{ "feedVersion": 2, "generatedFrom": "verifywise.ai/ai-trust-index", "meta": { "name": "VerifyWise AI App Trust & Transparency Index", "scopeStatement": "Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information.", "disclaimer": "The VerifyWise AI Trust & Transparency Index is provided for general informational purposes only and reflects VerifyWise's good-faith analysis of publicly available privacy policies and terms of service as of each app's stated assessment date. Each grade is a statement of opinion based on our published methodology, not a statement of fact, legal or compliance advice, or an endorsement or warning about any company or product. We assess only what these documents disclose; we do not audit, test, or verify any company's actual data handling, security practices, or legal compliance, and a grade does not measure whether an app is safe or trustworthy to use. Policies change over time, so a grade may not reflect an app's current documents, and any assessment may contain errors or omissions. The index is not a substitute for your own review; you should read the relevant policies and seek professional advice before relying on it. VerifyWise makes no warranty as to accuracy or completeness and, to the fullest extent permitted by law, accepts no liability for any decision made in reliance on the index. Company and product names are trademarks of their respective owners; their inclusion does not imply any affiliation with or endorsement by VerifyWise. To request a correction, contact privacy@verifywise.ai.", "rubricVersion": "2.0", "model": "temperature-0 automated scoring", "rankingSource": "a16z Top 100 Gen AI Consumer Apps, 6th Edition (Mar 2026)", "rankingSourceUrl": "https://a16z.com/100-gen-ai-apps-6/", "enterpriseRankingSource": "Menlo Ventures: 2025 State of Generative AI in the Enterprise (Dec 2025)", "enterpriseRankingSourceUrl": "https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/", "assessedDate": "2026-07-08", "methodologyNote": "Apps are scored across 7 data-governance domains (training-data use, data-subject rights, retention, third-party sharing, transparency, sensitive data & children, security & accountability) on a 10-point additive scale, scaled to 100. Every score is anchored to a quoted clause or a recorded silence. An app with an active dealbreaker clause (sells data with no opt-out, claims a perpetual content licence, or refuses deletion) is capped at a displayed B." }, "design": { "gradeStyles": { "A": { "bg": "#13715B", "text": "#ffffff", "ring": "#13715B", "label": "Strong disclosure" }, "B": { "bg": "#2E8B6F", "text": "#ffffff", "ring": "#2E8B6F", "label": "Good disclosure" }, "C": { "bg": "#C8941E", "text": "#ffffff", "ring": "#C8941E", "label": "Partial disclosure" }, "D": { "bg": "#C2683B", "text": "#ffffff", "ring": "#C2683B", "label": "Weak disclosure" }, "F": { "bg": "#B23B3B", "text": "#ffffff", "ring": "#B23B3B", "label": "Poor disclosure" } }, "gradeBands": [ { "grade": "A", "range": "70–100" }, { "grade": "B", "range": "60–69" }, { "grade": "C", "range": "48–59" }, { "grade": "D", "range": "35–47" }, { "grade": "F", "range": "0–34" } ], "faviconUrlTemplate": "https://icons.duckduckgo.com/ip3/{domain}.ico" }, "count": 211, "apps": [ { "slug": "claude", "name": "Claude", "vendor": "Anthropic", "domain": "claude.ai", "category": "Assistant", "scoreOutOf100": 63, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Claude discloses training with opt-out, user data ownership, core GDPR-style rights, multi-mechanism data sharing, and named international safeguards, but lacks concrete security controls, breach notification timelines, and AI-use transparency.", "highlights": [ { "label": "Training opt-out with exceptions", "text": "Users can opt out of training, but flagged content and explicit feedback remain used regardless" }, { "label": "Data ownership and deletion", "text": "User owns inputs and outputs; conversations deleted from backend within 30 days of user deletion" }, { "label": "International safeguards named", "text": "Relies on EU adequacy decisions and standard contractual clauses for transfers" }, { "label": "Vague retention and security", "text": "Retention is 'as necessary'; security is 'appropriate technical measures' with no named controls" } ], "policyUrl": "https://www.anthropic.com/legal/privacy", "policyLastUpdated": "2026-07-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/claude.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" }, { "date": "2026-06-20", "score": 82, "grade": "B" }, { "date": "2026-06-21", "score": 63, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "chatgpt", "name": "ChatGPT", "vendor": "OpenAI", "domain": "openai.com", "category": "Assistant", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "ChatGPT offers opt-out training controls and user ownership of outputs, but lacks named security mechanisms, transparent AI interaction disclosures, and purpose-to-legal-basis mapping in its global privacy policy.", "highlights": [ { "label": "Training opt-out", "text": "Read our instructions on how you can opt out of our use of your Content to train our models." }, { "label": "User output ownership", "text": "you (a) retain your ownership rights in Input and (b) own the Output. We hereby assign to you all our right, title, and interest, if any, in and to Output." }, { "label": "Boilerplate security", "text": "We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access" }, { "label": "Data category enumeration", "text": "Personal Data You Provide...Account Information, User Content, Communication Information, Contact Data, Other Information You Provide. Personal Data We Receive from Your Use...Log Data, Usage Data, Device Information, Location Information, Cookies and Similar Technologies." } ], "policyUrl": "https://openai.com/policies/privacy-policy/", "policyLastUpdated": "2026-04-28", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/openai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 76, "grade": "B" }, { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "perplexity", "name": "Perplexity", "vendor": "Perplexity AI", "domain": "perplexity.ai", "category": "Assistant", "scoreOutOf100": 66, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Perplexity discloses training-data opt-out, full user rights (access/delete/port/correct/object), vague retention, broad third-party sharing with no-sell attestation, comprehensive data categories and legal bases, but lacks AI interaction disclosure, security control specifics, and breach timeframes.", "highlights": [ { "label": "D1.1–1.2 Training controls", "text": "Opt-out mechanism named: \"You may opt out of information collection for AI...in your settings page\"; scope vague on whether inputs train by default" }, { "label": "D2.1–5 User rights", "text": "Full suite: Access, Deletion (\"30 days\"), Portability, Correction, Objection (GPC+ads opt-out named); all named with concrete timelines" }, { "label": "D3.1 Retention vagueness", "text": "\"We retain your information for as long as is reasonably necessary\" , no concrete number; ladder=0.2 (adjective-based)" }, { "label": "D4.1–4.4 Sharing & transfers", "text": "Named categories (Group, Service Providers, Partners, Third Parties, Ads, Advisors, law enforcement); no-sell attestation (CCPA); SCCs+DPF for EU/UK" } ], "policyUrl": "https://www.perplexity.ai/hub/legal/privacy-policy", "policyLastUpdated": "2026-02-05", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/perplexity.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-20", "score": 75, "grade": "B" }, { "date": "2026-06-21", "score": 66, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "gemini", "name": "Gemini", "vendor": "Google", "domain": "gemini.google.com", "category": "Assistant", "scoreOutOf100": 31, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Gemini's policy discloses access/deletion rights and some data transparency, but is silent on inputs/training, lacks explicit correction rights, and omits age gate disclosure in the main policy.", "highlights": [ { "label": "Output ownership (D1.4)", "text": "Google won't claim ownership over that content , but vague on Outputs specifically vs. user-generated content generally" }, { "label": "Deletion rights (D2.2)", "text": "You can browse by date and by topic, and delete part or all of your activity; Delete your content from specific Google services" }, { "label": "Correction right (D2.4)", "text": "Policy is SILENT on explicit correction mechanism; table of contents mentions ability to ask for inaccurate Gemini responses to be corrected, but no substantive disclosure in policy body" }, { "label": "International transfers (D4.4)", "text": "your information may be processed on servers located outside of the country where you live...we apply the same protections described in this policy" } ], "policyUrl": "https://support.google.com/gemini/answer/13594961", "policyLastUpdated": "2026-05-26", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gemini.google.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" }, { "date": "2026-06-20", "score": 71, "grade": "B" }, { "date": "2026-06-21", "score": 31, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "meta-ai", "name": "Meta AI", "vendor": "Meta", "domain": "meta.ai", "category": "Assistant", "scoreOutOf100": 31, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Meta AI trains on user inputs with opt-out, collects broad data for personalization and ad targeting, shares data globally with partners, and discloses AI interaction data, but lacks named retention periods, safeguards on international transfers, special-category limits, and security controls.", "highlights": [ { "label": "Input Training", "text": "Trains on user inputs by default with named opt-out mechanism in settings (D1.1 half, D1.2 half)" }, { "label": "Data Sharing", "text": "Shares data globally with partners and advertisers; claims no sale but does share for ad targeting. No named international transfer safeguards (D4.1 half, D4.3 full, D4.4 zero)" }, { "label": "Sensitive Data Risk", "text": "Collects special-category data (religion, health, political views) but discloses processing for personalization with no protective limits (D6.2 zero)" }, { "label": "Vague retention and thin security", "text": "Data is kept 'as long as necessary' with no named retention period, and the policy discloses no specific security controls, breach notification timeline, or data protection officer" } ], "policyUrl": "https://www.facebook.com/privacy/policy/", "policyLastUpdated": "2025-12-16", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/meta.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-21", "score": 31, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "canva", "name": "Canva", "vendor": "Canva", "domain": "canva.com", "category": "Productivity", "scoreOutOf100": 70, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Canva discloses opt-out AI training with privacy controls, comprehensive data subject rights, named third-party safeguards, and COPPA/FERPA education certification, but lacks breach notification procedures and concrete retention timelines.", "highlights": [ { "label": "AI Training Opt-out", "text": "You can manage the use of your data for training AI to improve our Service in the privacy controls page under your privacy settings" }, { "label": "Education Tier Protected", "text": "We will not use User Content of Canva Education for AI training" }, { "label": "Data Subject Rights", "text": "You can request access, correction or deletion of the data Canva holds on you by contacting privacy@canva.com" }, { "label": "International Safeguards", "text": "we will require those third party providers to enter into an agreement that provides appropriate safeguards for your information, including by using the EU Model Clauses and the UK International Data Transfer Addendum" } ], "policyUrl": "https://www.canva.com/policies/privacy-policy/", "policyLastUpdated": "2026-04-15", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/canva.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 73, "grade": "B" }, { "date": "2026-06-21", "score": 70, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "elevenlabs", "name": "ElevenLabs", "vendor": "ElevenLabs", "domain": "elevenlabs.io", "category": "Audio", "scoreOutOf100": 69, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: perpetual and irrevocable...sub-licensable, through multiple tiers" ], "summary": "ElevenLabs offers opt-out training controls, an explicit named mechanism, and tiered commercial use policies, but grants perpetual sublicensable content licenses without user retention; retention is named at 3 years for voice data and biometric data; it sells personal data with opt-out available; international transfers use named safeguards and it names a DPO contact, but security controls are referenced externally without specific certs named in the policy text.", "highlights": [ { "label": "D1.1 – Training opt-out", "text": "you may opt out of our use of your Personal Data for training at any time" }, { "label": "D1.4 – Adverse license", "text": "perpetual and irrevocable...sub-licensable, through multiple tiers" }, { "label": "D3.1 – 3-year retention", "text": "not keep data it generates about your voice longer than 3 years after your last interaction" }, { "label": "D7.1 – Security measures unclear", "text": "up-to-date list of measures along with relevant audit certifications can be obtained at: https://compliance.elevenlabs.io/" } ], "policyUrl": "https://elevenlabs.io/privacy-policy", "policyLastUpdated": "2026-05-20", "modalities": [ "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/elevenlabs.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 71, "grade": "B" }, { "date": "2026-06-20", "score": 73, "grade": "B" }, { "date": "2026-06-21", "score": 69, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "half", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "character-ai", "name": "Character.AI", "vendor": "Character Technologies", "domain": "character.ai", "category": "Companion", "scoreOutOf100": 41, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: you grant Character.AI, to the fullest extent permitted under the law, a nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, irrevocable license" ], "summary": "Character.AI trains on user inputs and public data without disclosed opt-out, grants itself perpetual sublicensable rights to user content, allows data requests but retention is vague, and provides minimal security/breach disclosure.", "highlights": [ { "label": "Training with no opt-out", "text": "User inputs and publicly available data are used for model development with no opt-out mechanism disclosed" }, { "label": "Perpetual content licence", "text": "Grants Character.AI a 'perpetual, irrevocable' sublicensable licence to your content for 'any Character.AI-related purpose,' allowing broad reuse beyond running the service" }, { "label": "Thin security disclosure", "text": "The policy names no security controls such as encryption and gives no breach notification timeframe" } ], "policyUrl": "https://character.ai/privacy", "policyLastUpdated": "2025-08-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/character.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-20", "score": 50, "grade": "D" }, { "date": "2026-06-21", "score": 41, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "deepseek", "name": "DeepSeek", "vendor": "Hangzhou DeepSeek AI", "domain": "deepseek.com", "category": "Assistant", "scoreOutOf100": 54, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "DeepSeek discloses training-data opt-out with a named mechanism, limits output reuse to service, and explicitly rejects targeted ads and profiling, but lacks concrete security controls and breach-notification timeframes.", "highlights": [ { "label": "D1.2 downgrade", "text": "Marked \"full\" for named opt-out mechanism, but \"the right to opt-out of using your Personal Data for training our models\" is boilerplate naming without concrete implementation. Downgraded to \"half\" per rubric: adjectives/named-but-vague = half at most." }, { "label": "D2.1 downgrade", "text": "Marked \"full\" for access right, but \"the right to access your Personal Data\" is a bare statement with no mechanism, deadline, or format specification. Downgraded to \"half\" per rubric: stated rights without substance = half." }, { "label": "D2.4 downgrade", "text": "Marked \"full\" for correction right, but \"the right to correct inaccuracies in your Personal Data\" is vague boilerplate. Policy later disclaims: factual accuracy of Outputs cannot be guaranteed. Downgraded to \"half\" per rubric." }, { "label": "D4.3 affirmed as full", "text": "\"NOTE WE DO NOT ENGAGE IN TARGETED ADVERTISING, SELL PERSONAL DATA OR USE PERSONAL DATA FOR PROFILING\" is an explicit named non-engagement clause that meets full award criteria." } ], "policyUrl": "https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html", "policyLastUpdated": "2026-02-10", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/deepseek.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" }, { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-21", "score": 54, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "grok", "name": "Grok", "vendor": "xAI", "domain": "x.ai", "category": "Assistant", "scoreOutOf100": 43, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: irrevocable, perpetual, transferable, sublicensable, royalty-free, and worldwide right to xAI to use, copy, store, modify, distribute, reproduce, publish, display in public forums, list information regarding, make derivative works of" ], "summary": "Grok offers opt-out from training and 30-day deletion for Private Chat, but grants xAI broad perpetual sublicensable rights to outputs and uses indefinite default retention for non-opted data.", "highlights": [ { "label": "D1.2 downgrade: no named mechanism", "text": "The policy states users can \"select\" whether to consent to training but provides no details on HOW or WHERE to opt-out. The snapshot does not quote specific UI, settings location, or process. Downgraded from half to zero (SILENT)." }, { "label": "D3.1 retention ladder downgrade: indefinite default", "text": "General retention policy is vague: \"We retain your personal information where we have an ongoing legitimate business need to do so.