AI apps ranked by data transparency

Drata

Drata, Inc.

A

Drata states plainly that it does not train AI models on customer data and that AI features are off until an admin turns them on, but its own privacy notice keeps personal data only "as long as necessary" with no stated period and describes security in general terms.

Lovable

Productivity

B

Lovable discloses an opt-out for AI model training and publishes a sub-processor list, but its terms take a perpetual licence over customer data and the policy sets no retention period.

Hex

BI & analytics

A

Hex commits in its Enterprise service agreement that neither it nor its AI providers will use customer data to train AI models, and it names a Privacy Officer, a data processing addendum, and a thirty-day account deletion window, but its retention period is open-ended and it never says how it would notify anyone of a breach.

Sourcegraph Cody

Sourcegraph, Inc.

A

Sourcegraph Cody tells Free and Pro users their AI inputs and outputs may be used to improve the service unless they opt out, routes LLM calls through partners under a defined zero-retention commitment, and promises no sale of data for advertising, while leaving its own retention window described only as for as long as necessary.

n8n

n8n GmbH

A

n8n commits in both its privacy policy and its cloud terms that it will not use customer content or personal data to train machine learning models, names a 6-month deletion window after account deactivation with 30 days advance email warning, and publishes a purpose-to-legal-basis table, though it reserves the right to change the policy without prior notice and says nothing about notifying users of a security breach.

Granola

Enterprise copilot

A

Granola trains only on de-identified data with an account-settings opt-out and enterprise accounts off by default, publishes a full set of data rights with a named request channel, and promises not to keep meeting audio after transcription, while leaving retention periods, breach notification and security specifics thin.

Betterworks

Betterworks Systems, Inc.

A

Betterworks publishes a detailed privacy notice with named security controls, a 30-day deletion deadline after contract termination, and a clear no-sale commitment, but it leans on a third-party LLM provider's terms for its training stance and never states how long it keeps personal data.

Fireworks AI

Fireworks AI Inc.

A

Fireworks AI commits in its terms not to use customer content for model training and adopts a Zero Data Retention policy for inference, but the retention promise carries broad carve-outs, the security section names no specific controls, and there is no breach-notification commitment.

Photoroom

Image & video

B

Photoroom trains its image models on uploaded photos with an in-app opt-out and excludes API images, but its terms take a perpetual sublicensable licence over user content and the policy names no security controls or breach notice.

v0

Vercel

B

Vercel's v0 discloses that free and Pro tier prompts and uploads feed third-party AI model training unless the user opts out in team settings, while paid Enterprise tiers get a contractual no-training warranty.

Notion

Notion Labs

B

Notion commits by default to not training any models on customer data and backs that with contractual limits on its AI subprocessors, zero data retention for Enterprise workspaces, and a named 30-day deletion window, while its privacy rights and international transfer language stay closer to legal boilerplate.

Freepik

Freepik Company (Magnific)

B

Freepik's Magnific policy commits not to use uploaded images or voices to train AI models and deletes uploaded media immediately after generation, but it names no breach-notification process, no output-ownership terms in the captured text, and it may share identifiers and activity data with advertising networks.

Personio

Personio SE

B

Personio's AI terms state plainly that customer data, inputs and outputs are not used to train models, that admins can switch AI features off, and that customers keep rights in their inputs and outputs, while the wider privacy notice leans on GDPR language without naming specific security controls or an advertising-sale position.

Mistral Le Chat

Mistral AI

B

Mistral gives Le Chat users named in-account controls to export, delete and object to training, but consumer chats are used for model training unless you opt out, the content licence Mistral takes can be passed to its subcontractors, and the policy says nothing about security controls or breach notice.

Fyxer

Productivity

B

Fyxer commits in writing that neither user data nor user content trains any language model provider, backs that with zero-data-retention agreements at its AI vendors, and asks for in-app consent before AI processing, but it names no retention period, no age gate, and no limit on special-category data.

Airbyte

Airbyte, Inc.

