Answers for builders and their agents

Short, practical legal information on AI products, agents, and app privacy. Every guide has a Markdown version and a checklist an agent can run against a codebase.

• How should my agent handle users' passwords and logins?

  Delegated access versus stored passwords, the security and breach-notification duties that come with holding credentials, and a safer design.

• Can my AI agent give legal, health, or financial help?

  Where general information ends and licensed advice begins, the rules that apply to AI in law, health, and finance, and how to design and market these products.

• Who is responsible when my agent uses another company's website?

  Website terms, anti-hacking laws, and bot detection when an agent browses, logs in, or transacts on sites you don't control, and how to design for it.

• What should I do when a user says my agent did something they didn't authorize?

  The first hours after an agent makes a purchase, sends a message, or deletes something a user says they never approved. Contain, preserve, assess, and respond.

• Can my AI agent buy things for users?

  The legal questions behind agents that book, buy, and pay for users, including authority, errors, payments, merchant terms, and disclosure.

• How do I keep legal advice privileged when my agent talks to my lawyer?

  Attorney-client privilege when an AI agent carries your communications with counsel, including the model account it runs on, where advice ends up, and a handling checklist an agent can follow.

• Can I send user data to an LLM provider?

  What to check before user data goes into prompts sent to a model provider's API, including provider terms, your own promises, sensitive data, and logging.

• Is it risky to use session replay or analytics SDKs in my app?

  Why session replay, autocapture, and tracking pixels lead to lawsuits and enforcement, and how to configure analytics so your privacy policy stays true.

• Do I have to tell users they're talking to an AI?

  When US state laws and the EU AI Act require an AI disclosure, what a good disclosure looks like, and how to check your product for it.

• What should the terms of service for an AI product cover?

  The sections an AI product's terms need beyond a standard SaaS template, from outputs and accuracy to acceptable use, training, and agent actions.

• Can I train or fine-tune a model on my users' data?

  What decides whether user or customer data can be used for training, including promises already made, contracts, sensitive data, and the risk of having to delete a model.

• Does Washington's My Health My Data Act apply to my app?

  Who the law covers, what counts as consumer health data, and the checklist an app has to meet. Written for developers and the coding agents working for them.