AI apps ranked by data transparency

Drata

Drata, Inc.

A

Drata commits in its terms that it does not use customer data to train or fine-tune AI models and does not permit its inference providers to do so, gates AI features behind an administrator opt-in, and names a 48-hour security incident notification window, while its retention, security-control and sensitive-data language stays general.

Lovable

Productivity

B

Lovable discloses an opt-out for AI model training and publishes a sub-processor list, but its terms take a perpetual licence over customer data and the policy sets no retention period.

Hex

BI & analytics

A

Hex commits in its Enterprise service agreement that neither it nor its AI providers will use customer data to train AI models, and it names a Privacy Officer, a data processing addendum, and a thirty-day account deletion window, but its retention period is open-ended and it never says how it would notify anyone of a breach.

Sourcegraph Cody

Sourcegraph, Inc.

A

Sourcegraph Cody tells Free and Pro users their AI inputs and outputs may be used to improve the service unless they opt out, routes LLM calls through partners under a defined zero-retention commitment, and promises no sale of data for advertising, while leaving its own retention window described only as for as long as necessary.

n8n

n8n GmbH

A

n8n commits in both its privacy policy and its cloud terms that it will not use customer content or personal data to train machine learning models, names a 6-month deletion window after account deactivation with 30 days advance email warning, and publishes a purpose-to-legal-basis table, though it reserves the right to change the policy without prior notice and says nothing about notifying users of a security breach.

Granola

Enterprise copilot

A

Granola trains only on de-identified data with an account-settings opt-out and enterprise accounts off by default, publishes a full set of data rights with a named request channel, and promises not to keep meeting audio after transcription, while leaving retention periods, breach notification and security specifics thin.

Betterworks

Betterworks Systems, Inc.

A

Betterworks publishes a detailed privacy notice with named security controls, a 30-day deletion deadline after contract termination, and a clear no-sale commitment, but it leans on a third-party LLM provider's terms for its training stance and never states how long it keeps personal data.

Notion

Notion Labs

B

Notion commits by default to not training any models on customer data and backs that with contractual limits on its AI subprocessors, zero data retention for Enterprise workspaces, and a named 30-day deletion window, while its privacy rights and international transfer language stay closer to legal boilerplate.

Photoroom

Image & video

B

Photoroom trains its image models on uploaded photos with an in-app opt-out and excludes API images, but its terms take a perpetual sublicensable licence over user content and the policy names no security controls or breach notice.

Vanta

Vanta Inc.

B

Vanta's terms state flatly that customer data will not be used to train AI models and give admins a switch to turn AI features off, while the privacy policy leaves retention open-ended and confirms that identifiers and browsing activity have been sold or shared with ad networks.

v0

Vercel

B

Vercel's v0 discloses that free and Pro tier prompts and uploads feed third-party AI model training unless the user opts out in team settings, while paid Enterprise tiers get a contractual no-training warranty.

Heidi Health

Heidi Health Pty

B

Heidi Health's policy is unusually specific about clinical data, naming a no-training rule for health information, per-category retention periods, and three security certifications, but it leaves breach notification, output ownership, and AI-output labelling unaddressed, and its legal-basis and special-category commitments appear only in the European section.

Fireworks AI

Fireworks AI Inc.

B

Fireworks AI commits in its terms not to use customer content for model training and adopts a Zero Data Retention policy for inference, but the retention promise carries broad carve-outs, the security section names no specific controls, and there is no breach-notification commitment.

Freepik

Freepik Company (Magnific)

B

Freepik's Magnific policy commits not to use uploaded images or voices to train AI models and deletes uploaded media immediately after generation, but it names no breach-notification process, no output-ownership terms in the captured text, and it may share identifiers and activity data with advertising networks.

Personio

Personio SE

B

Personio's AI terms state plainly that customer data, inputs and outputs are not used to train models, that admins can switch AI features off, and that customers keep rights in their inputs and outputs, while the wider privacy notice leans on GDPR language without naming specific security controls or an advertising-sale position.

Mistral Le Chat

Mistral AI

B

Mistral gives Le Chat users named in-account controls to export, delete and object to training, but consumer chats are used for model training unless you opt out, the content licence Mistral takes can be passed to its subcontractors, and the policy says nothing about security controls or breach notice.

