privacy, as users may not know how long their data is being stored or how it is being used. For users concerned about privacy, it is essential to inquire directly with Act-On about these practices and seek assurances regarding the management of AI data.
Lack of Identification for AI Features
Another significant weakness is that Act-On does not clearly identify which features utilize AI in its privacy policy. This omission can leave users unaware of potential risks associated with AI functionalities. Users should be proactive in understanding which features may involve AI and assess whether they align with their privacy expectations. It is advisable to reach out to Act-On for detailed information on AI features and their implications for data privacy.
Absence of a Data Processing Agreement (DPA)
A critical area of concern for users is the absence of a Data Processing Agreement (DPA) from Act-On. Without a DPA, users may face challenges in ensuring compliance with legal frameworks such as GDPR and ISO 27701. This absence can expose users to risks related to data handling and processing. To mitigate this risk, users should consider discussing the need for a DPA with Act-On and explore alternative platforms that provide clear agreements to protect their data rights.
Practical Steps for Enhanced Privacy Management
To enhance privacy management while using Act-On, users should take specific precautions. First, review the settings related to data sharing and AI functionalities. Disable any features that are not essential for your marketing efforts, especially those that involve AI, until you have clarity on their data handling practices. Additionally, regularly audit your data retention settings to ensure compliance with your organization's policies and legal obligations. Finally, consider seeking legal advice to understand your rights under GDPR and LGPD, ensuring that your data processing practices align with these regulations.
Other Marketing Automation software
Dive into in-depth research and analysis of each player
Source: vendor public documents
Related articles about Act-On
Analyzed Sources
Public documents used in the audit of Act-On:
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
Scope & Limitations
TrustThis/AITS assessments are based exclusively on publicly available information, duly cited with date and URL, following the AITS methodology (privacy & AI transparency).
The content is indicative in nature, intended for screening and comparison, not replacing internal audits.
TrustThis/AITS does not perform invasive tests, does not access vendor technology environments and does not process customer personal data. Conclusions reflect only the vendor's public communication at the date of collection.
Source: vendor public documents