B

Airbyte publishes a clear no-training commitment, a named Privacy Center for access, deletion, correction and portability, a public subprocessor list and Standard Contractual Clauses for EU transfers, but the terms take a sublicensable licence over customer data, the policy shares user information with advertising partners for lookalike audiences, and no retention period, deletion deadline or legal basis is stated.

Higgsfield

Image & video

B

Higgsfield tells users plainly that their uploads, prompts and generated outputs feed its AI model training unless they delete the content or the account, and it reserves interest-based ad sharing with a cookie-level opt-out.

NotebookLM

Google

B

Google commits that Gemini Notebook content will not be used to directly train its foundational AI models unless the user submits feedback, and feedback content is then human-reviewed and kept for up to three years, while the Google Terms of Service still take a worldwide, sublicensable content licence lasting as long as the content is protected by intellectual property rights.

Heidi Health

Heidi Health Pty

B

Heidi Health's policy is unusually specific about clinical data, naming a no-training rule for health information, per-category retention periods, and three security certifications, but it leaves breach notification, output ownership, and AI-output labelling unaddressed, and its legal-basis and special-category commitments appear only in the European section.

VEED

Image & video

B

VEED trains AI models on free-tier uploads with an opt-out that costs you the free tier, names strong security controls and a privacy manager, and leaves retention periods and recipient categories vague.

GitHub Copilot

GitHub (Microsoft)

B

GitHub Copilot trains on individual users' prompts and AI outputs by default with an account-level opt-out, but a separate repository content licence lets GitHub and its affiliates train on user content regardless of that opt-out.

Sana

Sana Labs AB

B

Sana states plainly that neither it nor its service providers use personal data to train AI or machine learning models, and that it will not sell personal data, but it names no retention period, no deletion timeline after account closure, and no specific security controls.

Arize AI

Arize

B

Arize commits in writing not to train its models on AI feature inputs without separate consent, enumerates data categories and US state privacy rights in detail, and names a 24 month cap on usage and log data, but its security and minimization language rests on adjectives and it publishes no sub-processor list or breach notification commitment.

Together AI

Together Computer Inc.

B

Together AI commits not to train on customer data without explicit opt-in and offers a Zero Data Retention setting, but several user rights appear only inside region-specific sections and the security and transfer language stays at the level of industry-standard adjectives.

Fathom

Fathom Video Inc.

B

Fathom records and transcribes meetings, trains its own AI models on de-identified meeting content unless you switch it off in account settings, and refuses to let outside AI vendors train on your data, but it stores personal information only "for as long as necessary" with no stated period and reserves the right to sell personal information in states whose law defines a sale broadly.

Zapier

Zapier, Inc.

B

Zapier trains on de-identified data derived from customer content with a named opt-out form and automatic opt-out for Company and Enterprise plans, and it leaves retention periods, breach notification and AI-log handling unstated.

Spellbook

Rally Legal, Inc.

B

Spellbook commits in its terms that customer documents and prompts are not used to train the third-party models behind the product, names a 90-day cap on quality-assurance logs and a 30-day cap on abuse-monitoring data for self-serve accounts, and states it never sells personal information, but it names no retention period for customer data held on its own platform, no deletion timeline after an account closes, and no specific international transfer safeguard.

dbt Labs

dbt Labs, LLC

B

dbt Labs trains its AI tools only when a customer turns the feature on, leaves customers owning their data under a revocable service-limited licence, and names a data protection officer, but it sets no retention period, no breach-notification commitment and no children's safeguards.

Bolt.new

StackBlitz

B

Bolt.new trains models on Bolt prompts and code by default with a free account-level opt-out, but the Terms take a sublicensable and transferable licence over that content, the retention section names no period, and nothing is said about security controls or breach notification.

FaceApp

Image & video

B

FaceApp commits to deleting uploaded photos and videos within 24 to 48 hours and says it does not use them for anything beyond editing, but it never addresses model training, says nothing about breach notification, and describes its security only as commercially reasonable.

Leonardo.Ai

Leonardo Interactive (a Canva brand)

C

Leonardo.Ai confines its no-training promise to private Content on paid plans, while free-tier generations are public by default and fall under a perpetual, transferable licence that covers AI model training.