\" No time limit specified. The 30-day deletion only applies to Private Chat or after explicit deletion request. Default retention is indefinite. Ladder downgraded from 0.5 to 0.2." }, { "label": "D4.3 downgrade: no opt-out for ad targeting", "text": "Policy states cookies are used to \"deliver relevant content and targeted advertising\" but does NOT disclose an opt-out mechanism. Downgraded from half to zero (sells/shares for ads with no stated opt-out = silent)." }, { "label": "D1.4 & D4.3 adverse findings confirmed", "text": "D1.4 correctly flags perpetual, sublicensable licence as adverse. D4.3 silent on ad-targeting opt-out, hence zero." } ], "policyUrl": "https://x.ai/legal/privacy-policy", "policyLastUpdated": "2026-04-04", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/x.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 54, "grade": "D" }, { "date": "2026-06-20", "score": 55, "grade": "C" }, { "date": "2026-06-21", "score": 43, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "half", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "janitor-ai", "name": "Janitor AI", "vendor": "JanitorAI Inc.", "domain": "janitorai.com", "category": "Companion", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: worldwide, non-exclusive, royalty-free, sublicensable, and transferable license" ], "summary": "Janitor AI discloses comprehensive data rights (access, deletion, correction, restriction) and names recipients and transfer safeguards, but applies sublicensable output rights without limitation and offers only vague retention language without specific periods.", "highlights": [ { "label": "Output ownership: perpetual sublicense", "text": "Section 5.2 grants \"worldwide, non-exclusive, royalty-free, sublicensable, and transferable license\" over user content, with no reversion on account deletion and no limitation to service-related use only." }, { "label": "Data access & portability awarded full", "text": "Policy explicitly grants right to receive data \"in a structured, commonly used, machine-readable format\" (D2.1 full) with portability separately named as data in same format (D2.3 half as it references the same clause)." }, { "label": "Retention vague without period", "text": "Section 8 states retention is \"only for as long as necessary to fulfill the purposes outlined in this Privacy Policy\" with no named number of days/months. Ladder 0.2 correct for vague language." }, { "label": "No sale under CCPA explicitly stated", "text": "Section 15 declares \"We do not sell your Personal Data as defined under the CCPA/CPRA,\" earning D4.3 full." } ], "policyUrl": "https://janitorai.com/policy", "policyLastUpdated": "2025-12-11", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/janitorai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 47, "grade": "D" }, { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "leonardo-ai", "name": "Leonardo.Ai", "vendor": "Leonardo Interactive (a Canva brand)", "domain": "leonardo.ai", "category": "Image & video", "scoreOutOf100": 68, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Leonardo.ai offers opt-out model training for paid users but trains by default on free content; paid users own outputs with limited reuse, free users do not; comprehensive data rights (access, deletion, portability, correction, opt-out); vague retention policy tied to account activity; extensive third-party sharing with ad partners; named security certification (SOC 2 II) and European DPO; weak sensitive-data protections.", "highlights": [ { "label": "Training data opt-out (paid only)", "text": "If you don't want your Content to be used for machine learning, you can generate Content privately with any paid subscription plan. Private Content isn't accessible to others and won't be used by Leonardo.Ai for model training." }, { "label": "Tier-dependent ownership", "text": "Paid Subscribers: ownership of all...Content...will vest in you upon creation...Free Subscribers: ownership...will vest in us upon creation." }, { "label": "Ad sharing with opt-out", "text": "You may opt out of the 'selling or sharing' of your personal information, which may include us sharing your information with third party advertising partners as described above in the section 'Advertising'. You can opt out by following the instructions on the 'Do not sell or share my personal information' banner, or by emailing privacy@leonardo.ai." }, { "label": "Security certification", "text": "Leonardo.ai is fully SOC 2 Type I and Type II accredited, demonstrating our commitment to the highest standards of security, availability, and data integrity." } ], "policyUrl": "https://leonardo.ai/privacy-policy/", "policyLastUpdated": "2026-01-19", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/leonardo.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 93, "grade": "A" }, { "date": "2026-06-20", "score": 71, "grade": "B" }, { "date": "2026-06-21", "score": 68, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "notion", "name": "Notion", "vendor": "Notion Labs", "domain": "notion.com", "category": "Productivity", "scoreOutOf100": 73, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Notion's privacy policy discloses explicit no-training pledges for customer data with contractual safeguards, clear user rights including deletion and access, concrete AI-log retention periods (30 days/zero), and comprehensive security certifications, though international transfer mechanisms and some data-sharing opt-outs lack specificity.", "highlights": [ { "label": "AI Training Prohibition", "text": "By default, Notion and its AI Subprocessors do not use Customer Data to train any models. We specifically have contractual agreements in place with our AI Subprocessors that prohibit the use of Customer Data to train their models." }, { "label": "User Data Ownership", "text": "Notion does not claim ownership of your input or the generated output. When you use Notion AI, Input and Output are your Customer Data... you retain any and all of your rights to your User Content." }, { "label": "AI Log Retention Specifics", "text": "By default for all non-Enterprise plan workspaces, LLM providers only retain Customer Data for 30 days or fewer before deletion. For Enterprise plan workspaces, zero data retention." }, { "label": "Security Certifications", "text": "SOC 2 Type 2... ISO 27001, ISO 27701, ISO 27017, ISO 27018... encryption in-transit using TLS 1.2 or greater" } ], "policyUrl": "https://www.notion.com/trust/privacy-policy", "policyLastUpdated": "2025-09-29", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/notion.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 89, "grade": "A" }, { "date": "2026-06-20", "score": 89, "grade": "A" }, { "date": "2026-06-21", "score": 73, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "photoroom", "name": "Photoroom", "vendor": "Photoroom", "domain": "photoroom.com", "category": "Image & video", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: royalty-free, sublicensable, transferable, perpetual, irrevocable, non-exclusive, worldwide license" ], "summary": "Photoroom offers moderate transparency on AI training (opt-out available with limits) and data rights, but reserves broad content licensing rights and provides weak security/breach disclosures.", "highlights": [ { "label": "Perpetual content licence", "text": "royalty-free, sublicensable, transferable, perpetual, irrevocable, non-exclusive, worldwide license" }, { "label": "D2.1-D2.5: GDPR rights", "text": "Access, deletion, portability (conditional), correction, and objection rights all disclosed" }, { "label": "D3.1 retention: 2yr+5yr archive", "text": "Duration of use (Until account deleted or 2 years from last connection), then archived for 5 years" }, { "label": "D7.3 DPO named", "text": "external Data Protection Officer declared to CNIL, contact: privacy@photoroom.com" } ], "policyUrl": "https://www.photoroom.com/legal/privacy", "policyLastUpdated": "2026-03-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/photoroom.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 86, "grade": "A" }, { "date": "2026-06-20", "score": 79, "grade": "B" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "grammarly", "name": "Grammarly", "vendor": "Grammarly", "domain": "grammarly.com", "category": "Productivity", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Grammarly (Superhuman) grants users data subject rights and opt-out control over AI training, but retains data indefinitely per business needs and allows AI model training including for new products.", "highlights": [ { "label": "AI Training Opt-Out", "text": "You can decide whether Superhuman can use your user content to train our AI models by adjusting the available training control(s) in your account settings" }, { "label": "User Owns Content + Broad License", "text": "You own all right, title, and interest in and to User Content...license...for the limited purposes of: (i) Operating, providing, improving, troubleshooting, and debugging our Services...and (iv) Developing new products or adding features for our Services" }, { "label": "Data Subject Rights", "text": "You have the right to (1) request to know more about and access your personal information, including in a portable format, (2) request deletion of your personal information, and (3) request correction of inaccurate personal information" }, { "label": "Named Data Protection Officer", "text": "We've appointed VeraSafe as our representative in the EEA and UK for data protection matters" } ], "policyUrl": "https://www.grammarly.com/privacy-policy", "policyLastUpdated": "2025-10-29", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/grammarly.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 80, "grade": "B" }, { "date": "2026-06-20", "score": 70, "grade": "B" }, { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "kling-ai", "name": "Kling AI", "vendor": "Kuaishou", "domain": "klingai.com", "category": "Image & video", "scoreOutOf100": 62, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.1: non-exclusive, royalty-free right and license... to use the Content, which shall comprise the Input you provide or upload to the Services and Output generated during your use of our Services... create, test, improve, train, or otherwise develop the artificial intelligence or machine learning models", "D1.4: We may, at our discretion or by licensing to third parties, use or develop the aforementioned Content (in whole or in part) for the purposes of promotion, product/function upgrades, and to research on new products/functions" ], "summary": "Kling AI trains user inputs on models with a revocable opt-out; owns outputs with sublicensable reuse rights; provides standard GDPR-style data rights with vague retention; shares data with affiliates and third parties with generic contractual safeguards; discloses AI interactions and requires output labeling; implements encryption and access controls; and gates access at age 13.", "highlights": [ { "label": "Input training with opt-out", "text": "non-exclusive, royalty-free right and license... to create, test, improve, train, or otherwise develop the artificial intelligence or machine learning models; revocable via email to support@kling.ai" }, { "label": "Output ownership & reuse", "text": "Kling AI may, at our discretion or by licensing to third parties, use or develop the aforementioned Content (in whole or in part) for purposes of promotion, product/function upgrades, and to research on new products/functions" }, { "label": "Data rights provided", "text": "Access, deletion, portability, correction, and objection rights available; retention 'for as long as necessary' (vague); data minimization by default" }, { "label": "International transfers safeguard", "text": "appropriate contractual guarantees which are compliance with applicable laws and regulations (vague; no reference to standard contractual clauses or adequacy decisions)" } ], "policyUrl": "https://kling.ai/docs/privacy-policy", "policyLastUpdated": "2026-04-21", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/klingai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 62, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "full", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "faceapp", "name": "FaceApp", "vendor": "FaceApp", "domain": "faceapp.com", "category": "Image & video", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "FaceApp's privacy policy discloses limited input-training restrictions, defines photo retention at 24-48 hours with encryption, and allows sublicensable derivative works reuse; but lacks breach-notification timelines, AI-interaction transparency, and data-processor agreement details.", "highlights": [ { "label": "Input use restriction (D1.1)", "text": "We do not use photographs or videos you provide when you use the Apps for any reason other than to provide you with the editing functionality of the Apps." }, { "label": "Photo retention & encryption (D3.1)", "text": "Photographs or videos may remain cached in the cloud for a limited period between 24 to 48 hours after your last edit... safeguard each photograph or video that you select using an encryption key stored locally on your device." }, { "label": "Sublicensable output reuse (D1.4 adverse)", "text": "You grant FaceApp a nonexclusive, sublicensable, royalty-free, worldwide, fully paid license to use, reproduce, temporarily cache, modify, adapt, create derivative works from, distribute, perform, and display your User Content... solely for the purpose of providing you with the Services." }, { "label": "No selling (D4.3)", "text": "We do not sell personal information." } ], "policyUrl": "https://www.faceapp.com/privacy", "policyLastUpdated": "2024-11-04", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/faceapp.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" }, { "date": "2026-06-20", "score": 72, "grade": "B" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "microsoft-copilot", "name": "Microsoft Copilot", "vendor": "Microsoft", "domain": "copilot.microsoft.com", "category": "Assistant", "scoreOutOf100": 38, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: we can give those same rights to others who work on our behalf" ], "summary": "Microsoft Copilot discloses basic AI identity and data access rights, but trains on user data with opt-out, grants itself broad perpetual rights to outputs, and lacks specificity on data processors, international safeguards, and children's governance.", "highlights": [ { "label": "Training with Opt-Out", "text": "Conversation data trains generative AI models unless user opts out; opt-out mechanism not specifically named, only referenced as \"additional privacy choices\" in product settings" }, { "label": "Output Ownership Risk", "text": "Microsoft can copy, distribute, sublicense, and give outputs to third parties indefinitely (\"we can give those same rights to others who work on our behalf\") with no time limit or user control" }, { "label": "Deletion & Retention", "text": "Users can delete individual conversations (removed immediately, back-end deletion within 30 days), but overall retention policy is only \"for as long as reasonably necessary\" (vague)" }, { "label": "Data for Advertising", "text": "Policy states data used \"to provide relevant advertising\" with no explicit opt-out mechanism for ad-specific uses, unlike Anthropic's commitment to non-sale" } ], "policyUrl": "https://privacy.microsoft.com/en-us/privacystatement", "policyLastUpdated": "2026-06-12", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/copilot.microsoft.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" }, { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-21", "score": 38, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "midjourney", "name": "Midjourney", "vendor": "Midjourney", "domain": "midjourney.com", "category": "Image & video", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: You grant to Midjourney, its affiliates, successors, and assigns a perpetual, worldwide, non-exclusive, sublicensable no-charge, royalty-free, irrevocable copyright license" ], "summary": "Midjourney allows training on user inputs with opt-out, grants users output ownership subject to a broad perpetual sublicensable license, provides standard data rights, but lacks detail on retention timelines, security certifications, and breach notification procedures.", "highlights": [ { "label": "Training data opt-out", "text": "We may use Materials to provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out of training through your account settings." }, { "label": "Broad content license", "text": "You grant to Midjourney, its affiliates, successors, and assigns a perpetual, worldwide, non-exclusive, sublicensable no-charge, royalty-free, irrevocable copyright license" }, { "label": "Children protection (age 13+)", "text": "Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13." }, { "label": "Data access mechanism", "text": "In order to exercise Your rights please visit www.midjourney.com/account and follow the instructions listed at the bottom of the page" } ], "policyUrl": "https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy", "policyLastUpdated": "2025-06-02", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/midjourney.