--- title: Create a Behavior-First AI Usage Policy | MakePolicy.ai, a tool by Maro description: "Cognitive security made simple: build a custom AI usage policy with clear secure actions, approved apps, use cases, and behavior guidelines tailored to your business." image: https://seekmaro.com/hubfs/feature-ai-policy-2.png --- ## Privacy Policy × **MakePolicy.ai Privacy Policy** *Effective Date: July 9, 2025* MakePolicy.ai is a tool by **Maro** designed to help you build and export a custom AI usage policy. We respect your privacy and only collect what's necessary to improve your experience and provide relevant follow-up. ### What We Collect If you choose to provide them, we may collect the following: - **Email address** - **Usage data**: basic usage activity metrics (e.g., page views, clicks, form completions) **Note:** Any text entered into the policy builder remains in your browser session and is not stored on our servers. ### What We Don't Do - We do **not** store your full completed policy or inputs beyond the data above. - We do **not** sell your data. ### Use of Third-Party Services We use **HubSpot** to manage communication and engagement. If you provide your information, it may be processed through HubSpot to: - Deliver your policy PDF - Share relevant product updates or content from Maro should you opt in - Help us understand how users interact with the app HubSpot acts as a **data processor** on our behalf. Your data is never sold or shared outside of Maro's systems. You can opt out or request deletion at any time by contacting [beatrice@seekmaro.com](mailto:beatrice@seekmaro.com). ### GDPR and CCPA Compliance If you're located in the **European Union** (GDPR) or **California** (CCPA), you have the right to: - Access or receive a copy of any personal data we've collected - Request correction or deletion of your information - Opt out of communications or data processing To exercise these rights, email us at [beatrice@seekmaro.com](mailto:beatrice@seekmaro.com). We respond to all valid requests within the legally required timelines. We do not knowingly collect information from anyone under 16 years of age. ### Your Control - You may use MakePolicy.ai without submitting any personal information. - You can unsubscribe or request for your data to be deleted at any time. - For any questions or privacy-related concerns, contact [beatrice@seekmaro.com](mailto:beatrice@seekmaro.com). ## Help Us Improve MakePolicy.ai × We're always looking for ways to improve our tools. Let us know: # MakePolicy.ai ## Create a behavior-first AI usage policy in just a few simple steps Made with ♥ by [Maro, Your Cognitive Security Agent](https://seekmaro.com/?utm_campaign=18255177-AI%20Usage%20Governance&utm_source=makepolicyai&hsLang=en) 1 Organization 2 Secure Actions 3 AI Apps 4 Use Cases 5 Behavior Guidelines 6 Final Review ## Organization Context Let's get started! We just need a bit of information about your organization to recommend Behavior Guidelines tailored to your needs. Company Name Industry Select your industry... Energy, Utilities, Manufacturing Finance, Banking, Insurance Government, Defense Healthcare Retail, E-Commerce Technology, Software Other Select Applicable Compliance Frameworks Choose the compliance frameworks your organization must adhere to. This will automatically apply relevant behavior controls. #### HIPAA Health Insurance Portability and Accountability Act - Healthcare data protection #### HITECH Health Information Technology for Economic and Clinical Health Act #### PCI-DSS Payment Card Industry Data Security Standard - Payment data protection #### GLBA Gramm-Leach-Bliley Act - Financial privacy protection #### SOX Sarbanes-Oxley Act - Financial reporting and corporate governance #### SOC 2 Service Organization Control 2 - Security, availability, and confidentiality #### ISO/IEC 27001 Information Security Management Systems standard #### NIST CSF NIST Cybersecurity Framework - Comprehensive security guidance #### FISMA Federal Information Security Management Act - Government security #### CMMC Cybersecurity Maturity Model Certification - Defense contractor security #### NERC CIP North American Electric Reliability Corporation Critical Infrastructure Protection #### ISA/IEC 62443 Industrial Automation and Control Systems Security #### CCPA / CPRA California Consumer Privacy Act / California Privacy Rights Act #### GDPR General Data Protection Regulation - European privacy law Company Size #### Small Business 1-50 employees #### Medium Business 51-500 employees #### Large Enterprise 500+ employees AI Maturity Level Exploring Implementing Mature #### Exploring Just starting to evaluate AI tools Risk Tolerance Conservative Balanced Progressive #### Balanced Moderate controls with productivity focus ## Secure Actions and Habits Define the specific secure behaviors and operational habits that all users must adopt when engaging with AI systems. #### Verify Tool Approval Check the approved AI tools list before using any new AI service. When in doubt, submit an access request. #### Use Your Corporate Email Always register or sign in to AI tools using your corporate identity, not personal email addresses. #### Check Input Sensitivity Before submitting prompts or data to any AI, ask: "Would this violate confidentiality if shared externally?" When in doubt, do not input. #### Use Secure Network Environments Interact with AI tools only on company-managed or secured devices. Avoid public networks without VPN access. #### Turn off Data Sharing for Model Training Disable settings that allow prompts or data to be used for model training. This helps prevent unintended retention or reuse of sensitive information. #### Store Outputs Responsibly Save AI-generated outputs only in approved internal systems or secure shared drives. Avoid copying outputs to unsecured personal documents. #### Review for Hallucinations or Violations Always fact-check AI outputs, verify claims, and ensure content aligns with company policies before using. #### Avoid Sharing Chat Details