Privacy Policy vs. Data Access Request: Is Your SaaS Ready?

Privacy compliance shouldn’t slow SaaS product development. But treating privacy and AI governance as an afterthought can create bigger problems once the product is already live. In this episode of Saas That App, Lindsay Vogel joins Aaron Marchbanks and Justin Edwards to unpack why strong privacy and AI governance starts much earlier. Turns out, the key lies in better questions, clearer accountability and a real understanding of how data moves through the business. From copy-paste privacy policies to “reject all” buttons and the murky question of putting client data into ChatGPT, she breaks down all the decisions SaaS teams can’t afford to treat as an afterthought. This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/ Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp

Boilerplate privacy policies, data inventories, consent banners, accountability, AI governance, and one especially tricky question: when you put company or client data into ChatGPT or Claude, have you disclosed it to a third party?

That’s what we’re tackling in this episode. Lindsay Vogel, Partner at Scale LLP, joins Aaron Marchbanks and Justin Edwards to talk about the privacy decisions founders and engineering teams tend to postpone until somebody forces the issue. Lindsay argues that privacy works better when legal, engineering and founders are in the room together early, rather than calling legal after the product has already shipped.

The big lesson: A privacy policy copied from another SaaS company might look convincing but the problem starts when an actual customer asks what data you hold on them and nobody knows.

What You’ll Learn:

Why legal, engineering, and founders work better as collaborators
Why copy-pasting a privacy policy can leave you exposed later
The simplest way to start mapping the data your company actually holds
Why somebody needs to “hold the pen” on data and AI decisions
How “reject all” can sometimes create a better consent experience
Why AI governance starts with many of the same questions as data governance
What SaaS teams should know before sending sensitive data into an LLM

Lindsay Vogel is a Partner at Scale LLP with around 15 years of experience in privacy. Her career has included work at the Department of Homeland Security and FDIC, as well as serving as lead privacy counsel and interim global head of privacy at Bumble. Before joining Scale LLP, she founded Gamut Privacy, where she worked with small and emerging technology companies on privacy and AI governance programs.

This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/

Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp.

#SaaSBusiness #ProductStrategy #TechFounders #StartupPodcast #SoftwareStartup #B2BStartups

Highlights:

[02:22] How Lindsay Fell Into Privacy
[04:08] Why Privacy Feels Like a Blocker
[07:24] The Copy-Paste Privacy Trap
[10:02] When Legal Meets Engineering
[11:29] Who Actually Owns Privacy?
[12:25] 6 Questions Your Policy Must Answer
[13:00] The Case for “Reject All”
[18:20] Do You Need Multiple Privacy Policies?
[19:50] Can You Just Change Your Terms?
[20:21] Is ChatGPT Sharing Your Data?
[24:47] What AI Governance Actually Needs
[27:16] Why Regulation Can’t Keep Up

Episode Resources:

Lindsay Vogel on LinkedIn
Scale LLP Website
Aaron Marchbanks on LinkedIn
Justin Edwards on LinkedIn
Delta Systems Website