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-20", "score": 56, "grade": "C" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "civitai", "name": "Civitai", "vendor": "Civitai", "domain": "civitai.com", "category": "Image & video", "scoreOutOf100": 19, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: worldwide, non-exclusive, irrevocable, royalty-free, fully paid right and license (with the right to sublicense through multiple tiers)" ], "summary": "Civitai's privacy policy is minimal, with most data rights and transparency indicators either silent or vague; the broad sublicensable output license is adverse.", "highlights": [ { "label": "Critical: Broad Output Licence (D1.4)", "text": "Civitai reserves perpetual, irrevocable, sublicensable rights to all user-posted content with no limits on reuse or commercialization , users retain ownership in name only." }, { "label": "Missing Data Rights (D2.1–D2.4)", "text": "Policy is silent on access, deletion, portability, and correction rights , no explicit mechanisms disclosed despite these being fundamental under modern privacy law." }, { "label": "Weak AI Transparency (D5.1)", "text": "Describes the platform as AI-focused but does not explicitly disclose to users that they are interacting with AI systems or how their inputs may be processed." }, { "label": "Vague retention and security", "text": "Data is kept 'as long as reasonably necessary' and security rests on 'reasonable efforts' and generic 'safeguards,' with no named controls or breach notification timeline" } ], "policyUrl": "https://civitai.com/content/privacy", "policyLastUpdated": "2024-02-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/civitai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 46, "grade": "D" }, { "date": "2026-06-20", "score": 18, "grade": "F" }, { "date": "2026-06-21", "score": 19, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "pixelcut", "name": "Pixelcut", "vendor": "Pixelcut", "domain": "pixelcut.ai", "category": "Image & video", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Pixelcut's policy is GDPR-compliant boilerplate with no AI training disclosures; silent on model training, data minimization, retention specifics, deletion timelines, and security certifications.", "highlights": [ { "label": "D1 Training Data , CRITICAL GAP", "text": "Policy is entirely SILENT on inputs/outputs training models. No mechanism named; no opt-out disclosed. Quotes attributed to D1.1/D1.2/D1.4 do not appear in document." }, { "label": "D2 Rights , Boilerplate GDPR/US law", "text": "Generic listing of statutory rights (access, deletion, portability, correction, object to direct marketing). No named mechanism beyond contact form." }, { "label": "D3 Retention , Vague 'as long as necessary'", "text": "'Personal Data shall be processed and stored for as long as required by the purpose they have been collected for' , no concrete retention periods named for any data type." }, { "label": "D6.4 Children , Strong age gate", "text": "'Usage of Pixelcut and the Service is age restricted: to access and use Pixelcut and its Service the User must be an adult under applicable law.'" } ], "policyUrl": "https://www.pixelcut.ai/privacy", "policyLastUpdated": "2026-05-18", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pixelcut.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 45, "grade": "D" }, { "date": "2026-06-20", "score": 49, "grade": "D" }, { "date": "2026-06-21", "score": 32, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "freepik", "name": "Freepik", "vendor": "Freepik Company (Magnific)", "domain": "magnific.com", "category": "Image & video", "scoreOutOf100": 51, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.1: Under no circumstances will we use your images or voices...to train or improve our artificial intelligence models" ], "summary": "Freepik (now Magnific) does not explicitly forbid training on user inputs without opt-out, perpetually sublicenses user images and voices without opt-out, and lacks transparent data minimization commitments, with only limited automated-decision disclosure and fragmented data handling rules across multiple documents.", "highlights": [ { "label": "D1.1 contradicts D4 & actual practice", "text": "Policy states 'Under no circumstances will we use your images...to train' but section 9 permits using Inputs/Outputs for 'security purposes and to improve...products' and section 3.4 permits third-party model training on uploaded content without opt-out." }, { "label": "Sublicensed to third parties", "text": "Images/voices are 'transferred to third parties in the form of licences or access' with no stated opt-out or time limit for this distribution." }, { "label": "D1.4 scope ambiguity", "text": "Quote applies only to outputs for third-party AI models, not Magnific's own models, creating false impression of user ownership over model-training data." }, { "label": "D5.3 purposes lack concrete legal bases", "text": "Data categories listed but purposes stated only as vague 'to provide/maintain' service without mapping to specific legal bases per GDPR article 6." } ], "policyUrl": "https://www.magnific.com/legal/privacy", "policyLastUpdated": "2026-04-01", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/magnific.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 80, "grade": "B" }, { "date": "2026-06-20", "score": 79, "grade": "B" }, { "date": "2026-06-21", "score": 51, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "ADVERSE" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "picsart", "name": "Picsart", "vendor": "Picsart", "domain": "picsart.com", "category": "Image & video", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: You grant Picsart a worldwide, non-exclusive, royalty-free, sublicensable and transferable license to use your Content... This license is perpetual", "D2.2: certain information may be stored indefinitely where a user has violated our policies or terms" ], "summary": "Picsart reserves broad perpetual sublicensable content licenses, indefinite retention for policy violators, and lacks biometric governance despite collecting face geometry.", "highlights": [ { "label": "D1.4: Perpetual sublicensable license", "text": "You grant Picsart a worldwide, non-exclusive, royalty-free, sublicensable and transferable license to use your Content... This license is perpetual" }, { "label": "D2.2: Indefinite retention exception", "text": "certain information may be stored indefinitely where a user has violated our policies or terms" }, { "label": "D6.2: Biometric collection without governance", "text": "Picsart scans your face geometry in the images you upload to our services (sometimes referred to by us as biometric data)" }, { "label": "D6.4: Age-gated children protection", "text": "You are not allowed to use our services if you are under the age of 14... If we become aware that we have received personal Information from a person under the age of 14, we will delete this information and terminate the person's account" } ], "policyUrl": "https://picsart.com/privacy-policy/", "policyLastUpdated": "2023-11-16", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/picsart.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 42, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "ADVERSE" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "higgsfield", "name": "Higgsfield", "vendor": "Higgsfield", "domain": "higgsfield.ai", "category": "Image & video", "scoreOutOf100": 39, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: you hereby grant to the Company a non-exclusive, irrevocable, perpetual, worldwide, royalty-free, fully paid, transferable, sublicensable right and license to use any Inputs and Outputs" ], "summary": "Higgsfield offers opt-out training, 90-day deletion, and broadly shares user data with multiple third parties, but lacks global transparency on data transfer safeguards, purposes/legal bases, and international security mechanisms outside EU addendum.", "highlights": [ { "label": "Training data use with opt-out", "text": "improve the Service (including by using your user-shared text and multimedia data and query and prompt data to train our algorithms), unless you opt out of training through your account settings" }, { "label": "90-day deletion after account closure", "text": "your content will become immediately inaccessible and should be purged from our systems in full within 90 days" }, { "label": "Perpetual sublicensable outputs licence", "text": "you hereby grant to the Company a non-exclusive, irrevocable, perpetual, worldwide, royalty-free, fully paid, transferable, sublicensable right and license to use any Inputs and Outputs" }, { "label": "Broad third-party sharing", "text": "Affiliates, Service providers, Payment processors, Advertising partners, Third parties designated by you, Partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees, Other users and the public" } ], "policyUrl": "https://higgsfield.ai/privacy-policy", "policyLastUpdated": "2025-08-30", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/higgsfield.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-21", "score": 39, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "ideogram", "name": "Ideogram", "vendor": "Ideogram", "domain": "ideogram.ai", "category": "Image & video", "scoreOutOf100": 34, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Ideogram discloses non-sale/non-share for ads, enumerated data categories, and user ownership of outputs, but lacks detail on training opt-outs, data minimization, security controls, and breach notification procedures.", "highlights": [ { "label": "D4.3 - No ad sales", "text": "We do not 'sell' or 'share' (as those terms are defined under the CCPA) personal information, nor have we done so in the preceding 12 months" }, { "label": "D5.3 - Data categories enumerated", "text": "Identifiers, Commercial information, Internet and similar network activity information, Geolocation information, Visual information, Account access credentials, Precise geolocation" }, { "label": "D1.4 - Output ownership ambiguous", "text": "royalty-free, transferable, sublicensable, worldwide and irrevocable (for so long as Your Content is stored with us)... pass these rights along to, others with whom we have contractual relationships" }, { "label": "D3.1 - Vague retention period", "text": "We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy" } ], "policyUrl": "https://ideogram.ai/legal/privacy", "policyLastUpdated": "2025-01-15", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/ideogram.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-20", "score": 46, "grade": "D" }, { "date": "2026-06-21", "score": 34, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "manus", "name": "Manus", "vendor": "Manus", "domain": "manus.im", "category": "Assistant", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: you are the owner of all right, title and interest in Your Content... we grant us and our affiliates, successors, and assigns a non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable right" ], "summary": "Manus discloses opt-out training control and offers core data rights (access, deletion with caveats, correction), but grants sublicensable content licenses and lacks detailed retention specificity outside sandbox data.", "highlights": [ { "label": "Training opt-out", "text": "opt out of training through your account settings (but not opt-in by default)" }, { "label": "Content licence adversity", "text": "user grants non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable right to provider" }, { "label": "Deletion with caveat", "text": "Delete where there is no good reason for continuing to process (conditional right)" }, { "label": "DPO appointed", "text": "Data Protection Officer responsible for overseeing privacy compliance. Contact: privacy@manus.im" } ], "policyUrl": "https://manus.im/privacy", "policyLastUpdated": "2026-04-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/manus.im.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-20", "score": 69, "grade": "C" }, { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "quillbot", "name": "QuillBot", "vendor": "Learneo", "domain": "quillbot.com", "category": "Productivity", "scoreOutOf100": 28, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "QuillBot's policy is vague on training-data use, retention periods, and biometric practices, with unsubstantiated opt-out mechanisms and no concrete safeguards disclosed for most data rights.", "highlights": [ { "label": "D1.1/D1.2 Training Data Use", "text": "Claims opt-out via account settings but provides no evidence of actual mechanism, named location, or proof of functionality. Changed from 'half' to 'zero' per strict standards." }, { "label": "D3.1 Retention", "text": "Policy defers to 'applicable Part Two section' which contains only navigation links in the rendered snapshot, leaving actual retention periods silent. Correctly zero." }, { "label": "D6.2 Biometric Data", "text": "Mentions facial geometry only in conditional verification context ('may ask you'). This is optional scenario, not biometric governance commitment. Changed from 'half' to 'zero'." }, { "label": "Unsubstantiated data claims", "text": "Many data-use statements are vague, conditional, or point to sections that do not exist, so commitments on training, retention, and biometrics cannot be relied upon" } ], "policyUrl": "https://quillbot.com/privacy", "policyLastUpdated": "2025-11-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/quillbot.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" }, { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-21", "score": 28, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "kimi", "name": "Kimi", "vendor": "Moonshot AI", "domain": "kimi.com", "category": "Assistant", "scoreOutOf100": 46, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: you grant us and our affiliates a non-exclusive, unrestricted, perpetual, free license to use and re-license to third parties" ], "summary": "Kimi trains inputs by default without explicit opt-in, shares with service providers and affiliates, commits only to vague retention practices, and relies on passive child protections, but does disclose data categories, offers core deletion/access rights, and uses minimal named security controls.", "highlights": [ { "label": "D1.4 , Harmful content licence", "text": "Policy grants Kimi \"a non-exclusive, unrestricted, perpetual, free license to use and re-license to third parties\" , a broad, sublicensable clause reserved without user opt-out." }, { "label": "D5.4 , Vague purpose-to-basis links", "text": "Policy lists purposes but links inconsistently to legal bases; many purposes reference only \"applicable law\" or \"legitimate interests\" without specific justification, falling short of full transparency." }, { "label": "D2.1–2.5 , Core rights present", "text": "Access, deletion (with exceptions), portability, correction, and marketing objection all explicitly named with defined scope; deletion right includes legal/fraud exceptions." }, { "label": "D7.2 , Breach notice lacks timeframe", "text": "Policy commits to \"promptly inform\" of breaches but provides no named timeframe (e.g., 72 hours), rendering the commitment vague." } ], "policyUrl": "https://www.kimi.com/user/agreement/userPrivacy?version=v2", "policyLastUpdated": "2025-07-07", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/kimi.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" }, { "date": "2026-06-20", "score": 65, "grade": "C" }, { "date": "2026-06-21", "score": 46, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "mistral-le-chat", "name": "Mistral Le Chat", "vendor": "Mistral AI", "domain": "mistral.ai", "category": "Assistant", "scoreOutOf100": 74, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Mistral Le Chat trains user inputs by default with an opt-out on Enterprise/paid tiers, offers standard rights with some ambiguities, has unclear breach-notification safeguards, but explicitly discloses non-use of sublicensable outputs for training, undermined by a perpetual sublicense grant for service providers.", "highlights": [ { "label": "Sublicensable output licence", "text": "Policy grants Mistral 'worldwide, non-exclusive, non-transferable license with the right to sublicense to our delegates and subcontractors' , a perpetual sublicensable licence that contradicts user ownership." }, { "label": "D6.1 , Strong ADM protection", "text": "Mistral explicitly states 'does not engage in profiling or automated decision-making in the processing of personal data' , full award for absence of ADM." }, { "label": "D1.1 & D1.3 , Conditional no-train", "text": "Free/Vibe tiers train by default with opt-out; Enterprise/paid APIs do not train. Three distinct tiers disclosed, supporting half award on D1.1 and full on D1.3." }, { "label": "Thin security disclosure", "text": "The policy names no security controls such as encryption or recognised certifications and gives no breach notification timeframe" } ], "policyUrl": "https://legal.mistral.ai/terms/privacy-policy", "policyLastUpdated": "2026-05-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/mistral.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 84, "grade": "B" }, { "date": "2026-06-21", "score": 74, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "seaart", "name": "SeaArt", "vendor": "SeaArt", "domain": "seaart.ai", "category": "Image & video", "scoreOutOf100": 35, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: worldwide, perpetual, non-exclusive, no-charge, royalty-free, sublicensable, irrevocable license to create derivative works" ], "summary": "SeaArt discloses data access and correction rights clearly, but deletion rights are conditionally vague; content licensing grants perpetual sublicensable rights without explicit user opt-out, AI involvement disclosure is named, but retention periods lack concrete timeframes.", "highlights": [ { "label": "Perpetual Content License (Adverse)", "text": "worldwide, perpetual, non-exclusive, no-charge, royalty-free, sublicensable, irrevocable license to create derivative works" }, { "label": "Access Right (Strong)", "text": "You have the right to access personal information we hold about you, how we use it, and who we share it with" }, { "label": "Deletion Vagueness (Weak)", "text": "You can delete your Account, or remove certain personal information, by logging into your Account" }, { "label": "Retention Vagueness (Weak)", "text": "Personal Information is kept until the end of its life cycle" } ], "policyUrl": "https://node1.cdn2.seaart.ai/mirror/static/upload/policy.html", "policyLastUpdated": "2023-07-03", "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/seaart.