Cursor

Anysphere

C

Cursor commits in its terms that it will not use your content to train AI models unless you explicitly agree, and it lets you keep ownership of your inputs while assigning you the outputs, but its retention, security and breach-notice disclosures stay at the level of adjectives with no named periods or controls.

Vanta

Vanta Inc.

C

Vanta's terms contain a flat promise never to train AI models on customer data and an admin switch to turn AI features off, but the privacy policy sets no retention period, gives no breach-notification commitment, and confirms that identifiers and browsing activity have been sold or shared with ad networks.

Fireflies.ai

Fireflies.ai Inc.

C

Fireflies.ai rules out using personal information or meeting content to train AI models and gives a 30-day deletion timeline after account closure, but its terms claim a perpetual, irrevocable, sublicensable licence over user content and the policy names no security controls or breach notification.

Plaud

Plaud Inc.

C

Plaud commits in writing never to train AI models on user content without prior explicit consent, backs that with in-app access and account deletion controls, and leaves gaps around retention periods, breach notification and how long recordings are kept.

Eightfold AI

Eightfold AI Inc.

C

Eightfold AI publishes a detailed privacy notice with enumerated data categories, a named subprocessor notice and SOC 2 audits, but it commits to no retention period, reserves the use of anonymized customer data to train machine learning algorithms, and routes several of its strongest individual rights through the EU and UK sections rather than the default global notice.

Fivetran

Fivetran, Inc.

C

Fivetran publishes a detailed privacy notice with named transfer safeguards, a subprocessor list, a data protection officer and request-handling statistics, but it says nothing about whether customer inputs train AI models, names no retention period, and gives no breach notification commitment.

Veriff

Security & compliance

C

Veriff discloses a strong set of data rights, named transfer safeguards and a clear account of its automated verification engine, while stating that its algorithms are trained on real end-user data with no opt-out offered and giving no retention period beyond "as long as necessary".

Remini

Bending Spoons

C

Remini requires prior consent before user photos train its machine learning models and deletes uploaded media within days, but it says nothing about marking AI-generated images, limiting biometric or special-category data, or notifying users of a breach.

Cohere

Model provider

C

Cohere publishes a detailed privacy policy with a named privacy officer, a self-serve account deletion path and a Global Privacy Control signal that is honoured, but its terms of use take an irrevocable sublicensable licence over everything users submit and free-tier inputs feed research and development without a user-facing opt-out.

Snowflake

Data platform

C

Snowflake says it trains its machine learning and AI models on the information it collects and offers no way to opt out of that training, though customers keep ownership of the data they upload and get thirty days to retrieve it after an account ends.

Tabnine

Coding

C

Tabnine's terms say code written while using the service is used only to improve that user's own service and never to improve the service given to other users, and the retention, breach-notification and sub-processor disclosures stay general.

Nametag

Nametag Inc.

C

Nametag's policy is unusually strong on biometric governance and human review of automated identity decisions, while retention runs to three years and the security and breach disclosures stay generic.

Microsoft Copilot

Microsoft

C

Microsoft's consumer Copilot policy discloses model training with an opt-out that applies only in some markets, grants Microsoft a broad licence over user content that it can pass to others, and states no retention period or breach-notification commitment.

BambooHR

BambooHR LLC

C

BambooHR documents a clear set of individual rights with a named request address and a thirty day download window after a subscription ends, but it reserves usage and performance data for training and improving its AI offerings without offering an opt-out, and it names no retention period for most data beyond a ten year floor on payroll records.

Garfield AI

Garfield Law Ltd

C

Garfield AI commits in writing that client data is not used to train AI models and sets out named retention periods for each record type, but it says little about security controls, breach notification or protections for children.

Qdrant

Data platform

C

Qdrant's privacy policy is a GDPR-style disclosure that spells out data subject rights, named transfer safeguards and a commitment not to use customer data for its own business purposes, while leaving breach notification, policy versioning and a government-access standard unaddressed.

Clio

Legal

C

Clio's terms promise not to use customer confidential information to train general-purpose language models and set a 90-day deletion window after cancellation, but the same terms take a worldwide, sublicensable, perpetual licence over customer content and the privacy policy names no retention period.