

Copper
Based exclusively on public evidence • 20 criteria (Privacy + AI)
Last review: 21 Feb 2026
AI Trust Summary
- •In AI: it does not document the retention of AI inputs/outputs, which creates uncertainty about the management of interaction data.
- •In Core Privacy: it offers detailed retention periods for contact data, ensuring clarity in data processing operations.
Safer Alternatives
Higher-rated software in the same category
Attention Points in AI (3)
AI criteria that require attention. Buy the Premium Analysis to see all 3 criteria.
- •Copper
- •does not document the retention of AI prompts and responses, creating uncertainties about the management of interaction data.
- •does not mention mechanisms for contesting automated decisions, limiting user rights.
- •it is necessary to require specific contractual clauses to mitigate these risks.
AI data retention (prompts and responses) is not disclosed
The policy mentions retention of interaction data, but does not clearly inform about AI data retention, creating uncertainties.
Ethical AI principles and anti-bias measures not documented
The policy mentions commitment to privacy, but does not address ethical practices regarding AI use.
AI decision contestation mechanism not available
The policy mentions user rights, but does not offer a clear mechanism to contest automated decisions.
Source: vendor public documents
Compliances in AI (3)
AI criteria the company meets. Buy the Premium Analysis to see all 3 criteria.
- •Copper
- •documents the purposes of contact data processing, ensuring transparency in operations.
- •provides data processing agreements, ensuring compliance with LGPD and GDPR.
- •these practices strengthen due diligence and trust in data management.
Policy on data use for AI training clearly stated
The policy mentions the use of data to improve services, but does not clarify whether contact data is used to train AI.
AI training opt-out control available
The policy offers cookie management options, but there is no specific opt-out for data use in AI.
Use of artificial intelligence clearly disclosed in policies
The policy mentions automated systems, but does not explicitly declare the use of artificial intelligence.
Source: vendor public documents
Highlights in Privacy (3)
Most relevant criteria for this category. Buy the Premium Analysis to see all 3 criteria.
Processing purposes clearly listed by data category
The policy connects contact data categories with specific purposes, ensuring transparency in operations.
Data retention period clearly stated
The policy specifies detailed retention periods for contact data, promoting clarity and compliance.
Personal data recipients clearly identified in the policy
The policy identifies categories of contact data recipients, ensuring security and compliance in transfers.
Source: vendor public documents
Critical Alerts
- •Princípios de IA ética e medidas anti-viés não documentados: Importante para garantir que o uso de IA não cause discriminação ou viés nos dados de contatos..
- •Mecanismo de contestação de decisões de IA não disponível: Crucial para garantir que os usuários possam contestar decisões que impactam seus dados de contatos.
Conformance analysis (20)
Purposes of contact data processing clearly listed
Reference: ISO/IEC 27701 (7.3)
Contact data retention period clearly informed
Reference: ISO/IEC 27701 (7.4.6)
Recipients of contact data clearly identified
Reference: ISO/IEC 27701 (7.3)
Source: vendor public documents
Follow this company and access all 20 criteria
Track score changes, get alerts on policy updates, and view the full conformance analysis
Don't miss any update
Sign up to follow this company and track changes in privacy and AI scores
Why trust the AITS Index: Open Community Audit
Public transparency, peer review and open evidence trails — all verifiable by the community
Trust guarantees
Peer review
users, professionals and experts confirm or contest items online.
Public history
vendor and index changes are versioned and accessible.
Participate
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
Understanding Copper's Privacy and AI Governance: Strengths and Weaknesses
Privacy Strength: Clear Data Processing Purposes
Copper excels in transparency regarding the purposes of data processing for contacts. This clarity is crucial for users who want to understand how their data is being utilized. With a solid OPTI Base (Privacy) Score of 72%, Copper provides a detailed list of data processing purposes, ensuring that users are informed about how their information is used. This transparency aligns with GDPR and LGPD requirements, allowing users to exercise their rights effectively. Users should regularly review these purposes to ensure they align with their expectations and compliance needs.
Privacy Strength: Defined Data Retention Periods
Another strength of Copper is its clearly defined data retention periods for contact data. This feature is essential for users who prioritize data management and compliance with regulations like GDPR and ISO 27701. Knowing how long your data will be retained helps you make informed decisions about your data privacy. Users are encouraged to check the retention settings in their account to ensure they are comfortable with the specified time frames and to adjust them if necessary.
Privacy Weakness: Undefined AI Data Retention
Despite its strengths, Copper has notable weaknesses, particularly in its handling of AI-related data. The absence of a defined retention period for AI prompts and responses raises concerns about data management and user privacy. This lack of clarity can lead to uncertainty regarding how long your interactions with the AI are stored and used. Users should be cautious and consider limiting their use of AI features until more transparency is provided. Regularly checking for updates on this aspect can help mitigate risks.
Privacy Weakness: Lack of Ethical AI Documentation
Copper's failure to document ethical AI principles and anti-bias measures is another significant weakness. This lack of transparency can lead to potential biases in AI outputs, which may affect decision-making processes. Users should be aware of this risk and consider implementing additional checks or balances when relying on AI-generated insights. Engaging with Copper's support team to express concerns about this issue may also encourage them to enhance their documentation and practices.
Practical Guidance: Reviewing Settings and Features
To maximize privacy and security while using Copper, users should regularly review their account settings. Ensure that data retention periods align with your compliance requirements and that you understand the implications of the AI features you are using. Enabling notifications for updates related to privacy practices can also keep you informed about any changes that may affect your data.
Practical Guidance: Exploring Alternatives
If the weaknesses in Copper's AI governance are concerning, users may want to explore alternative CRM solutions that offer stronger documentation and ethical guidelines for AI usage. Researching other platforms that prioritize transparency in AI practices can provide peace of mind and better compliance with privacy regulations. Additionally, consider reaching out to Copper for clarification on their AI policies, as user feedback can drive improvements in their offerings.
Other Sales CRM software
Dive into in-depth research and analysis of each player
Source: vendor public documents
Analyzed Sources
Public documents used in the audit of Copper:
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
Scope & Limitations
TrustThis/AITS assessments are based exclusively on publicly available information, duly cited with date and URL, following the AITS methodology (privacy & AI transparency).
The content is indicative in nature, intended for screening and comparison, not replacing internal audits.
TrustThis/AITS does not perform invasive tests, does not access vendor technology environments and does not process customer personal data. Conclusions reflect only the vendor's public communication at the date of collection.
Source: vendor public documents






