"Exa presents a high-risk privacy profile (68/100) comparable to major ad-tech platforms, driven by aggressive collection of query data and sensitive information for AI model training, broad third-party sharing with unspecified data enrichment partners, extensive tracking technologies, and vague data retention policies. Most concerning is the explicit use of user queries for model training without active safeguards against personal data inclusion, combined with the refusal to honor Do Not Track signals and reliance on manual email-based deletion requests. The service's disclosure to 'data partners' and 'enrichment companies' without specificity, coupled with indefinite retention timelines, creates significant downstream privacy risks."
exa Privacy Concerns & Scorecard
Exa collects data from third-party enrichment companies and data partners without explicit user consent, including publicly available information about users. No active monitoring prevents personal information from being included in training data.
Query data and user content are disclosed to customers through service use. Data is shared broadly with vendors, affiliates, professional advisors, and third parties in business transactions. Sharing with 'data partners' and 'data enrichment companies' is vague and unspecified.
Limited opt-out options for data use. Cookie blocking is offered but may break functionality. Do Not Track is explicitly not honored. Data deletion requests must be submitted via email to privacy@exa.ai with no guaranteed timeline or scope.
Data retention policies are not specified in the privacy policy. No explicit timelines, deletion mechanisms, or retention limitations are provided, creating indefinite retention risk.
Exa deploys tracking technologies (cookies, pixels) to monitor user interactions, measure engagement, and tailor user experience. The service explicitly does not honor Do Not Track signals, and third parties also use tracking technologies on the service.
Policy uses vague language regarding data partner sharing and does not clearly explain how user information is protected when used for model training or shared with enrichment companies.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, service authentication, and communication
Service delivery and AI model training
Payment processing and service provisioning
Service functionality, analytics, and tracking
Service personalization and analytics
Analytics, performance monitoring, engagement measurement, and user experience tailoring
Data enrichment and potentially AI model training
Account creation and authentication
Cross-Platform Tracking
Exa collects information from third-party login services (Google, LinkedIn, X, Discord) and shares data with external data enrichment companies. The service does not describe cross-site behavioral tracking on other websites, but cookies and tracking pixels are used to monitor user interactions, and third parties also deploy tracking technologies on Exa's platform.
Tracking Methods:
First-Party Cookies
Cookies set by Exa to track user sessions, preferences, and interactions on the Exa website
Third-Party Tracking Pixels
Tracking pixels deployed by third parties to monitor user interactions and enable retargeting or analytics across services
Device Identifiers
Persistent device identifiers and IP addresses used to recognize returning users across sessions
AI & Data Training
exa uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Search Queries
All user search queries are collected and explicitly used for AI model training. No active monitoring prevents personal information in queries from being used for training purposes.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed exa
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.