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 44, "grade": "D" }, { "date": "2026-06-20", "score": 45, "grade": "D" }, { "date": "2026-06-21", "score": 35, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "talkie", "name": "Talkie", "vendor": "Talkie AI", "domain": "talkie-ai.com", "category": "Companion", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.1: allow your AI chatbot to learn from your interactions to improve your conversations", "D1.4: non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, store, modify, and otherwise use your User Content in connection with the operation of the Services or the promotion, advertising, or marketing thereof" ], "summary": "Talkie offers moderate rights access (read, delete, correct, portability, opt-out) and security controls, but trains on user conversations without explicit opt-in, reserves perpetual sublicensable rights to user content, and lacks enforceable data minimization.", "highlights": [ { "label": "Training with no opt-out", "text": "allow your AI chatbot to learn from your interactions to improve your conversations (D1.1 adverse)" }, { "label": "Broad content licence", "text": "non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable, perpetual, irrevocable license to use your User Content in connection with promotion, advertising, or marketing (D1.4 adverse)" }, { "label": "Full data access & deletion rights", "text": "Access to a copy of personal information; Deletion of personal information; Correction of inaccurate data; portable, machine-readable format (D2.1–D2.4 full)" }, { "label": "Named security controls", "text": "All transmitted data encrypted; Access protected by firewalls, role-based access controls, and passwords (D7.1 full)" } ], "policyUrl": "https://www.talkie-ai.com/static/privacy", "policyLastUpdated": "2025-12-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/talkie-ai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "cutout-pro", "name": "Cutout.Pro", "vendor": "Cutout.Pro", "domain": "cutout.pro", "category": "Image & video", "scoreOutOf100": 30, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Cutout.Pro prohibits user training use but is silent on its own AI model training; supports deletion and access but with vague timelines; names AWS as processor and explicitly blocks third-party sharing; discloses facial transformation AI with TLS encryption but lacks certification credentials.", "highlights": [ { "label": "Training prohibition", "text": "Use for the following purposes is prohibited: Research/development of artificial intelligence (in particular generation of training data)" }, { "label": "Automatic deletion", "text": "Any uploaded images and videos, processed or non-processed will be deleted automatically" }, { "label": "Third-party sharing ban", "text": "A share or publish of information to any third parties are prohibited" }, { "label": "AI disclosure", "text": "We use artificial intelligence technology to automatically create highly realistic facial transformations base on the portrait photos user uploaded" } ], "policyUrl": "https://www.cutout.pro/privacy", "policyLastUpdated": null, "modalities": [ "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cutout.pro.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-20", "score": 52, "grade": "D" }, { "date": "2026-06-21", "score": 30, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "zero", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "hypic", "name": "Hypic", "vendor": "Hypic", "domain": "hypic.com", "category": "Image & video", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Hypic collects user inputs for model training with opt-out option, but global privacy rights are vague and jurisdiction-dependent with explicit rights limited to EEA/Brazil/Asia-specific sections.", "highlights": [ { "label": "Training without explicit opt-in", "text": "To train and improve our technology, such as our machine learning models and algorithms" }, { "label": "User owns exported content copyright", "text": "You or the owner of your User Content always own the copyright in User Content edited and exported from the Platform" }, { "label": "Biometric data deletion", "text": "Any images we collect to provide these features will be deleted promptly after we provide the said features that use face information and not retained" }, { "label": "Jurisdiction-dependent rights", "text": "As discussed further in the Supplemental Terms - Jurisdiction Specific, you may also be afforded rights in your country under applicable laws" } ], "policyUrl": "https://m.hypic.com/clause/hypic-privacy-policy", "policyLastUpdated": "2026-01-22", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/hypic.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 32, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "facemoji", "name": "Facemoji", "vendor": "Facemoji", "domain": "facemojikeyboard.com", "category": "Image & video", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: perpetual license to use, copy, reproduce, distribute, adapt, re-format, modify, publish, translate, license, sub-license, and exploit the User Content" ], "summary": "Facemoji collects keyboard inputs for model training with a named opt-out toggle, discloses AI interactions clearly, but grants itself a perpetual sublicensable license over user content and sells Internet/Network data with opt-out only.", "highlights": [ { "label": "Training opt-out available", "text": "Keyboard inputs are used to train models, but a 'share data' toggle lets users opt out" }, { "label": "No closure deletion timeline", "text": "Analytics data is deleted after 30 days, but the policy names no specific timeline for deleting your data after you close your account" }, { "label": "Perpetual content licence", "text": "Grants a perpetual, sublicensable, and transferable licence to 'license, sub-license, and exploit the User Content anywhere,' allowing reuse by third parties" }, { "label": "Automated decision rights are EEA only", "text": "Rights around automated decisions appear only in the EEA-specific section, so users elsewhere are not guaranteed them by default" } ], "policyUrl": "https://www.facemojikeyboard.com/page/privacy/appstore/privacy.html", "policyLastUpdated": "2025-11-11", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/facemojikeyboard.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 69, "grade": "C" }, { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "gamma", "name": "Gamma", "vendor": "Gamma Tech, Inc.", "domain": "gamma.app", "category": "Productivity", "scoreOutOf100": 46, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Gamma's policy discloses basic AI functionality and user data rights (access, deletion, correction, marketing opt-out) but lacks specificity on training opt-out mechanism, offers vague retention standards, and names international transfer safeguards without security control details.", "highlights": [ { "label": "User ownership & output rights", "text": "you retain any right, title, and interest that you have in the Inputs you submit; we assign to you all of our right, title, and interest in Outputs; unless you opt out of training through your account settings" }, { "label": "Data rights (global)", "text": "Right to access, deletion (subject to exceptions), correction, portability; opt-out of marketing (unsubscribe) and targeted advertising (Cookie Preference Center)" }, { "label": "International safeguards", "text": "Transfers to US or other locations use adequacy decisions or Standard Contractual Clauses where no adequacy decision applies" }, { "label": "Data categories enumerated", "text": "Contact data, Demographic data, Profile data, Communications data, Transactional data, Marketing data, User-generated content, Device data, Online activity data, Communication interaction data, Cookies" } ], "policyUrl": "https://gamma.app/privacy", "policyLastUpdated": "2025-04-10", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gamma.app.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" }, { "date": "2026-06-20", "score": 54, "grade": "D" }, { "date": "2026-06-21", "score": 46, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "candy-ai", "name": "Candy.AI", "vendor": "EverAI Limited", "domain": "candy.ai", "category": "Companion", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Candy.AI discloses limited training data practices with no explicit opt-out, offers GDPR-aligned deletion and portability rights, retains data up to three years with selective AI-log purging, shares with named service provider categories, explicitly forbids selling data, discloses AI interaction and basic data categories, and requires parental compliance for under-18 protection.", "highlights": [ { "label": "Data Deletion & Portability", "text": "Users can delete account data without undue delay or request portability in structured, commonly used, machine-readable format." }, { "label": "No Data Sale or Third-Party Sharing", "text": "\"We will not disclose, sell, trade, or otherwise transfer your Personal Data to any third parties without your Consent\" , with named service provider categories for necessary operations." }, { "label": "Retention Period", "text": "Account data retained for up to three years (possibly one year) after last activity; log files auto-deleted after 30 days." }, { "label": "Training Data Use", "text": "Data used to train AI models with anonymized/de-identified processing, but no explicit opt-out mechanism disclosed for model training." } ], "policyUrl": "https://candy.ai/privacy-policy", "policyLastUpdated": "2026-05-27", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/candy.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "remini", "name": "Remini", "vendor": "Bending Spoons", "domain": "remini.ai", "category": "Image & video", "scoreOutOf100": 52, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Remini's policy discloses user training-data opt-out, GDPR data rights, reasonable retention periods with defined numbers, limited third-party sharing, and basic security measures, but lacks explicit AI transparency, synthetic-output marking, and specific breach-notification timeframes.", "highlights": [ { "label": "D1.1 – Training data use", "text": "we will only use your User-Generated Content to improve the performance of machine learning models with your prior consent" }, { "label": "D2 – GDPR rights cluster", "text": "Right of access, Right to erasure, Right to data portability, Right to rectification, Right to object all explicitly named and described" }, { "label": "D3.2 – Data deletion timeline", "text": "at the end of these periods, the personal data processed will be deleted or anonymized" }, { "label": "D6.4 – Age gate", "text": "OUR SERVICE IS NOT AVAILABLE TO INDIVIDUALS UNDER THE AGE OF 16" } ], "policyUrl": "https://app.remini.ai/privacy-and-cookie-policy", "policyLastUpdated": "2026-01-20", "modalities": [ "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/remini.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 73, "grade": "B" }, { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-21", "score": 52, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "pixverse", "name": "PixVerse", "vendor": "PixVerse (AISphere)", "domain": "pixverse.ai", "category": "Image & video", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: you grant the company and/or its affiliates a free, worldwide, perpetual and sublicensable license to use, reproduce, modify, distribute, and display such Information Content" ], "summary": "PixVerse discloses training without explicit opt-out, allows deletion requests, prohibits sales, requires age 16+, but lacks granular retention timelines, versioning transparency, and automated deletion timelines.", "highlights": [ { "label": "D1.4 adverse", "text": "Perpetual, sublicensable license for model training is an explicit reserved-harm mechanism. Adverse flag should be TRUE even though opt-out exists (opt-out alone doesn't erase the harmful default)." }, { "label": "No guaranteed deletion timeline", "text": "Deletion is handled on request only, with no guaranteed timeframe and no automatic back-end deletion promised" }, { "label": "Broad content licence", "text": "Reserves a perpetual, sublicensable licence over user content by default, with no clear statement that users own their outputs" }, { "label": "No real version history", "text": "The policy carries a date stamp but no version numbers, change log, or historical versions, so users cannot track how terms have changed" } ], "policyUrl": "https://pixverse.ai/en/privacy-policy", "policyLastUpdated": "2026-05-07", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pixverse.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-21", "score": 27, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "veed", "name": "VEED", "vendor": "VEED", "domain": "veed.io", "category": "Image & video", "scoreOutOf100": 63, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "VEED's privacy policy provides transparency on tier-specific training use and data rights, with mostly functional GDPR-aligned protections, though output ownership is broadly licensed to third parties rather than user-exclusive.", "highlights": [ { "label": "Opt-out costs you access", "text": "To avoid training on the free tier you must delete your account or upgrade to a paid plan, rather than opt out while keeping free access" }, { "label": "Transferable content licence", "text": "The licence over user content is 'transferable' and extends to 'other users or partners,' going beyond what is needed to deliver the service" }, { "label": "Silent on security controls (D7.1)", "text": "Policy contains no named technical controls (TLS, AES-256, RBAC, encryption standards). Award remains zero." } ], "policyUrl": "https://www.veed.io/privacy", "policyLastUpdated": "2025-01-06", "modalities": [ "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/veed.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-20", "score": 76, "grade": "B" }, { "date": "2026-06-21", "score": 63, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "hugging-face", "name": "Hugging Face", "vendor": "Hugging Face", "domain": "huggingface.co", "category": "Productivity", "scoreOutOf100": 43, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Hugging Face policy provides explicit deletion timelines and access mechanisms, named sub-processors, and no-sell commitments, but lacks transparency on input training, retention specifics, and named security controls.", "highlights": [ { "label": "Deletion timeline", "text": "we will use commercially reasonable efforts to delete your information and Content of your own Repositories, whether public or private, within 90 days" }, { "label": "No-sell clause", "text": "The Company will not sell, rent or lease your Personal Information" }, { "label": "Sub-processor list", "text": "Discourse | Forum | United States; AWS SES | Emails | United States; Amazon Web Services, Inc. | Hosting/Infrastructure | United States; [plus 8 more listed]" }, { "label": "Security vagueness", "text": "The Company follows generally accepted industry standards, including the use of appropriate administrative, physical and technical safeguards" } ], "policyUrl": "https://huggingface.co/privacy", "policyLastUpdated": "2023-03-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/huggingface.co.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 49, "grade": "D" }, { "date": "2026-06-20", "score": 48, "grade": "D" }, { "date": "2026-06-21", "score": 43, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "photomath", "name": "Photomath", "vendor": "Google", "domain": "photomath.com", "category": "Productivity", "scoreOutOf100": 43, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: perpetual, irrevocable, non-exclusive, worldwide, transferable, royalty-free and fully paid right and license, with the right to sublicense" ], "summary": "Photomath's policy reflects strong rights disclosures (access, deletion, portability, correction, objection) and explicit non-sale commitments, but weak specificity on training data use, retention periods (vague \"necessary\" language), and security certifications.", "highlights": [ { "label": "User output ownership & reuse", "text": "perpetual, irrevocable, non-exclusive, worldwide, transferable, royalty-free and fully paid right and license, with the right to sublicense , adverse because explicitly grants sublicensable, perpetual rights" }, { "label": "No-sell guarantee", "text": "We do not sell, lease, rent or otherwise disclose the personal data relating to our users to third parties unless otherwise stated herein" }, { "label": "Retention vagueness", "text": "We shall only store Personal information for as long as we have legitimate need for it , vague, no concrete number or defined scope" }, { "label": "Security: named controls", "text": "firewalled and secured database with strictly limited and controlled access rights, using encryption , names encryption but no TLS/AES/RBAC specification" } ], "policyUrl": "https://photomath.com/privacy/", "policyLastUpdated": "2023-10-31", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/photomath.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 43, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "brainly", "name": "Brainly", "vendor": "Brainly sp. z o.o.", "domain": "brainly.com", "category": "Productivity", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: irrevocably grant Brainly worldwide, non-exclusive, irrevocable, assignable and transferable perpetual rights to use Your Content" ], "summary": "Brainly explicitly forbids training on personal data and discloses AI use; grants core data rights but lacks retention numbers, minimization commitments, and breach notification timelines.", "highlights": [ { "label": "Strong no-train disclosure", "text": "We do not use your personal data for training models" }, { "label": "Perpetual content licence (adverse)", "text": "Irrevocably grant Brainly worldwide, non-exclusive, irrevocable, assignable and transferable perpetual rights to use Your Content" }, { "label": "Vague retention period", "text": "Data is kept 'as long as it may be relevant to the purposes for which it was collected,' with no concrete retention period named" }, { "label": "Data rights (D2 cluster)", "text": "Access, update/correct, request deletion, object to or restrict processing, data portability (machine-readable)" } ], "policyUrl": "https://brainly.com/pages/privacy_policy", "policyLastUpdated": "2026-02-26", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/brainly.