We Read Everything a Company Publishes, Then Check It Against Itself.
We do not read one privacy policy and write a summary. We read every page that describes how a product handles data — the privacy notice, the data protection agreement, the list of other companies that touch the data, the AI disclosure, the terms. Then we check whether those pages agree with each other.
Collect The Evidence
We read what the company has published: privacy pages, data protection agreements, the list of other companies that touch the data, AI disclosures, trust centres, terms and public regulatory records.
Write It Down As Facts
Each finding becomes one fact, with the sentence it came from, the page it was on and the date we read it.
Draw The Chain
We put the facts in order: the company, the product, who else handles the data, which AI providers are involved, and which countries it passes through.
Say What It Means For You
Then we say what the buyer is left with: what is missing, what is still unresolved, and what the rules in your country ask you to show.
Facts are researched. Conclusions are derived. Uncertainty is recorded.
Most Problems Are Not Inside One Document. They Are Between Two.
- A supplier may advertise regional hosting while naming processors elsewhere.
- It may identify an AI provider without clearly stating where inference occurs.
- It may publish a sub‑processor list that covers infrastructure but does not clearly explain model providers.
- It may describe a retention period for customer data while saying something different about AI inputs, support logs or derived states.
- It may offer several deployment modes while documenting only one in detail.
“All customer data is hosted in the EU.”
A support processor is listed in a third country.
The two published statements do not reconcile. Whether support access is covered by the hosting claim cannot be established from the public record. The discrepancy is recorded with both sources attached.
BlackSnow does not resolve those tensions by guessing. We identify the discrepancy, attach the evidence and determine whether the processing position can be established from the published record.
An incomplete public record does not automatically prove illegality. It does show that the customer may be unable to independently establish the full processing chain or demonstrate every obligation that may attach to it.
The Research Is The Product.
The screens are the easy part. The work is the reading behind them.
We keep five answers apart, because they are five different things: Published, Partly, Not Published, Consistent across documents, and Not Determined. “They have not published it” and “we could not settle it” are not the same sentence, and a method that turns them into one word has invented a finding.
Every assessment names its evidence, carries the date it was read, and says which version of the method produced it.
Jurisdiction Research
Forty countries read against their own rules — what may leave, where it may go, and who can demand it once it lands.
Evidence Standard
A written standard says what counts as evidence, so the answer does not depend on who did the reading.
Versioned Method
When the method improves, we read the company again. We never quietly upgrade an old finding.