Privado AI asks the question your privacy policy cannot answer

The spreadsheet was supposed to settle the matter. Privado’s founders had spent six months mapping data for an ecommerce company, interviewing more than 100 product managers and developers. They had an impressive Excel file. They also had a problem: the product had changed while they were asking questions. The map was already ageing.

There is a small tragedy here familiar to anyone who has commissioned an inventory. By the time you have described the house, someone has built another room. Privacy teams face an especially inconvenient version: their map must describe information moving through software that keeps being rewritten.

01 / The map loses the race

Privado began in 2020. Its founding team includes CEO Vaibhav Antil, CTO Prashant Mahajan and commercial co-founder Jasdeep Singh, named Jasdeep Cheema in early announcements. Antil and Cheema had previously built Jukebox Studio, acquired by Gaana. At Gaana, GDPR compliance exposed them to the work of extracting information and maintaining proof.

The early mapping exercise changed the question. How could a company know what its software did without repeatedly asking everyone who built it? Privado’s answer was to inspect the code. The scanner identifies personal data, traces collection and destinations, and flags handling that conflicts with configured privacy requirements. A developer can investigate the relevant code rather than decipher a legal abstraction.

This is the company’s technical specialty: treating privacy as something observable throughout development. Finding an email address in a database answers where it sits. Following it through an application asks who receives it, how it gets there and whether that journey belongs in the first place.

02 / HP starts with the account

HP supplies a useful example. Its privacy team already reviewed products, but needed a way to validate questionnaire answers and keep evidence current. The company piloted Privado on a subset of repositories handling user accounts across its website and apps. Scans connected to its build pipeline produced inventories and flow maps within days, according to the published case study.

Engineers could check findings against specific code. HP then configured risk workflows around its policies and had new pipeline runs refresh the maps. The interesting unit of progress was a repeatable check: a software change could trigger evidence and an alert without waiting for another interview.

“We need privacy controls based on evidence.”Aaron Weller, HP

HERE Technologies encountered a related difficulty. Developers and privacy officers used different terms, and manually maintained records struggled to follow product changes. A pilot scanned a significant portion of repositories within a month. HERE reported finding previously unidentified compliance issues and gaining a shared view of personal data processing. Neither case requires imagining a villain. Ordinary handoffs were quite sufficient.

03 / A banner is a promise with buttons

Code is one vantage point. A live website offers another. Privado’s Web Auditor simulates journeys and consent choices in different locations, recording cookies, pixels, scripts and data sharing. A reject button can look immaculate while an advertising request carries on its merry way.

App Auditor applies a similar approach to mobile software, examining permissions, third-party SDKs and consent behavior. These tools are useful to privacy and marketing teams checking a deployed experience, including behavior before and after login. The practical question is whether the machinery obeys the choice the interface presents.

Dynamic Data Maps combines several kinds of evidence, including source code, live scans, third-party integrations and documents. In October 2025, Privado announced additional runtime and third-party scanning capabilities alongside Agentic Assessments. The expansion acknowledges something sensible: a codebase alone cannot describe every business process.

04 / The form gets an assistant

Agentic Assessments reads material such as product requirements, technical specifications and contracts to populate privacy reviews. Responses come with reasoning and cited evidence; reviewers can validate them and examine contradictions. That matters more than the agreeable spectacle of a completed form.

In March 2026, Privado introduced Wren to handle assessment intake, triage, research and risk tracking. It can monitor tools such as Jira for work warranting review and use company policies to guide the process. Its name nods to Samuel Warren, co-author of the 1890 essay The Right to Privacy. A nineteenth-century lawyer has acquired a decidedly twenty-first-century inbox.

April brought Cookie Agent, which researches cookie categories rather than relying solely on an existing consent platform’s labels. Its published method includes confidence flags when information is insufficient. The useful habit running through these products is making the evidence available for inspection.

05 / What the evidence costs

Privado sells enterprise software through annual contracts. Published starting rates are $600 per website per month for Web Auditor, with a four-site minimum, and $800 per app per month for App Auditor. iOS and Android versions count separately. Wren starts at $4,200 monthly for up to 500 assessments; the wider management platform uses custom pricing.

Investors supplied $17.5 million across a $3.5 million seed and $14 million Series A in 2022. Backers included Insight Partners, Sequoia Capital India, Together Fund and Emergent Ventures. The company also maintains an open-source scanner, giving developers a route to examine its approach outside an enterprise purchase.

In the market, Privado overlaps with broader privacy platforms and website auditing tools. It can also feed findings into OneTrust and TrustArc. Competition and integration coexist because collecting technical evidence and managing an organization’s privacy program are connected jobs with different demands.

06 / Borrow the pilot, keep the judgment

The copyable move is HP’s narrow starting point. Pick a bounded application, follow a few consequential data elements, validate findings with engineers and repeat after changes. A small map that updates earns more trust than a grand diagram nobody can verify.

That approach depends on access to the relevant systems, policies clear enough to test and people assigned to fix problems. Document-based assessments depend on the documents supplied; scans depend on coverage. A generated answer still needs review. Privado’s proposition is most persuasive when it helps a company shorten the distance between making a privacy promise and checking whether it has kept it.