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-20", "score": 65, "grade": "C" }, { "date": "2026-06-21", "score": 45, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "notebooklm", "name": "NotebookLM", "vendor": "Google", "domain": "notebooklm.google", "category": "Productivity", "scoreOutOf100": 66, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "NotebookLM discloses explicit no-training for inputs unless feedback is provided, tier protections for Workspace users, deletion rights, 3-year retention with feedback minimization, and 18+ age verification.", "highlights": [ { "label": "No-train commitment (inputs)", "text": "The content in NotebookLM will not be used to directly train our foundational AI models, unless you choose to provide feedback." }, { "label": "Workspace tier protection", "text": "Google Workspace or Google Workspace for Education users...will not be reviewed by human reviewers...and will not be used to train AI models" }, { "label": "Feedback minimization", "text": "disconnecting your feedback from your Google Account before reviewers see or annotate them" }, { "label": "Age gate", "text": "You must be at least 18 years old or the minimum age required to consent to use the Services" } ], "policyUrl": "https://support.google.com/notebooklm/answer/17004255", "policyLastUpdated": "2026-05-26", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/notebooklm.google.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 81, "grade": "B" }, { "date": "2026-06-21", "score": 66, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "cohere", "name": "Cohere", "vendor": "Cohere", "domain": "cohere.com", "category": "Model provider", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.1: For Trial Users and Researchers...we may use this input and output data to conduct research and development", "D1.4: YOU GRANT US A NONEXCLUSIVE, WORLDWIDE, ROYALTY-FREE, IRREVOCABLE, SUBLICENSABLE...RIGHT...including by sharing API Data and Finetuning Data with Third Parties" ], "summary": "Cohere trains trial users' inputs on models with no opt-out, offers vague data controls to enterprise customers, and grants itself irrevocable sublicensable rights to share training data with unlimited third parties.", "highlights": [ { "label": "D1.4: Perpetual sublicensable licence", "text": "Cohere explicitly grants itself 'IRREVOCABLE, SUBLICENSABLE' rights and reserves the right to share training and fine-tuning data with third parties 'in accordance with their terms and conditions' , with no user opt-out." }, { "label": "D1.1: Trial users' data trained with no opt-out", "text": "For Trial Users and Researchers, policy states 'We may use this input and output data to conduct research and development' with only a de-identification safeguard, no opt-out mechanism disclosed." }, { "label": "D3.1: Enterprise-only 30-day retention", "text": "Only Enterprise Users get a defined 30-day retention period. Trial Users and Researchers receive no named retention commitment." }, { "label": "D2.1–D2.4: Conditional deletion/access rights", "text": "All data subject rights (access, deletion, correction, portability) are qualified with 'may request', 'subject to certain exceptions', and caveats , no unconditional commitments." } ], "policyUrl": "https://cohere.com/privacy", "policyLastUpdated": "2026-05-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cohere.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 78, "grade": "B" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "glean", "name": "Glean", "vendor": "Glean", "domain": "glean.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Glean discloses basic opt-out for marketing sharing and named personnel oversight, but is silent on user data rights, retention timelines, and security controls beyond boilerplate language.", "highlights": [ { "label": "Opt-out for marketing sharing", "text": "To opt out of sharing for third-party marketing purposes, contact privacy@glean.com" }, { "label": "Named Data Protection Officer", "text": "Data Protection Officer: Michael Moore, Legal Department" }, { "label": "Enumerated data categories", "text": "Identity and Contact Data... Payment Information... Information Collected Automatically... Information from Third Parties" }, { "label": "No sale of personal information", "text": "We do not sell your Personal Information" } ], "policyUrl": "https://www.glean.com/privacy", "policyLastUpdated": "2026-04-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/glean.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 56, "grade": "C" }, { "date": "2026-06-21", "score": 27, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "writer", "name": "Writer", "vendor": "Writer", "domain": "writer.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 59, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Writer explicitly forbids use of user inputs/outputs to train its models, assigns output ownership to users, provides clear access/correction/deletion rights, commits to data retention only as needed, discloses AI interaction requirements, enumerates data categories and legal bases, and complies with Data Privacy Frameworks.", "highlights": [ { "label": "D1.1: No-Train Commitment", "text": "in no event will we use any data you provide to us when you access or use our Services to train our models, including any inputs or outputs" }, { "label": "D1.4: Output Ownership", "text": "you retain any right, title, and interest that you have in any Input, and we assign to you all right, title, and interest, if any, in and to the Output" }, { "label": "D5.1: AI Disclosure Required", "text": "you shall not hide or misrepresent to any users on your account or to any third party that they are interacting with an artificial intelligence system rather than a human" }, { "label": "D4.4: Data Privacy Framework Certification", "text": "WRITER complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework" } ], "policyUrl": "https://writer.com/legal/privacy/", "policyLastUpdated": "2026-04-17", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/writer.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 59, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "synthesia", "name": "Synthesia", "vendor": "Synthesia", "domain": "synthesia.io", "category": "Image & video", "audience": "Enterprise", "scoreOutOf100": 62, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Synthesia offers opt-out training, comprehensive data rights including deletion, enumerated data categories, and explicit restrictions on biometric data monetization, but remains vague on AI component disclosure and lacks breach notification timelines.", "highlights": [ { "label": "Training opt-out", "text": "You will be asked whether you consent to the use of your Biometric Data" }, { "label": "Data deletion within timeline", "text": "automatically deleted from our back-end within 30 days" }, { "label": "Biometric restrictions", "text": "We will not sell, lease, trade, or otherwise profit from Biometric Data and will not permit its vendor(s) to sell, lease, trade" }, { "label": "Legal bases disclosed", "text": "We rely on different legal bases...for each legal basis below, we describe the purposes" } ], "policyUrl": "https://www.synthesia.io/legal/privacy-policy", "policyLastUpdated": "2025-01-30", "modalities": [ "video" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/synthesia.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-21", "score": 62, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "harvey", "name": "Harvey", "vendor": "Harvey", "domain": "harvey.ai", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 56, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Harvey discloses core data rights (access, deletion, portability, correction) and international transfer safeguards (DPF, Standard Contractual Clauses) but lacks named training opt-out, security controls, and account deletion timelines.", "highlights": [ { "label": "D2 Rights (Access/Deletion/Portability)", "text": "Access, correct, update, or request deletion of your Personal Data; delete individual conversations, which will be removed immediately from your conversation history and automatically deleted from our back-end within 30 days; Request portability of your personal data" }, { "label": "D4 Sharing Controls", "text": "Harvey does not sell or share personal data with third parties in exchange for payment; We comply with the EU-U.S. Data Privacy Framework, Standard Contractual Clauses for international transfers" }, { "label": "D1 Training Mechanism (Gap)", "text": "Policy discloses training on publicly available information and feedback but lacks explicit named opt-out/opt-in mechanism for user Inputs to train models" }, { "label": "D7 Security (Gap)", "text": "We protect your Personal Data through technical and organizational measures (vague, no named controls like TLS/AES-256); no breach notification timeframe" } ], "policyUrl": "https://www.harvey.ai/legal/privacy-policy", "policyLastUpdated": "2025-12-23", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/harvey.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 70, "grade": "B" }, { "date": "2026-06-21", "score": 56, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "abridge", "name": "Abridge", "vendor": "Abridge", "domain": "abridge.com", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 31, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Abridge's privacy policy discloses consumer rights and data-sharing practices but lacks detail on automated decision-making, training data use, and security certifications.", "highlights": [ { "label": "Boilerplate security", "text": "Commits only to 'appropriate administrative, physical, and technical safeguards' without naming specific mechanisms such as encryption or access controls" }, { "label": "No named certifications", "text": "Provides a privacy contact email but names no recognised certification such as ISO 27001 or SOC 2 and no formal data protection officer" }, { "label": "D6.1 corrected to zero", "text": "Policy only discloses opt-out right from automated decisions; does not affirmatively disclose automated decision-making with human-review mechanisms. Zero, not silent on absence." } ], "policyUrl": "https://www.abridge.com/privacy", "policyLastUpdated": "2025-08-22", "modalities": [ "audio", "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/abridge.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 43, "grade": "D" }, { "date": "2026-06-21", "score": 31, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "databricks", "name": "Databricks", "vendor": "Databricks", "domain": "databricks.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 36, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: perpetual, irrevocable, worldwide, non-exclusive, sub-licensable, fully paid-up and royalty-free license" ], "summary": "Databricks discloses recipient categories, international transfer safeguards (SCCs), and children's protections clearly, but is silent on training-data use, retention timelines post-deletion, security certifications, breach notification, and government data standards.", "highlights": [ { "label": "D1.4 Sublicensable Licence (ADVERSE)", "text": "Policy grants Databricks 'perpetual, irrevocable, worldwide, non-exclusive, sub-licensable, fully paid-up and royalty-free license' to user submissions, explicitly reserving sublicensable rights in violation of user ownership principle." }, { "label": "Vague correction and restriction rights", "text": "Rights to amend data and restrict 'certain uses' are named but described in general terms, with no concrete mechanism or timeline for exercising them" }, { "label": "D7.1 Half for Vague Security Controls", "text": "Policy states only 'technical, physical, and organizational security measures' without naming TLS, AES-256, RBAC, ISO 27001, or SOC 2. Adjectives alone do not merit full." } ], "policyUrl": "https://www.databricks.com/legal/privacynotice", "policyLastUpdated": "2026-01-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/databricks.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 36, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "snowflake", "name": "Snowflake", "vendor": "Snowflake", "domain": "snowflake.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Snowflake discloses moderate data handling practices including Usage Data processing with anonymization limits, customer data ownership rights, prompt deletion timelines, and named security controls, though lacks explicit no-sales policy and some gaps in special-category governance.", "highlights": [ { "label": "Data Ownership & Control", "text": "Customer retains all right, title and interest in Customer Data; Snowflake's processing rights are limited to service provision." }, { "label": "Deletion & Retrieval Rights", "text": "30-day retrieval window after termination; Snowflake shall promptly delete Customer Data thereafter." }, { "label": "Usage Data Sharing Limits", "text": "Snowflake may not share Usage Data including Customer Confidential Information except aggregated and anonymized." }, { "label": "Security Controls Named", "text": "Physical access controls, encryption, internet firewalls, intrusion detection and network monitoring implemented." } ], "policyUrl": "https://www.snowflake.com/en/legal/privacy/privacy-policy/", "policyLastUpdated": "2025-11-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/snowflake.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "granola", "name": "Granola", "vendor": "Granola", "domain": "granola.ai", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Granola provides opt-out access to training data, deletion, basic data rights, and named security controls, but lacks explicit standards for government access, breach notification, and synthetic output marking.", "highlights": [ { "label": "Training data opt-out", "text": "We only use De-Identified Data to train AI models, which you can opt-out of within your Granola account settings." }, { "label": "Account deletion mechanism", "text": "To delete your account, open your Granola app, click on Granola on the top left on your screen → Settings → Profile and at the bottom → Delete Account." }, { "label": "Security controls", "text": "All Personal Data is encrypted at rest and in transit using AWS's encrypted database system. Additionally, we implement firewalls, virtual private cloud (VPC) setups, and anti-virus/malware protection." }, { "label": "Recording retention", "text": "We do not retain or store such recordings once the transcription is created." } ], "policyUrl": "https://www.granola.ai/privacy", "policyLastUpdated": "2025-12-19", "modalities": [ "audio", "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/granola.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 75, "grade": "B" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "salesforce-einstein", "name": "Salesforce Einstein", "vendor": "Salesforce", "domain": "salesforce.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 65, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Salesforce Einstein discloses zero-retention for customer prompts, customer data ownership, opt-out mechanisms for sharing/ads, and named international transfer safeguards, but lacks specificity on deletion timelines, breach notification, and granular access/portability procedures.", "highlights": [ { "label": "Zero-Retention Policy", "text": "Prompts and generated responses are never stored or used to train the underlying third-party large language models; data masking replaces PII with non-identifiable tokens before the prompt is sent to the LLM." }, { "label": "Data Ownership & Control", "text": "Data belongs to the customer; data remains exclusively the customer's property. Customers remain in control of their data and models at all times." }, { "label": "Government Disclosure Standard", "text": "Shares data with government authorities only where based on good-faith belief that disclosure is reasonably necessary to comply with law, prevent harm, detect fraud, or enforce rights (vague standard lacking specificity)." }, { "label": "Children's Protections", "text": "No knowing collection of Personal Data from children under 13; for ages 13–18 only with parent/guardian consent or separate agreement." } ], "policyUrl": "https://www.salesforce.com/company/privacy/full_privacy/", "policyLastUpdated": "2026-05-19", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/salesforce.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" }, { "date": "2026-06-21", "score": 65, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "github-copilot", "name": "GitHub Copilot", "vendor": "GitHub (Microsoft)", "domain": "github.com", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 78, "letterGrade": "A", "displayedGrade": "A", "confidence": "Medium", "dealbreakerFlags": [], "summary": "GitHub Copilot trains user inputs by default with opt-out available; Business/Enterprise tiers exclude inputs from training; users own outputs; limited third-party sharing (ads/analytics with opt-out); data deletion within 90 days post-cancellation; minimal security controls disclosed.", "highlights": [ { "label": "Training Use", "text": "Inputs train models by default unless user opts out through account settings; Business/Enterprise tier excluded from foundation-model training entirely" }, { "label": "User Rights", "text": "Full deletion right (90 days post-cancellation), data portability, access, correction, and objection rights all explicitly listed" }, { "label": "Output Ownership", "text": "Users own outputs; GitHub does not share with third-party AI providers for their independent training" }, { "label": "Transparency Gaps", "text": "Security controls described only as 'appropriate' without naming specific measures; no breach notification timeline; AI-log transient retention only disclosed for paid tiers" } ], "policyUrl": "https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement", "policyLastUpdated": "2026-04-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/github.