← All pages

1. What the document is: Alibaba Cloud (Singapore) Private Limited's Privacy Policy for Qwen Chat. A 2026-04-09 rewrite expanded its scope to the broader "Qwen Studio" product line at qwen.ai, and the company rebrands itself from "Alibaba" to "Qwen" in the same update.

What this wiki found — complete, every page

Presence facts, not verdicts — each flagged term links to its definition and the exact clause on this page. Absence of a badge means the term isn't currently flagged here, not that the page is risk-free.

Qwen Chat – Privacy Policy

Dataset: GenGA (Generative AI Governance Archive) — 11 AI services, 2025–present

GenGA (Generative AI Governance Archive) is this wiki’s Generative-AI dataset: raw policy snapshots captured by the Open Terms Archive genai-eu project across 11 GenAI providers (ChatGPT, Claude.ai, DeepSeek, Google Generative AI Services, Le Chat, Llama API, Meta AI, Microsoft Copilot, Perplexity, Qwen Chat, xAI). Unlike PGAv2, GenGA has no pre-tagged risk scores — all risk scoring and keyword tagging on these pages is LLM-assigned by direct reading, spanning 2025–present.

Note: This page contains documented policy clauses. Risk assessment is qualitative and context-dependent. For analysis of patterns across platforms, see:

• AI Act Substance Matrix
• Tier Bifurcation
• Scraper Enforcement Gap
• Methodology

Source: sources/GenGA/Qwen Chat/Privacy Policy/ (raw Markdown captures, Open Terms Archive genai-eu dataset — no pre-tagged JSONL exists for this source) Last updated: 2026-04-09

Note on methodology: No pre-computed risk_score/keyword fields exist for this source. Keyword tags and clause analysis on this page are LLM-assigned, using the same rubric/vocabulary as the PGAv2 pages plus new GenAI-specific tags (train AI/models, feedback, gdpr). Treat as first-pass analysis, not externally verified ground truth. This wiki’s risk-scoring system was retired project-wide on 2026-06-21 (see methodology.md §4) — no page, GenGA included, computes or displays a numeric risk score.

Overview

1. What the document is: Alibaba Cloud (Singapore) Private Limited’s Privacy Policy for Qwen Chat. A 2026-04-09 rewrite expanded its scope to the broader “Qwen Studio” product line at qwen.ai, and the company rebrands itself from “Alibaba” to “Qwen” in the same update.

2. Input rights: Training on “De-identified User Content” and Feedback rests on a legitimate-interests legal basis, not consent: “To improve the accuracy and quality of our services (including our AI models)… Legitimate interests (to provide you more accurate and helpful services).” No opt-out for this specific use is described in any of the four captured dates — unlike the opt-out-by-default pattern seen elsewhere in this dataset (ChatGPT, Claude.ai consumer tiers).

3. Output restrictions: Not addressed in this document.

4. Non-explicit predatory clauses: A Feedback mechanism nearly identical to Claude.ai’s: “If you rate an output in response to a prompt—for example, by using the thumbs up/thumbs down icon—we will store the related conversation as part of your feedback.” No compensation or opt-out is described.

5. Regulatory references: GDPR citations were added for the first time on 2026-04-09. Earlier captures (2025-11-11 through 2026-03-19) contain no GDPR reference at all. The rewrite adds Article 45 (adequacy decisions) and Article 46 (Standard Contractual Clauses) citations for transfers out of the EU/EEA/Switzerland/UK — matching the citation style ChatGPT’s and Claude.ai’s Privacy Policies use elsewhere in this dataset.

6. Regional variation: The data-residency disclosure changed substantively on 2026-04-09. Earlier versions disclosed storage/processing in “Singapore, Indonesia, and/or China”; the rewrite narrows this to “Singapore and Mainland China” and adds a new disclosure that corporate-group entities in those two countries get “limited remote access” to data “under strict security controls and authorization approval protocols.” This is a more detailed disclosure than the original, though not necessarily a narrower one in practice.

7. Key risk to users: Moderate. The main risk is the legitimate-interests (not consent/opt-out) basis for using de-identified content and Feedback to train AI — users have no described way to stop it. The China/Singapore data-residency and intra-group remote-access disclosures are a secondary concern, echoing (on a smaller scale) DeepSeek’s data-residency disclosures elsewhere in this dataset.

Flagged Keywords & Risks (LLM-assigned)

• train AI/models — “To improve the accuracy and quality of our services (including our AI models) | De-identified User Content, Feedback | Legitimate interests.” Why it matters: no opt-out is described for this use, in any of the four captured dates — it relies on legitimate interests, not consent.
• feedback — Thumbs up/down rating triggers storage of “the related conversation as part of your feedback,” with no compensation or stated opt-out. Why it matters: the same UI-driven feedback capture used by Claude.ai.
• gdpr — Article 45/46 GDPR citations were added on 2026-04-09 (previously absent entirely). Why it matters: a genuine compliance upgrade that brings Qwen Chat in line with how other major providers in this dataset cite GDPR.

Regulatory & Research Context

Qwen Chat was not among the providers studied by Davidson et al. (2026) or Pandit et al. (2026), but Pandit et al.’s finding that GenAI consumers face terms imposing “significant imbalance of power” applies by analogy to this page’s train AI/models clause, which justifies training on a legitimate-interests basis with no described opt-out across any of the four captured dates — a notably weaker user control mechanism than the opt-out toggles Pandit et al. observed among the providers they did examine. Edwards et al. (2025) note that privacy disclosures often demand “reading comprehension abilities at university level,” which is relevant here given that the GDPR Article 45/46 citations were added only in the 2026-04-09 rewrite, alongside a narrowed but still cross-border data-residency disclosure (Singapore and Mainland China, with intra-group “remote access”) that a reader must parse carefully to understand.

Changes Summary

Version History

2025-11-11

• Explicit AI clause: YES
• Non-explicit predatory: YES
• Flagged keywords: train AI/models, feedback

Clause: train AI/models

To improve the accuracy and quality of our services (including our AI models) | De-identified User Content, Feedback | Legitimate interests (to provide you more accurate and helpful services).

Clause: feedback

Feedback: We appreciate feedback, including ideas and suggestions for improvement or rating an output in response to a prompt. If you rate an output in response to a prompt—for example, by using the thumbs up/thumbs down icon—we will store the related conversation as part of your feedback.

Clause: data residency (not separately concept-tagged)

We generally provide the Services from Singapore, and our group companies and their designated service providers are generally located in Singapore, Indonesia, and/or China. Your personal data if therefore generally processed in one or both of these countries.

2026-04-09

train AI/models/feedback unchanged from 2025-11-11 (see above).

Clause: gdpr (new)

When we transfer your personal data outside of the European Union, European Economic Area, Switzerland or the United Kingdom, we ensure that it benefits from an adequate level of data protection by relying on: (a) Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR… (b) Standard contractual clauses. The European Commission has approved contractual clauses under Article 46 of the GDPR that allows companies subject to the GDPR to transfer data outside the European Union and European Economic Area.

Clause: data residency (updated wording)

We store or process personal data described in section I. How We Collect Your Personal Data in Singapore and Mainland China. Certain entities in our corporate group located in Singapore and Mainland China are given limited remote access to this data so they can provide certain important functions… Any such access is limited, secure and only granted where necessary under strict security controls and authorization approval protocols.