Your Divi AI content goes to an open-ended list of outside AI companiesSERIOUS
DATA SHARING
Anything you send to Divi AI is passed to OpenRouter, which then hands it to other AI companies. The policy names OpenAI, Anthropic, and Google but says 'without limitation,' so the list can grow without telling you. Which company gets your request can also change from request to request, so you can't know in advance who is handling your content.
“These providers may include, without limitation, OpenAI, Anthropic, Google, and other providers that OpenRouter makes available. The provider used for a particular request may vary based on factors such as the requested feature, model availability, performance, and service requirements.”
What you can do — If you build sites for clients, don't paste client content, private business details, or anything under a confidentiality agreement into Divi AI. Use it only with material you'd be comfortable handing to an outside AI company.
Broad sweep of what an AI request carries with itMATERIAL
DATA COLLECTION
A Divi AI request doesn't just send your prompt. It can also include images, code, and website content you make available to the feature, the surrounding context, the answers you get back, and technical usage data. That's a wide net, and more of your site's material may leave Elegant Themes than you'd expect from typing a short prompt.
“Information transmitted in connection with a Divi AI request may include your prompts and instructions; text, images, code, website content, or other materials that you submit or make available to the feature; relevant context needed to process the request; generated responses; and associated technical and usage information.”
What you can do — Before using Divi AI on a page, check what content sits on it — the feature may send surrounding page material, not just what you type.
How long the AI companies keep your data is out of your handsMATERIAL
DATA RETENTION
Once your information reaches OpenRouter or an AI provider, their retention rules apply, not Elegant Themes'. The policy says those rules 'may change from time to time,' so data you sent under one set of rules could end up kept longer under another. Elegant Themes' own deletion request form won't reach data sitting on a third party's servers.
“Information shared with these third parties is subject to their applicable terms, privacy policies, data-processing practices, and retention requirements, which may change from time to time.”
What you can do — Read OpenRouter's privacy policy and check whether the AI providers it routes to train on or retain submitted data before you use Divi AI for anything sensitive.
Elegant Themes disclaims responsibility if an AI provider mishandles your dataMATERIAL
LIABILITY LIMITS
If OpenRouter or one of the AI companies behind it leaks, misuses, or poorly secures what you sent, Elegant Themes says it isn't responsible. Since you deal with Elegant Themes and never chose these providers yourself, this leaves you chasing companies you have no direct relationship with.
“To the extent permitted by law, Elegant Themes is not responsible for the independent privacy, security, or data-processing practices of OpenRouter or any downstream artificial intelligence provider.”
You carry the legal risk for what you type into Divi AIMATERIAL
USER OBLIGATIONS
The policy makes you responsible for having every right, permission, and consent needed for whatever you submit. For anyone building sites for clients, that quietly shifts a real legal duty onto you: if you paste in a client's copy, photos, or customer data without their say-so, that's your problem, not the company's.
“You are responsible for the information you submit to Divi AI. You must have all rights, permissions, notices, and consents necessary to provide that information to Elegant Themes and to permit its processing by OpenRouter and the applicable artificial intelligence providers.”
What you can do — If you use Divi AI on client projects, get written permission from clients before feeding their content into it, and keep sensitive or regulated data (health, financial, personal records) out entirely.
Your information may be stored in countries with weaker privacy lawsMINOR
DATA SHARING
AI providers can process or store your data in the US or wherever else they operate. The policy openly warns those places may have privacy laws different from your own, which can mean fewer protections and less practical ability to get data removed.
“These third parties may process or store information in the United States or other countries where they or their service providers operate, and those countries may have privacy laws that differ from the laws where you live.”