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 78, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "ambience-healthcare", "name": "Ambience Healthcare", "vendor": "Ambience Healthcare", "domain": "ambiencehealthcare.com", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 40, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Ambience Healthcare discloses basic user rights (access, correction, deletion, portability, opt-out) but without named mechanisms; allows unrestricted de-identified data use; and omits training-data disclosure, automated-decision governance, and international-transfer safeguards.", "highlights": [ { "label": "D2.5: Opt-out (full)", "text": "To opt out of the sale or sharing of your personal information" }, { "label": "D5.3: Data categories (full)", "text": "Categories of personal information collected: Identifiers, Information contained in customer records, Commercial information, Internet activity, Professional or employment information, Geolocation data, Inferences drawn" }, { "label": "D6.4: Child protection (full)", "text": "The Sites are intended for a general audience and are not intended for minors under the age of eighteen. We do not knowingly gather personal information...about children under the age of 13" }, { "label": "D1.4: De-identified reuse (half)", "text": "Ambience may retain and use the De-identified Data without restriction for any purpose, including...improving...the Services" } ], "policyUrl": "https://www.ambiencehealthcare.com/privacy", "policyLastUpdated": "2023-12", "modalities": [ "audio", "text" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/ambiencehealthcare.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 52, "grade": "D" }, { "date": "2026-06-21", "score": 40, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "open-hands", "name": "OpenHands", "vendor": "All Hands AI", "domain": "all-hands.dev", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 30, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable (directly and indirectly through multiple tiers), perpetual, and irrevocable license" ], "summary": "OpenHands allows training on user inputs without explicit opt-out, grants the provider perpetual sublicensable rights to user content, offers deletion via email, discloses AI interaction, and lists data categories, but lacks specific security controls, named legal bases, and international safeguards.", "highlights": [ { "label": "Training without explicit opt-out (D1.1-D1.2)", "text": "Policy discloses training on user inputs and feedback but offers no named mechanism to opt out of training data use, only marketing opt-out is disclosed." }, { "label": "Perpetual sublicensable license on user content (D1.4)", "text": "Provider receives a 'perpetual, and irrevocable license' that is 'sublicensable (directly and indirectly through multiple tiers)' on all user content submitted, enabling indefinite commercial reuse." }, { "label": "Vague retention and no security naming (D3.1, D7.1)", "text": "Retains data 'as long as reasonably necessary' (boilerplate, no number) and describes safeguards only as 'technical, organizational and physical' without naming TLS, encryption, RBAC, or any standard." }, { "label": "Explicit ad-exclusion on submitted content (D4.3)", "text": "Policy explicitly commits 'We do not use any content you submit...for these advertising purposes,' protecting user inputs from being used for targeted ads." } ], "policyUrl": "https://www.all-hands.dev/privacy", "policyLastUpdated": "2025-11-25", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/all-hands.dev.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 42, "grade": "D" }, { "date": "2026-06-21", "score": 30, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "fyxer", "name": "Fyxer", "vendor": "Fyxer", "domain": "fyxer.com", "category": "Productivity", "audience": "Enterprise", "scoreOutOf100": 63, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: Fyxer AI own all right title and interest in and to any suggestions, ideas, feedback, recommendations or other information provided by User" ], "summary": "Fyxer does not train models on user data and requires explicit consent for AI processing, but retains data indefinitely without named deletion timelines, limits rights transparency to on-request sub-processor lists, and does not grant users ownership of AI-generated outputs.", "highlights": [ { "label": "No model training", "text": "We do not allow those providers to train their AI models using your data." }, { "label": "Explicit AI consent", "text": "Before sharing any of your data with our AI models, we seek explicit user consent." }, { "label": "Output ownership reversed", "text": "Fyxer AI own all right title and interest in and to any suggestions, ideas, feedback, recommendations or other information provided by User" }, { "label": "Vague retention", "text": "retain your personal data for as long as necessary to fulfill the purposes" } ], "policyUrl": "https://www.fyxer.com/privacy-policy", "policyLastUpdated": "2024-09-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/fyxer.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-21", "score": 63, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "sierra", "name": "Sierra", "vendor": "Sierra", "domain": "sierra.ai", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 48, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Sierra AI discloses user rights and basic data practices but lacks granular mechanisms for training opt-out, retention specifics, and security controls, resulting in mixed awards across transparency and rights indicators.", "highlights": [ { "label": "D5.3 data enumeration", "text": "Sierra explicitly enumerates personal information categories: Identifiers, Commercial information, Internet/network activity, Geolocation, Protected classifications; meets full disclosure standard" }, { "label": "D4.4 int'l transfers", "text": "Named safeguards for data transfers: Standard Contractual Clauses, EU-U.S. DPF, UK Extension, Swiss-U.S. DPF all explicitly stated; concrete mechanisms meet full award" }, { "label": "Vague retention period", "text": "Data is kept 'as long as you use our Services, or as necessary to fulfill the purpose,' with no concrete period named" }, { "label": "D1.4 customer data limited", "text": "Provider explicitly states 'we process this Customer Data only according to the instructions of our customers' , conditional reuse, not full ownership + limited; half award appropriate" } ], "policyUrl": "https://sierra.ai/privacy-policy", "policyLastUpdated": "2026-06-17", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/sierra.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 48, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "half", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "decagon", "name": "Decagon", "vendor": "Decagon", "domain": "decagon.ai", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 15, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Decagon discloses recipient categories and enumerated data types, but is silent on training consent, data rights, retention, sensitive data safeguards, and security specifics.", "highlights": [ { "label": "D4.1: Recipient Categories Named", "text": "Service providers, Advertising partners, Third parties designated by you, Partners, Professional advisors, Authorities and others, Business transferees" }, { "label": "D5.3: Data Categories Enumerated", "text": "Contact data, Demographic data, Communications data, Marketing data, Device data, Online activity data" }, { "label": "D6.4: Age Gate for Children", "text": "The Service is not intended for use by anyone under 18 years of age" }, { "label": "D4.5: Government Access Standard (Corrected)", "text": "Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary" } ], "policyUrl": "https://decagon.ai/legal/privacy", "policyLastUpdated": "2025-05-06", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/decagon.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 25, "grade": "F" }, { "date": "2026-06-21", "score": 15, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "qwen", "name": "Qwen", "vendor": "Alibaba", "domain": "qwen.ai", "category": "Assistant", "scoreOutOf100": 41, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: unconditional, irrevocable, non-exclusive, royalty-free, fully transferable, sub-licensable, perpetual, worldwide licence" ], "summary": "Qwen's privacy and terms policies provide partial transparency on data use and user rights, with opt-out mechanisms for training absent and broad content reuse rights reserved by the vendor.", "highlights": [ { "label": "Training data use lacks opt-out", "text": "D1.1 and D1.2 both award zero: Qwen's policies are silent on whether users can opt out of having their inputs used for model training. The Qwen terms (Section III.5) allow broad use of User Content but contain no explicit opt-out mechanism." }, { "label": "Perpetual broad reuse license granted to vendor", "text": "D1.4 adverse=true: Users grant Qwen an 'unconditional, irrevocable, non-exclusive, royalty-free, fully transferable, sub-licensable, perpetual, worldwide licence' over all User Content (line 837), enabling indefinite reuse without user consent." }, { "label": "No data minimization commitment", "text": "The policy includes no commitment to limit collection to what is needed for the stated purposes" }, { "label": "No automated-decision safeguards", "text": "The policy says nothing about safeguards or human review for automated decision-making that affects users" } ], "policyUrl": "https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-privacy-policy", "policyLastUpdated": "2026-05-19", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/qwen.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" }, { "date": "2026-06-20", "score": 52, "grade": "D" }, { "date": "2026-06-21", "score": 41, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "half", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "poe", "name": "Poe", "vendor": "Quora", "domain": "poe.com", "category": "Assistant", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: worldwide, non-exclusive, royalty-free, transferable, and perpetual license" ], "summary": "Poe discloses that third-party AI developers may train on user interactions and retain a perpetual, transferable license to user content, with minimal rights, deletion, or retention disclosures.", "highlights": [ { "label": "Third-party AI training (adverse)", "text": "Developers that create bots and apps on Poe using APIs may view and store your chats on their servers to train their models" }, { "label": "Perpetual, transferable license (adverse)", "text": "By using Poe, you grant us a worldwide, non-exclusive, royalty-free, transferable, and perpetual license to use Your Content and Your Bots" }, { "label": "Disclosure of AI interactions (strong)", "text": "Poe is a platform that enables you to explore and interact with various bots powered by third-party Artificial Intelligence Models, including Large Language Models" }, { "label": "Age gate (full protection)", "text": "Use of Poe by anyone under 13 years of age is prohibited" } ], "policyUrl": "https://poe.com/privacy", "policyLastUpdated": "2026-04-30", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/poe.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 42, "grade": "D" }, { "date": "2026-06-20", "score": 26, "grade": "F" }, { "date": "2026-06-21", "score": 27, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "crushon-ai", "name": "CrushOn AI", "vendor": "CrushOn", "domain": "crushon.ai", "category": "Companion", "scoreOutOf100": 11, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.1: For all contents generated from the chat, we will only use such contents in a general way for training our models", "D1.4: a worldwide, non-exclusive, royalty-free, perpetual, irrevocable, sublicenseable (through multiple tiers) and transferable license" ], "summary": "CrushOn AI trains on user chat inputs without opt-out, grants itself perpetual sublicensable content licences, and lacks comprehensive privacy safeguards despite age-gating to 18+.", "highlights": [ { "label": "Training without consent", "text": "For all contents generated from the chat, we will only use such contents in a general way for training our models and we will not link chat contents to specific users" }, { "label": "Perpetual content license", "text": "a worldwide, non-exclusive, royalty-free, perpetual, irrevocable, sublicenseable (through multiple tiers) and transferable license" }, { "label": "Vague retention", "text": "We retain Personal Information for so long as it is reasonably necessary" }, { "label": "Age gate only protection", "text": "you must be at least 18 years old to use CrushOn.ai... does not knowingly collect any Personal Information about or market to children, minors, or anyone under the age of 18" } ], "policyUrl": "https://crushonaiapk.com/privacy-policy/", "policyLastUpdated": "2025-07-22", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/crushon.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 32, "grade": "F" }, { "date": "2026-06-20", "score": 45, "grade": "D" }, { "date": "2026-06-21", "score": 11, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "zero", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "cursor", "name": "Cursor", "vendor": "Anysphere", "domain": "cursor.com", "category": "Productivity", "scoreOutOf100": 69, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Cursor commits to not training on user inputs without explicit opt-in, assigns output ownership to users, and offers standard rights, but lacks detailed retention timelines, named security controls, and breach notification specifics.", "highlights": [ { "label": "D1.1 , No-train default with opt-in", "text": "ANYSPHERE WILL NOT USE CONTENT TO TRAIN, OR ALLOW ANY THIRD PARTY TO TRAIN, ANY AI MODELS, UNLESS YOU'VE EXPLICITLY AGREED" }, { "label": "Unnamed opt-out mechanism", "text": "Training preferences can be managed somewhere 'in the Service,' but the policy points to no specific setting or process" }, { "label": "Boilerplate security", "text": "Commits only to 'commercially reasonable technical and organizational measures' with no named standard or control" }, { "label": "Purpose without legal basis", "text": "States data is used 'to provide, maintain and facilitate any products and services' without pairing each purpose to a legal basis" } ], "policyUrl": "https://www.cursor.com/privacy", "policyLastUpdated": "2025-10-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cursor.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" }, { "date": "2026-06-20", "score": 69, "grade": "C" }, { "date": "2026-06-21", "score": 69, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "lovable", "name": "Lovable", "vendor": "Lovable", "domain": "lovable.dev", "category": "Productivity", "scoreOutOf100": 66, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: You grant us a worldwide, perpetual, royalty-free license to use, copy, modify, process, analyze, and otherwise exploit your Customer Data for our business purposes, including without limitation: operating, maintaining, and improving the Services; developing and training artificial intelligence and machine learning models." ], "summary": "Lovable's privacy policy discloses training opt-out and core rights but uses vague language for several capabilities, and the Terms contain a perpetual license clause that directly contradicts the Privacy Policy's training opt-out offer.", "highlights": [ { "label": "Contradictory training rights", "text": "Privacy Policy offers training opt-out via email/Business plan, but Terms grant 'worldwide, perpetual, royalty-free license' to use Customer Data for 'developing and training artificial intelligence' (clause 4, Rights and Responsibilities) , these directly conflict" }, { "label": "Opt-out conditioned on paid tier", "text": "Training opt-out requires contacting privacy@lovable.dev OR upgrading to Business plan; free/Pro users must email to opt out, making opt-out conditional and not universally accessible via settings" }, { "label": "Vague data rights disclosures", "text": "Access, portability, and correction rights stated only as 'request disclosure' and 'request correction' with no concrete mechanisms, timelines, or response procedures detailed" }, { "label": "AI interaction and automated decisions silent", "text": "Policy states Lovable 'does not engage in automated decision-making' but does not affirmatively disclose that users interact with AI or provide human-review rights for any decisions" } ], "policyUrl": "https://lovable.dev/privacy", "policyLastUpdated": "2026-04-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/lovable.dev.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 81, "grade": "B" }, { "date": "2026-06-20", "score": 98, "grade": "A" }, { "date": "2026-06-21", "score": 66, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "polybuzz", "name": "PolyBuzz", "vendor": "PolyBuzz", "domain": "polybuzz.ai", "category": "Companion", "scoreOutOf100": 38, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "PolyBuzz trains on user inputs with opt-out available but reserves rights for safety-flagged content; users retain input ownership but grant PolyBuzz broad perpetual sublicensable rights to uploaded content; limited data access/deletion/correction rights with vague timelines; no sale of user data but limited disclosure controls; silent on retention periods beyond vague necessity standard, international safeguards, synthetic marking, and government access standards; strong age gate for children globally and in UK with mandatory verification.", "highlights": [ { "label": "Model training with opt-out (but exceptions apply)", "text": "We may use Materials to provide, maintain, and improve the Services...including training our models, unless you opt out of training through your account settings. Even if you opt-out, we will use Materials for model training when...your Materials are flagged for safety review" }, { "label": "No sale of user data", "text": "We DO NOT sell User Information to any other individual, company, or organization" }, { "label": "Strong children's age gate", "text": "You must have reached 18-year-old to use PolyBuzz and/or our Services...PolyBuzz and/or our Services strictly prohibit for minors (less than 18-year-old) worldwide...Mandatory Age Verification in United Kingdom (UK)...we require you to complete an age verification process before accessing PolyBuzz" }, { "label": "Broad sublicensable license for uploaded content", "text": "you grant us a permanent, irrevocable, free of charge, perpetual, non-exclusive, sublicensable (multi-tiered) license (including but not limited to, all intellectual property rights such as the right of reproduction, communication through information networks, adaptation, compilation, modification, translation, making derivatives, performance and display) to use the Licensed Contents worldwide" } ], "policyUrl": "https://www.polybuzz.ai/privacy-policy", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/polybuzz.