On Saturday, October 10, Elon Musk urged users to “take a picture of your credit card” and send it to Grok Bot so it can find a deal and place the order. The documents that govern the product say more than the post does. xAI’s privacy policy asks users not to give it sensitive personal information, and the Grok Bot terms say customers must use human review before the bot takes certain actions, including financial transactions.
What the privacy policy says
The policy, updated October 11, asks users not to provide sensitive information and says that if they do, it “may be reproduced in the Output.” It does not name payment information in that passage, so whether a card photo counts is a reading, and a community note on Musk’s post argued that it does. The policy also says users are responsible for their actions, including providing payment information.
What the Grok Bot terms say
The terms, updated October 12, say customers are solely responsible for the access they give the bot and for what it does, including actions they did not intend. They say its actions may be inaccurate, incomplete or unintended. They also say Grok Bot may keep customer data, files, browser sessions and credentials in a cloud environment, and that deleting a bot may not remove all of them.
The pledge
Musk has also written that SpaceX will “make you whole” if Grok Bot makes a mistake or leaks card details. That is a post, not a line in the terms, and we covered it in Amazon Blocks Musk’s Grok Bot and He Floats an Amazon Rival.
Our take: the pitch and the paperwork point in different directions. The post says to send a photo and let the bot shop, while the documents put the review and the risk on the user. Anyone thinking of trying it should read both documents first and check what protection their card issuer offers. We have not seen the company respond to the community note. Our first look at the pitch is in Musk Says Grok Bot Can Order for You From a Photo of Your Card.