Externally Keep AI conversation history private. Don't share screenshots of prompts or responses outside the company. #### Report Unusual or Concerning Behavior Contact the security team immediately if AI provides unexpected, inappropriate, or concerning responses. #### Reinforce Feedback Loops When provided, use thumbs up/down, rating systems, and feedback mechanisms to help improve AI behavior and safety. ## AI Apps Define which AI apps are or aren't approved for use. You can also add a custom list at the bottom. #### ChatGPT General Purpose • OpenAI's conversational AI platform Approved Denied #### Claude General Purpose • Anthropic's AI assistant for various tasks Approved Denied #### DeepSeek General Purpose • An open-source AI chatbot platform Approved Denied #### Google Gemini General Purpose • Google's AI assistant and chatbot Approved Denied #### Microsoft Copilot General Purpose • Microsoft's AI assistant integrated with Office 365 Approved Denied #### Perplexity General Purpose • An AI-powered answer engine Approved Denied #### Cursor Developer Tool • AI code editor Approved Denied #### GitHub Copilot Developer Tool • AI-powered code completion and generation tool Approved Denied #### Bolt Prototyping • AI-powered app builder Approved Denied #### Lovable Prototyping • Create apps and websites by chatting with AI Approved Denied #### v0.dev Prototyping • Vercel's pair programming AI for prototying Approved Denied #### Canvas Magic Studio Creative & Design • Power your ideas with AI Approved Denied #### Figma Make Creative & Design • AI-driven, prompt-to-code design tool Approved Denied #### Miro AI Creative & Design • Turn ideas into reality with AI Approved Denied #### DALLE-E Image Generation • Create images from text Approved Denied #### Midjourney Image Generation • GenAI image and video creation Approved Denied #### Stable Diffusion Image Generation • Convert text to images Approved Denied #### Fireflies.ai Notetaker • Transcribe, summarize, and analyze meetings with AI Approved Denied #### Otter.ai Notetaker • The AI meeting agent Approved Denied #### ** Add an AI app Add Cancel ## Approved Use Cases Define which use cases are and aren't approved for use. Each section contains the top 5 use cases by department. You can also add custom use cases at the bottom. #### ** Add a use case Add Cancel ## Behavior Guidelines Define comprehensive behavioral guidelines for AI interactions across all data protection and security categories. #### Personal Information Confidentiality Data Protections • Do not share or discuss any PII such as SSNs, biometric data, home addresses, etc. Data must be anonymized or pseudonymized to meet GDPR, CCPA, and HIPAA standards. #### Health Information Confidentiality Data Protections • Do not share or discuss PHI or any medical data including diagnosis, treatment plans, insurance numbers. Ensure compliance with HIPAA, classify and encrypt such data. #### Credit Card Information Security Data Protections • Do not expose any card-related data including numbers, CVV, expiration dates, or tokens. Protect sensitive financial data under encryption policies. #### Financial Information Confidentiality Data Protections • Do not disclose internal financial data like revenue, pricing, forecasts, salaries, or contracts. This includes historical and projected figures. #### Trade Secrets Protection Data Protections • Keep confidential any business methodologies, product designs, R&D, customer lists, and strategies. #### Third Party Information Protection Data Protections • Don't disclose vendor contracts, pricing, or partnership details. #### Customer Information Protection Data Protections • Do not share customer data like usage metrics, support history, contracts, or feedback. #### Employee Data Confidentiality Data Protections • Keep internal employee data like compensation, reviews, background checks, and contracts confidential. #### Legal Information Confidentiality Data Protections • Do not share details of litigation, legal strategy, audits, or attorney-client communication. #### R&D Information Protection Data Protections • Protect information about prototypes, development roadmaps, and experimental data. #### Merger Acquisition Confidentiality Data Protections • Do not disclose any information related to acquisitions, valuations, or deal structures. #### Competitive Intelligence Protection Data Protections • Avoid sharing market share analysis, competitor comparisons, or strategic insights. #### Regulatory Compliance Information Protection Data Protections • Do not expose audits, control tests, or regulatory documentation. #### Source Code Confidentiality Technology Protections • Do not share application code, config files, algorithms, or deployment scripts. #### Infrastructure Information Security Technology Protections • Do not share network diagrams, server configs, backup protocols, or S3 bucket locations. #### Authentication Credentials Protection Access Protections • Do not share any credentials like API keys, MFA secrets, passwords, or SSH keys. #### Privileged Access Information Security Access Protections • Keep information about admin accounts, permission structures, or escalation procedures secure. #### Internal Communications Confidentiality Communication Protections • Do not expose internal emails, Slack messages, planning docs, or employee feedback. #### Security Incident Information Control Communication Protections • Do not disclose security incident details, breach reports, or vulnerability data. #### ** Add a behavior guideline Add Cancel ## Final Review Your AI policy is ready! Simply share your email to download it and don't forget to get approval from your legal team before rolling out. ✅ Form submitted! Click below to access your AI Policy downloads: Access My Downloads Download Your AI Policy Doc   Download as HTML Download as PDF Download as Markdown Previous Next Step ### Your AI Policy Preview Start filling out the wizard to see your comprehensive behavior-focused policy take shape in real-time.