Fyxer

Productivity

B

Fyxer commits in writing that neither user data nor user content trains any language model provider, backs that with zero-data-retention agreements at its AI vendors, and asks for in-app consent before AI processing, but it names no retention period, no age gate, and no limit on special-category data.

Airbyte

Airbyte, Inc.

B

Airbyte publishes a clear no-training commitment, a named Privacy Center for access, deletion, correction and portability, a public subprocessor list and Standard Contractual Clauses for EU transfers, but the terms take a sublicensable licence over customer data, the policy shares user information with advertising partners for lookalike audiences, and no retention period, deletion deadline or legal basis is stated.

Remini

Bending Spoons

B

Remini requires prior consent before user content trains its machine learning models, names a 1 day deletion window for uploaded media, and lists a contactable Data Protection Officer, but it says nothing about marking AI generated output, breach notification, or whether it sells or shares data for advertising.

NotebookLM

Google

B

Google commits that Gemini Notebook content will not be used to directly train its foundational AI models unless the user submits feedback, and feedback content is then human-reviewed and kept for up to three years, while the Google Terms of Service still take a worldwide, sublicensable content licence lasting as long as the content is protected by intellectual property rights.

Higgsfield

Image & video

B

Higgsfield trains its AI models on user content by default and the only way to stop it is to delete your content or your account, though the policy does name a 30-day deletion window, a cookie-based advertising opt-out and an 18-plus age gate.

VEED

Image & video

B

VEED trains AI models on free-tier uploads with an opt-out that costs you the free tier, names strong security controls and a privacy manager, and leaves retention periods and recipient categories vague.

Salesforce Einstein

Salesforce

B

Salesforce discloses a zero-retention guardrail for Einstein prompts sent to third-party models, but its website terms claim an irrevocable perpetual licence over content users post, and the general privacy statement sets no retention number and no breach-notification commitment.

GitHub Copilot

GitHub (Microsoft)

B

GitHub Copilot trains on individual users' prompts and AI outputs by default with an account-level opt-out, but a separate repository content licence lets GitHub and its affiliates train on user content regardless of that opt-out.

Sana

Sana Labs AB

B

Sana states plainly that neither it nor its service providers use personal data to train AI or machine learning models, and that it will not sell personal data, but it names no retention period, no deletion timeline after account closure, and no specific security controls.

Luminance

Luminance Technologies Ltd

B

Luminance publishes a detailed UK GDPR privacy policy with a full data processing addendum, a named subprocessor list and a 24-hour breach notice, but its terms take a perpetual licence over uploaded User Data and name no retention period.

Fireflies.ai

Fireflies.ai Inc.

B

Fireflies.ai rules out using personal information or meeting content to train AI models and gives a 30-day deletion timeline after account closure, but its terms claim a perpetual, irrevocable, sublicensable licence over user content and the policy names no security controls or breach notification.

Arize AI

Arize

B

Arize commits in writing not to train its models on AI feature inputs without separate consent, enumerates data categories and US state privacy rights in detail, and names a 24 month cap on usage and log data, but its security and minimization language rests on adjectives and it publishes no sub-processor list or breach notification commitment.

Together AI

Together Computer Inc.

B

Together AI commits not to train on customer data without explicit opt-in and offers a Zero Data Retention setting, but several user rights appear only inside region-specific sections and the security and transfer language stays at the level of industry-standard adjectives.

Fathom

Fathom Video Inc.

B

Fathom records and transcribes meetings, trains its own AI models on de-identified meeting content unless you switch it off in account settings, and refuses to let outside AI vendors train on your data, but it stores personal information only "for as long as necessary" with no stated period and reserves the right to sell personal information in states whose law defines a sale broadly.

Read AI

Read AI, Inc.

B

Read AI trains its models on meeting content with an account-settings opt-out, caps audio and video retention at two years, and takes a sublicensable licence over user content that extends well past running the service.

Zapier

Zapier, Inc.

B

Zapier trains on de-identified data derived from customer content with a named opt-out form and automatic opt-out for Company and Enterprise plans, and it leaves retention periods, breach notification and AI-log handling unstated.