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 78, "grade": "B" }, { "date": "2026-06-20", "score": 73, "grade": "B" }, { "date": "2026-06-21", "score": 38, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "zero", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "genspark", "name": "Genspark", "vendor": "Genspark", "domain": "genspark.ai", "category": "Assistant", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Genspark's policy provides conditional opt-out for training use (if such language actually appears in current policy), assigns users a broad sublicensable content license with defined scope limitations, and offers limited data rights with 30-day deletion after account closure.", "highlights": [ { "label": "Training disclosure unclear", "text": "The policy text does not clearly state whether inputs are used for training or how to opt out, so users cannot confirm the practice" }, { "label": "D1.4 adverse flag corrected", "text": "The sublicense is scoped to 'operating, promoting, and improving our Service', not perpetual or unrestricted. No explicit harm reservation exists. adverse should be false, not true." }, { "label": "AI providers disclosed", "text": "Names five AI providers it relies on, including OpenAI, Anthropic, Google, xAI, and ElevenLabs, so users know which models handle their data" }, { "label": "Content terms hard to verify", "text": "Some content and training clauses are difficult to locate in the current policy text, making the terms hard to verify" } ], "policyUrl": "https://www.genspark.ai/privacy", "policyLastUpdated": "2026-03-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/genspark.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 72, "grade": "B" }, { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "suno", "name": "Suno", "vendor": "Suno", "domain": "suno.com", "category": "Audio", "scoreOutOf100": 54, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.1: to train and enhance the models that power our Services", "D1.4: sublicensable (directly and indirectly through multiple tiers), assignable, royalty-free, perpetual, irrevocable right and license" ], "summary": "Suno trains user inputs on models with no disclosed opt-out mechanism, offers tiered output ownership (paid tiers retain rights; free/basic use limited to personal/non-commercial), and applies a broad perpetual sublicensable license to user submissions including voice data.", "highlights": [ { "label": "Critical: Training with no opt-out", "text": "Policy discloses model training (line 63: 'to train and enhance the models that power our Services') but provides NO opt-out mechanism for training data. Only opt-out references are for marketing communications." }, { "label": "Tier-specific output ownership", "text": "Pro/Premier tiers: user receives full copyright assignment. Free/Basic tiers: 'only use Outputs generated from Submissions...solely for your lawful, internal, personal and non-commercial purposes' (line 296)." }, { "label": "Perpetual sublicensable grant to Suno", "text": "Line 292 grants Suno 'a worldwide, non-exclusive, fully paid-up, sublicensable (directly and indirectly through multiple tiers), assignable, royalty-free, perpetual, irrevocable right and license' including voice models." }, { "label": "3-year biometric retention only", "text": "Biometric voice data: 'will retain this data for no longer than three (3) years following your last interaction' (line 172). General retention: vague 'as long as is reasonably necessary' (line 107)." } ], "policyUrl": "https://suno.com/legal/privacy", "policyLastUpdated": "2026-03-26", "modalities": [ "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/suno.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 76, "grade": "B" }, { "date": "2026-06-20", "score": 57, "grade": "C" }, { "date": "2026-06-21", "score": 54, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "ADVERSE" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "capcut", "name": "CapCut", "vendor": "ByteDance", "domain": "capcut.com", "category": "Image & video", "scoreOutOf100": 17, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "CapCut trains models with no disclosed opt-out, grants itself perpetual sublicensable rights to user content, and lacks global transparency on data rights and security controls.", "highlights": [ { "label": "D1.1 & D1.2: Fabricated opt-out quotes", "text": "The ledger cited \"unless you opt out of training through your account settings\" for both D1.1 and D1.2, but this phrase does not exist anywhere in CapCut's privacy policy. The policy discloses training but no opt-out mechanism." }, { "label": "D1.4: Perpetual sublicensable content licence", "text": "\"you grant to the Company and its affiliates a non-exclusive, royalty-free, transferable, sub-licensable, perpetual and worldwide licence to use your User Content\" , adverse clause; user outputs are not owned/controlled by user." }, { "label": "D2.4: Canada-only correction right", "text": "The right to \"rectify and correct inaccuracies\" is disclosed only in the Canada regional section, not in the global policy. Global assessment must score ZERO." }, { "label": "D7.1: No named security controls", "text": "Policy states \"technical, administrative, and organisational measures\" but names no TLS, AES, RBAC, or ISO certifications , only vague boilerplate." } ], "policyUrl": "https://www.capcut.com/privacy-policy", "policyLastUpdated": "2026-04-15", "modalities": [ "image", "video" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/capcut.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" }, { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 17, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "spicychat", "name": "SpicyChat", "vendor": "SpicyChat", "domain": "spicychat.ai", "category": "Companion", "scoreOutOf100": 19, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: SpicyChat.AI does NOT own the said Chats and Generations. By using our services, You grant SpicyChat.AI the right to use Your Chatbot and Generations and Chats from that Chatbot in any way...This permission is nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, and irrevocable." ], "summary": "SpicyChat is mostly silent on training data handling, retention periods, and data subject rights, with adverse perpetual/sublicensable content licence for user generations despite user ownership retention.", "highlights": [ { "label": "Training data use silent", "text": "Policy contains no disclosure about whether user inputs are used to train models or any opt-out mechanism." }, { "label": "Adverse content licence", "text": "Despite user ownership, SpicyChat reserves perpetual, sublicensable, transferable rights to user-generated content with no restrictions." }, { "label": "Vague retention standard", "text": "Retention defined as 'as long as necessary' with no named periods, only conditional deletion subject to legal obligations." }, { "label": "Missing data rights", "text": "Silent on access, portability, correction, and objection/opt-out mechanisms; deletion right is conditional." } ], "policyUrl": "https://spicychat.ai/privacy", "policyLastUpdated": "2026-06-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/spicychat.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 3, "scoreHistory": [ { "date": "2026-06-20", "score": 21, "grade": "F" }, { "date": "2026-06-20", "score": 40, "grade": "D" }, { "date": "2026-06-21", "score": 19, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "otter-ai", "name": "Otter.ai", "vendor": "Otter.ai, Inc.", "domain": "otter.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 63, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Otter.ai discloses training on user inputs with opt-out, granular data rights, conditional retention, transparent sharing with subprocessor lists, and standard security measures, but lacks specificity on synthetic content marking and AI-specific retention periods.", "highlights": [ { "label": "Model training with opt-out", "text": "Otter.ai trains proprietary AI on de-identified audio and transcriptions unless users opt out through account settings." }, { "label": "Strong data rights", "text": "Users can access, correct, delete, port data in machine-readable format, and opt out of 'sales' via footer link." }, { "label": "Subprocessor transparency", "text": "Lists cloud providers (AWS SOC 2 Type 2), data labelers, and AI vendors publicly with objection rights." }, { "label": "Vague retention & synthesis marking", "text": "Stores data 'as long as necessary' with no AI-specific retention period; no disclosure of synthetic content marking." } ], "policyUrl": "https://otter.ai/privacy-policy", "policyLastUpdated": "2026-06-16", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/otter.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 65, "grade": "C" }, { "date": "2026-06-21", "score": 63, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "gong", "name": "Gong", "vendor": "Gong.io Inc.", "domain": "gong.io", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Gong's privacy policy discloses foundational data subject rights (access, deletion, portability, correction, opt-out) with named mechanisms, limited training transparency, moderately clear retention (vague language without concrete periods except post-closure), enumerated data sharing categories including DPA incorporation, and named safeguards for international transfers, but lacks specificity on AI/ML disclosure, synthetic-output marking, and breach notice timelines.", "highlights": [ { "label": "Data subject rights fully disclosed", "text": "Explicit right to know/request access, rectification, erasure, portability, and restrict/object processing; right to direct against sale/sharing to third parties" }, { "label": "Deletion timeline after closure named", "text": "After 30-day period following termination, Gong will have no obligation to maintain Customer Data and will thereafter delete or destroy all copies" }, { "label": "International transfer safeguards named", "text": "EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses as approved by European Commission" }, { "label": "Retention language vague, no concrete numbers", "text": "Retention is 'as long as we deem it as reasonably necessary in order to maintain and expand our relationship' with no defined period" } ], "policyUrl": "https://www.gong.io/legal/privacy-policy", "policyLastUpdated": "2026-04-01", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gong.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "ironclad", "name": "Ironclad", "vendor": "Ironclad, Inc.", "domain": "ironcladapp.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 40, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Ironclad discloses data collection, retention, and sharing practices with opt-outs available, but lacks granular scope definitions and reserves broad discretion over output use.", "highlights": [ { "label": "Output use discretion (D1.4)", "text": "IRONCLAD MAY, by notice to you at any time, limit your use of the OUTPUT or require you to cease using them if Ironclad forms the view, in its sole and absolute discretion, that your use of the OUTPUT may infringe the rights of any third party." }, { "label": "Data recipient categories (D4.1)", "text": "We disclose customer information as follows: Order Processing, Third Party Marketing, Ad Networks and Advertising Partners, Required by Law, Visitor Demographics, Service Providers, Blogs and Forums, Other Transfers, Bankruptcy, Employer, Consent." }, { "label": "No automated decision-making (D6.1)", "text": "We do not conduct automated processing of personal information for the purposes of evaluating, analyzing, or predicting an individual's personal aspects in furtherance of decisions that produce legal or similarly significant effects." } ], "policyUrl": "https://legal.ironcladapp.com/privacy-policy", "policyLastUpdated": "2026-05-15", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/ironcladapp.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 40, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "sana", "name": "Sana", "vendor": "Sana Labs AB", "domain": "sanalabs.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 67, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Sana explicitly prohibits AI model training on user data and provides comprehensive data rights, retention limits, and security disclosures, but lacks defined mechanisms for some rights exercises and overstates governance of AI interaction disclosure.", "highlights": [ { "label": "AI training prohibition", "text": "we, or any of our third party service providers, do not use your personal data to train artificial intelligence and/or machine learning models" }, { "label": "Retention limit with concrete timeframe", "text": "no longer than one year without anonymizing it" }, { "label": "Age gate for children's services", "text": "free services provided to Civic Tier users above the age of 13 years... subject to our Children's Privacy Policy" }, { "label": "No automated decision-making", "text": "We do not use processes for automatic decision-making" } ], "policyUrl": "https://sanalabs.com/legal/privacy-notice", "policyLastUpdated": "2026-04-22", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/sanalabs.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 79, "grade": "B" }, { "date": "2026-06-21", "score": 67, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "luminance", "name": "Luminance", "vendor": "Luminance Technologies Ltd", "domain": "luminance.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Luminance discloses data subject rights and third-party sharing limits but lacks named security controls, lacks true opt-out for model training, and reserves the right to change its policy without user notice.", "highlights": [ { "label": "Policy change without notice", "text": "Luminance reserves the right to amend this policy at any time, for any reason, without notice to you , explicitly reserves harmful behavior (D5.5 adverse)" }, { "label": "Silent on training opt-out", "text": "Policy describes data uses for model improvement but never names an opt-out mechanism for training inputs in the main privacy policy (D1.1)" }, { "label": "No named security controls", "text": "Main consumer privacy policy lacks named technical controls (TLS, encryption, RBAC, etc.) and references to security certs; ISO 27001 mention is only in business-user DPA (D7.1, D7.3)" }, { "label": "Strong on retention timeline and output ownership", "text": "Provides clear 30-day post-termination grace period before deletion (D3.2) and explicitly assigns all output rights to users (D1.4)" } ], "policyUrl": "https://www.luminance.com/privacy-policy/", "policyLastUpdated": "2023-07-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/luminance.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 55, "grade": "C" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "ADVERSE" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "tabnine", "name": "Tabnine", "vendor": "Tabnine", "domain": "tabnine.com", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Tabnine discloses limited AI training practices (only narrowly for Tailor Made Services code, not general model training), provides comprehensive data rights (access, deletion, portability, correction, opt-out from marketing), but lacks specificity on retention periods, security certifications, and sub-processor governance.", "highlights": [ { "label": "Training data opacity", "text": "General model training of user inputs is undisclosed; only Tailor Made Services code is contractually limited to single-user improvement with explicit no-sharing covenant" }, { "label": "Strong rights framework", "text": "All five D2 rights explicitly named: access, deletion, portability, correction, object/opt-out from marketing" }, { "label": "Security vagueness", "text": "\"Industry standard measures\" without named control (TLS/AES/RBAC) or certification (ISO/SOC2); no breach notification timeframe" }, { "label": "Retention ambiguity", "text": "\"Longer than necessary\" without concrete period or option for zero-retention; legal carveout for claims unquantified" } ], "policyUrl": "https://www.tabnine.com/privacy-policy/", "policyLastUpdated": "2024-09-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/tabnine.