We read the fine print of the AI agents I actually use

You've heard me talk about AI personal assistants. I think personal assistants work very well, under certain conditions. But one of the things I care about the most is: where is my data actually going? Who has access to it? Who can buy it? Who can sell it? And is that data anonymized at all?

I've tried all of them. Mind you, and this is probably worth another post, I actually don't think any of the personal assistants out there are huge game changers yet. I use Instinct to find me good wine, and good deals from estate sales. I've used Muse and dots for different things, like dealing with an electrician or a plumber. And all of them, funny enough, failed at rescheduling a FedEx shipment. Although I can't blame them. Most humans would fail at that too.

An agent is not a chatbot. It's given my email, my calendar, sometimes my card, and it's told to go do things while I'm doing something else. So I thought: what could be an interesting way to use bem to actually understand what my rights are, as a customer and as a consumer, when I use these products?

Two more launched while I was writing this, xAI's Grok Bot and Perplexity's Teammates, so they're in too.

01. The graph

24 documents, about 80,000 words of fine print from dots (OpenAI), Muse (Meta), Instinct, Grok Bot (xAI) and Perplexity Teammates, captured November 9. We used bem to map every clause that answers one of my questions. 90 lines, each one quoted word for word and linked to its source.

Red would surprise most people, grey is worth knowing, green dashed protects you. Tap any line to open the exact paragraph.

My questions turned out to be everyone's. The sections follow what surveys say people worry about most.

02. If it spends my money, who pays?

Muse: "you bear all risk of financial loss arising from such actions and your use of Muse."

Only 14% of Americans are OK with AI placing orders for them (YouGov), and half think the AI company should pay for a bad purchase (Riskified). The terms say the opposite.

• Muse: Meta's $250 cap covers "ANY CLAIM ARISING FROM MUSE TAKING ANY UNINTENDED, ERRONEOUS, OR UNAUTHORIZED ACTION."
• Instinct: deals your agent makes "shall be binding on you as if entered into directly by you." And if they get Instinct sued, you "defend, indemnify and hold the Company Entities harmless."
• Grok Bot: "A card saved in Vault fills in at checkout without a separate approval each time."
• Perplexity: "Computer doesn't undo work it already did in a connected app, such as edits to an online store."
• dots has a real guardrail: "The most sensitive actions like changing a password or transferring money require you to take over."

Everyone else caps what they owe you at $100.

Honestly, I understand why the loss is put on the user. Nobody knows yet how to insure an agent. But then we need to be told, in plain words, before we hand over a card. Not halfway down a supplemental terms document.

03. Who can see my stuff?

Grok Bot: "In a group chat, your Bot can use what you told it in your private chat."

71% of Americans expect AI to make their information less secure (Pew). With agents, that means your inbox: link Google to Instinct and it can "access, copy, collect, and index data from your Connected Services."

Humans read it too. At dots, review can happen "even when model improvement is turned off." At Meta it "may be automated or manual (human)." Meta even tested a human concierge in Muse, then rolled it back.

And xAI's agent lives on a Cursor account: "Grok Bot uses Cursor authentication and account data settings."

04. Can I make it forget?

dots: "You currently cannot view, delete, or directly modify individual dot memories."

Remembering you is the point. Forgetting is another story.

• Muse: "After you delete something, Muse may still 'remember' information it learned from what you deleted."
• Grok Bot: "A Bot decides on its own when something is worth keeping. It doesn't ask first." And "There is no memory screen for a personal Bot."
• Perplexity: "Turning Memory off does not clear existing memories." At least you can delete them one by one.
• Instinct: "even if you disconnect a Connected Service, we may still use the indexed Connected Service Input data."

05. Is it training on me?

Perplexity: "Previously collected training data cannot be deleted or removed."

It's on by default at Muse, Instinct and Perplexity. At dots it's a setting. At Instinct and Perplexity, opting out only works going forward.

Credit where it's due: Meta strips "names, email addresses, phone numbers and Social Security Numbers" before training, and Cursor won't train on Grok Bot inputs unless "you've explicitly agreed" (or they're flagged or reported).

06. Can they sell it? Is it anonymized?

Instinct shares with "Third-party business partners who may use the information for their own purposes."

Four of the five say flat out they don't sell your data. Meta: "We don't sell any of your information to anyone, and we never will."

• Instinct: those partners get it "on an aggregate / anonymized basis, or otherwise in accordance with applicable law." That "or otherwise" does a lot of work.
• OpenAI: "We don't 'sell' Personal Data." Their quotes. Same paragraph: "we may share limited data with select marketing partners."
• Perplexity: doesn't sell, but does "share data with third parties to measure the performance of our advertising."
• Muse: your chats stay out of Meta's ad systems. That matters, after Meta started using AI chats to target ads last December.

On anonymizing, the bar is low. OpenAI removes identifiers "where possible." Perplexity won't re-identify your data, "except to test our deidentification methods."

07. 10 gotchas from the fine print

1. Instinct can say "I agree" for you. It may "confirm your acceptance to the terms and conditions of any such third party service." Terms all the way down. (Instinct terms)
2. Delete Grok Bot, lose Cursor. "Grok Bot uses your Cursor account, so deleting it deletes the Cursor account." (Grok Bot FAQ)
3. Whose brain is it, anyway? Perplexity: "New teammates use Claude Opus 5.5 by default." Grok Bot "does not show the underlying model for a request." (Perplexity teammates, Grok Bot FAQ)
4. Muse can't beat a CAPTCHA. No "circumventing any paywalls or CAPTCHAs." The robot still can't prove it's not a robot. (Muse terms)
5. Get banned and your errands die mid-air. "any pending or in-progress actions may be cancelled without completion." Half-booked electrician, anyone? (Muse terms)
6. Close the laptop, the Bot keeps going. "Closing the app, laptop, or phone does not stop a background turn or routine." (Grok Bot FAQ)
7. There's no off switch. Perplexity: "There's no account setting to turn off Computer." (What is Computer)
8. Meta will pay you to hack it. "We'll pay bounties for successful prompt injection attacks." I respect that. (How we built safety into Muse)
9. Instinct trains on you. You can't train on Instinct. You may not use it "to improve or train other AI models, tools or technologies." (Instinct terms)
10. Instinct can robo-text you ads, "including by an automatic telephone dialing system," "including for marketing purposes." (Instinct terms)

08. What I'm doing differently

• Training is off everywhere. It takes a minute.
• No saved cards. Approvals for anything that costs money.
• No passwords in chat. Use the sign-in flows.
• I assume disconnecting an app doesn't delete what the agent already read.

09. How we built it with bem

We captured 24 documents from the live pages on November 9, signed out, US English, one evidence pack per agent with numbered paragraphs. A bem workflow, agent-fine-print, read the five packs in parallel, each in 30 seconds or less. One schema turned clauses into lines: the question, who gets what, a plain-English claim, and the exact quote with its paragraph, checked word for word against the source.

That's what we care about at bem. Teams use bem to build AI-native products that understand any kind of data, make multi-layered decisions, and leave an audit trail on every run. Here, the audit trail is every line in the graph.

We'll re-run this when these documents change. They will.

Not legal advice. It's what five companies' own documents say, quoted, as of November 9, 2026.