Spellbook

Rally Legal, Inc.

B

Spellbook commits in its terms that customer documents and prompts are not used to train the third-party models behind the product, names a 90-day cap on quality-assurance logs and a 30-day cap on abuse-monitoring data for self-serve accounts, and states it never sells personal information, but it names no retention period for customer data held on its own platform, no deletion timeline after an account closes, and no specific international transfer safeguard.

dbt Labs

dbt Labs, LLC

B

dbt Labs trains its AI tools only when a customer turns the feature on, leaves customers owning their data under a revocable service-limited licence, and names a data protection officer, but it sets no retention period, no breach-notification commitment and no children's safeguards.

Bolt.new

StackBlitz

B

Bolt.new trains models on Bolt prompts and code by default with a free account-level opt-out, but the Terms take a sublicensable and transferable licence over that content, the retention section names no period, and nothing is said about security controls or breach notification.

ChatGPT

OpenAI

B

OpenAI's consumer policy trains on ChatGPT conversations by default and offers an account-settings opt-out, gives working export and account-deletion controls, and names a data protection officer, but it sets no retention period, names no transfer safeguard, and describes its security only as commercially reasonable.

Eightfold AI

Eightfold AI Inc.

B

Eightfold AI publishes a detailed privacy notice with enumerated data categories, a named subprocessor notice and SOC 2 audits, but it commits to no retention period, reserves the use of anonymized customer data to train machine learning algorithms, and routes several of its strongest individual rights through the EU and UK sections rather than the default global notice.

Slack

Salesforce (Slack Technologies)

B

Slack states plainly that customer messages and files are not used to train large language models and gives a working opt-out address for its global models, but the privacy policy names no retention period, no breach notification commitment, and no specific security controls.

Leonardo.Ai

Leonardo Interactive (a Canva brand)

C

Leonardo.Ai confines its no-training promise to private Content on paid plans, while free-tier generations are public by default and fall under a perpetual, transferable licence that covers AI model training.

Cursor

Anysphere

C

Cursor commits in its terms that it will not use your content to train AI models unless you explicitly agree, and it lets you keep ownership of your inputs while assigning you the outputs, but its retention, security and breach-notice disclosures stay at the level of adjectives with no named periods or controls.

Plaud

Plaud Inc.

C

Plaud commits in writing never to train AI models on user content without prior explicit consent, backs that with in-app access and account deletion controls, and leaves gaps around retention periods, breach notification and how long recordings are kept.

FaceApp

Image & video

C

FaceApp commits in writing that it does not use the photos and videos you edit for anything other than the editing itself and that cloud copies are deleted within 24 to 48 hours, but its terms take a sublicensable licence over user content, its data rights are offered only where your jurisdiction grants them, and it says nothing about notifying users of a breach.

Gong

Gong.io Inc.

C

Gong's policy is detailed on data categories, rights and legal bases, but it reserves use of customer and user data to optimize its AI and machine learning capabilities under legitimate interests with no opt-out, sets no retention period, and gates its sale and sharing opt-out to California visitors.

Cohere

Model provider

C

Cohere publishes a detailed privacy policy with a named privacy officer, a self-serve account deletion path and a Global Privacy Control signal that is honoured, but its terms of use take an irrevocable sublicensable licence over everything users submit and free-tier inputs feed research and development without a user-facing opt-out.

Writer

Enterprise copilot

C

Writer promises outright that it will not train its models on your inputs or outputs and assigns output ownership to you, but it reserves use of your material to develop other products, names no retention period or security controls, and discloses data to advertising partners with only a cookie-level opt out.

Snowflake

Data platform

C

Snowflake says it trains its machine learning and AI models on the information it collects and offers no way to opt out of that training, though customers keep ownership of the data they upload and get thirty days to retrieve it after an account ends.

Nametag

Nametag Inc.

C

Nametag's policy is unusually strong on biometric governance and human review of automated identity decisions, while retention runs to three years and the security and breach disclosures stay generic.

11x

11x Inc.

C

11x contractually promises never to train AI models on customer data and names the customer as owner of that data, but the privacy policy reserves the use of navigational data for advertising purposes, names no retention period, and says nothing about notifying anyone after a breach.