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 56, "grade": "C" }, { "date": "2026-06-21", "score": 58, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "replit", "name": "Replit", "vendor": "Replit, Inc.", "domain": "replit.com", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.1: Content published in public Apps may be used by Replit for improving the Service, including but not limited to developing or training large language models, both during and after the term of this agreement.", "D1.4: you grant Replit the right to copy, display, distribute, perform, reformat, and modify your content as necessary, and the right to sublicense such rights to any third party provider for the Service." ], "summary": "Replit trains models on public app content without explicit opt-out, provides strong data rights for users including deletion within 30 days and portability, but lacks transparent safeguards for international transfers and specific security certifications.", "highlights": [ { "label": "Training without explicit opt-out", "text": "Content published in public Apps may be used by Replit for improving the Service, including but not limited to developing or training large language models, both during and after the term of this agreement." }, { "label": "Strong deletion rights", "text": "When you request to delete your account, we delete your data within 30 days." }, { "label": "Broad sublicensing of user content", "text": "You grant Replit the right to copy, display, distribute, perform, reformat, and modify your content as necessary, and the right to sublicense such rights to any third party provider for the Service." }, { "label": "International transfers without named safeguards", "text": "Our Services are primarily hosted in the United States and may also be hosted in locations abroad (for example, India). If you use the Services from regions of the world with laws governing data processing, you accept that you are transferring your information to the United States and other hosting locations for storage and processing." } ], "policyUrl": "https://replit.com/privacy-policy", "policyLastUpdated": "2025-02-24", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/replit.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 55, "grade": "C" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "sourcegraph-cody", "name": "Sourcegraph Cody", "vendor": "Sourcegraph, Inc.", "domain": "sourcegraph.com", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 74, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Sourcegraph Cody trains user inputs with opt-out for most tiers but retains them for safety review; it discloses data practices transparently, offers user rights with some organizational limitations, and commits to minimal personal-data extraction from code.", "highlights": [ { "label": "AI training with opt-out (Pro/Free)", "text": "unless you opt out, AI User Content may be used to improve and support the Services" }, { "label": "Partner LLM zero-retention", "text": "Partner LLMs will not retain any Input, Output, or Candidate Context beyond the time it takes to generate an Output ('Zero Retention')" }, { "label": "Data minimization commitment", "text": "we do not intentionally extract, store, or use personal data from User Content for any purpose" }, { "label": "User owns outputs", "text": "You retain all right, title, and interest in and to User Content, including any Outputs adopted by You" } ], "policyUrl": "https://sourcegraph.com/terms/privacy", "policyLastUpdated": "2026-06-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/sourcegraph.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 74, "grade": "B" }, { "date": "2026-06-21", "score": 74, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "half", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "windsurf", "name": "Windsurf", "vendor": "Cognition AI, Inc.", "domain": "windsurf.com", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Windsurf trains on user inputs with selective opt-outs (Chat loses service; Autocomplete only for discriminative models) and assigns outputs to users with caveats, but lacks concrete retention periods, named security controls, or breach timelines.", "highlights": [ { "label": "Training data use & opt-out", "text": "Chat inputs train generative models with opt-out that terminates service; Autocomplete only trains discriminative models via 'code sharing options' in settings" }, { "label": "Output ownership & reuse", "text": "User retains copyright in inputs; provider assigns outputs to user (\"if any\") but reserves training rights via Feedback and safety-flagged content" }, { "label": "Data rights & retention", "text": "Access, portability, correction, object/restrict rights named; deletion conditional on vague \"as needed\" retention; no named period (silent=ladder 0)" }, { "label": "Security & breach gaps", "text": "Only \"commercially reasonable\" boilerplate; no named controls, certs, DPO, or breach notification timeline; sub-processor list absent despite DPA footer link" } ], "policyUrl": "https://windsurf.com/privacy-policy", "policyLastUpdated": "2026-03-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/windsurf.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 45, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "clay", "name": "Clay", "vendor": "Clay Software, Inc.", "domain": "clay.com", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 53, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: you grant Clay Labs a worldwide, non-exclusive... transferable and perpetual license to use, reproduce, modify, adapt, publish, translate, distribute, and display such content" ], "summary": "Clay discloses a training opt-out and deletion rights, but reserves perpetual sublicensable content licences, restricts some objection rights conditionally, and provides vague security/retention language.", "highlights": [ { "label": "Training opt-out with vague mechanism", "text": "unless you opt out of training through your account settings (D1.1, D1.2)" }, { "label": "Perpetual sublicensable content licence (adverse)", "text": "you grant Clay Labs a worldwide, non-exclusive... transferable and perpetual license to use, reproduce, modify, adapt, publish, translate, distribute, and display such content (D1.4)" }, { "label": "Conditional deletion rights", "text": "You may also request the deletion of your personal information, as permitted under applicable law (D2.2)" }, { "label": "Partial objection rights", "text": "You may object to any use of your personal information that is not required by legal obligation... (D2.5)" } ], "policyUrl": "https://www.clay.com/privacy", "policyLastUpdated": "2025-07-03", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/clay.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 53, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "apollo-io", "name": "Apollo.io", "vendor": "ZenProspect, Inc.", "domain": "apollo.io", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: an irrevocable, perpetual, worldwide, transferable, sublicensable, and royalty-free license to analyze Customer Data" ], "summary": "Apollo.io discloses basic access and deletion rights, names recipient categories, and references DPA compliance, but remains silent on training opt-out mechanism, data minimization, breach notice, and named security controls.", "highlights": [ { "label": "Training data use , named right but no mechanism", "text": "Apollo discloses \"You have the right to object to or opt-out of such processing\" for AI training, but the policy does not name how users exercise this right (no Privacy Center link, account setting, or process named)." }, { "label": "Adverse: perpetual sublicensable customer data licence", "text": "\"Apollo grants...an irrevocable, perpetual, worldwide, transferable, sublicensable, and royalty-free license to analyze Customer Data using artificial intelligence\" , customer data is retained and reused indefinitely beyond service provision." }, { "label": "Data rights disclosed for EU residents only", "text": "Access, deletion, correction, and objection rights are explicitly stated in Section 11 for European Territories residents but not listed in the main global policy sections." }, { "label": "Silent on breach notification, security controls, data minimization", "text": "Policy contains no named security controls (TLS, AES-256, RBAC), no breach notification timeline, no data minimization commitment, and no specific retention period (only 'as long as useful')." } ], "policyUrl": "https://www.apollo.io/privacy-policy", "policyLastUpdated": "2025-09-16", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/apollo.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "copy-ai", "name": "Copy.ai", "vendor": "Copy.ai, Inc.", "domain": "copy.ai", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: non-exclusive, transferable, perpetual, irrevocable, worldwide, royalty-free, fully paid-up license, with the right to sublicense" ], "summary": "Copy.ai discloses data collection categories and basic access/deletion rights, but lacks explicit model training opt-out mechanisms and uses a broad perpetual sublicensable user content license; disclosure of AI interaction is limited.", "highlights": [ { "label": "D1.4 (User Content License)", "text": "Non-exclusive, transferable, perpetual, irrevocable, worldwide, royalty-free, fully paid-up license, with the right to sublicense" }, { "label": "D2.1–D2.4 (GDPR Rights)", "text": "Access, deletion (limited circumstances), portability, and correction rights disclosed for EEA residents" }, { "label": "D4.3 (No Ad Sales)", "text": "Does not sell or share personal data for cross-contextual behavioral advertising" }, { "label": "D5.3 (Data Categories)", "text": "Enumerated: Account Creation, User Content, Purchases, Surveys, Interactive Features, automatically collected device and usage data" } ], "policyUrl": "https://www.copy.ai/privacy-notice", "policyLastUpdated": "2023-11-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/copy.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "vanta", "name": "Vanta", "vendor": "Vanta Inc.", "domain": "vanta.com", "category": "Security & compliance", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Vanta prohibits use of customer information to train AI models, provides standard data subject rights, maintains a Data Privacy Framework certification, but retains broad discretion on data retention and employs vague security standards.", "highlights": [ { "label": "AI Training Protection", "text": "Vanta explicitly prohibits use of customer information to train AI models (4.6.1), though Feedback and Aggregated Anonymous Data may be used for training" }, { "label": "Data Subject Rights", "text": "Policy provides full support for access, deletion, portability, correction, and objection rights across all D2 indicators" }, { "label": "Retention Vagueness", "text": "D3.1 retention period is 'as long as necessary' with no numeric limit, preventing a full award despite a documented DPO and international safeguards" }, { "label": "Ads/Marketing Opt-Out", "text": "Vanta discloses sale/sharing of data to ad networks with an opt-out right (D4.3), meeting half award standard for conditional sale" } ], "policyUrl": "https://www.vanta.com/legal/privacy", "policyLastUpdated": "2026-02-25", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/vanta.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "drata", "name": "Drata", "vendor": "Drata, Inc.", "domain": "drata.com", "category": "Security & compliance", "audience": "Enterprise", "scoreOutOf100": 53, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: all rights, title and interest in and to the Services and all hardware, Software and other components of or used to provide the Services...will remain with Drata and belong exclusively to Drata" ], "summary": "Drata does not train on customer data but retains broad IP rights in outputs; deletion rights lack concrete timelines and mandatory safeguards are boilerplate.", "highlights": [ { "label": "AI training restriction", "text": "Drata does not use Customer Data to train or fine-tune artificial intelligence or machine learning models and does not permit third-party inference providers to do so (Section 2.4.3)" }, { "label": "Output ownership adverse", "text": "All rights, title and interest in outputs and services remain with Drata exclusively; user receives no IP ownership (Section 10.1)" }, { "label": "Deletion timeline missing", "text": "Deletion requests are subject to exceptions with no concrete timeline; data retained as long as necessary for purposes (Privacy Notice Section 6)" }, { "label": "Security language generic", "text": "Safeguards described as appropriate administrative, physical, and technical measures but with no named controls (TLS/AES-256/RBAC) (Section 6.3)" } ], "policyUrl": "https://drata.com/privacy", "policyLastUpdated": "2026-06-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/drata.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 53, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "fireflies-ai", "name": "Fireflies.ai", "vendor": "Fireflies.ai Inc.", "domain": "fireflies.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 80, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Fireflies.ai discloses explicit no-train policies for personal data and user content, with opt-out mechanisms, 30-day deletion timelines, and zero-retention for meeting content, but lacks concrete security controls naming and breach notification timelines.", "highlights": [ { "label": "D1.1 Training-data exclusion", "text": "We do not use personal information for AI model training and we contractually prohibit our vendors from using this information for their own model training." }, { "label": "D1.4 User-content reuse limitation", "text": "will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models" }, { "label": "D3.3 Meeting-content retention", "text": "We also impose a Zero Data Retention policy for meeting content, which includes audio, video, transcripts, and summaries of the meeting." }, { "label": "D4.4 International transfers", "text": "Whenever we make restricted international transfers of personal information, we take steps to ensure that your personal information receives an adequate level of protection (by putting in place appropriate safeguards, such as contractual clauses)... Fireflies.ai complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks" } ], "policyUrl": "https://fireflies.ai/privacy-policy", "policyLastUpdated": "2026-03-06", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/fireflies.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" }, { "date": "2026-06-21", "score": 80, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "fathom", "name": "Fathom", "vendor": "Fathom Video Inc.", "domain": "fathom.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Fathom allows users to opt out of AI training on their inputs, does not sell personal data, provides standard data subject rights (access, deletion, portability, correction, objection), and does not knowingly collect data from children under 18; however, retention periods are vague, synthetic-output marking is absent, and specific security certifications are not named.", "highlights": [ { "label": "AI training opt-out", "text": "Based on how you configure your account settings, we may use and create de-identified data generated from Meeting Content Information to improve our Services by training, improving, and customizing our in-house artificial intelligence models. You can opt out from this use of your data in your account settings." }, { "label": "No third-party AI training", "text": "We do not authorize third parties (e.g., OpenAI, Anthropic, Google, etc) to use your personal information or Meeting Content Information to train their artificial intelligence models" }, { "label": "No sale of personal data", "text": "We do not sell, or share your personal information with non affiliated companies for their own direct marketing purposes, unless we have your permission. We do not sell Meeting Content Information" }, { "label": "Children's protections", "text": "We do not knowingly collect, maintain, or use personal information from children under the age of 18" } ], "policyUrl": "https://www.fathom.ai/privacy", "policyLastUpdated": "2025-08-11", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/fathom.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 75, "grade": "B" }, { "date": "2026-06-21", "score": 58, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "read-ai", "name": "Read AI", "vendor": "Read AI, Inc.", "domain": "read.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 53, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Read AI discloses opt-out mechanisms for training and data rights to users, but vague on opt-out mechanisms, limited data encryption scope, and sells data to marketing partners with weak safeguard language.", "highlights": [ { "label": "Vague training opt-out", "text": "Inputs are used 'to train and improve our models' and an opt-out is mentioned only in general terms, with no concrete mechanism named" }, { "label": "D2.1–D2.4 scope limits", "text": "Policy qualifies rights as 'certain account information' and 'inaccurate personal information', limited scope. Both are 'half' (named but constrained), not 'full'." }, { "label": "Boilerplate transfer safeguards", "text": "International transfers rely on protections described as 'such as contractual clauses,' without confirming standard contractual clauses are actually used" }, { "label": "D7.1 scope limit", "text": "Encryption claim applies only to Google Workspace API data, not all audio/video. Quote is accurate but scope-bound. Remains 'half' (named control on subset of data)." } ], "policyUrl": "https://www.read.ai/privacy-policy", "policyLastUpdated": "2026-02-26", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/read.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" }, { "date": "2026-06-21", "score": 53, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "avoma", "name": "Avoma", "vendor": "Avoma, Inc.", "domain": "avoma.com", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 54, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Avoma explicitly prohibits training on Google Workspace API data and sells/shares no personal data, offers 30-day deletion post-termination and DPF compliance, though input training is permitted unless opted-out and retention is vague.", "highlights": [ { "label": "Training: Google Workspace data only", "text": "Data obtained through Google Workspace APIs used exclusively to provide services. No use to train generalized AI/ML models. (But other user data may be trained unless opted out.)" }, { "label": "Deletion & DPF Compliance", "text": "30-day deletion after service termination; EU-US DPF, UK Extension, Swiss-US DPF certified." }, { "label": "No Sales/Shares", "text": "Explicit policy: We do not sell, share, rent or lease personally identifiable information." }, { "label": "Retention vague", "text": "Retention period is 'as long as necessary to support purposes of processing', no concrete timeline for general data." } ], "policyUrl": "https://www.avoma.com/privacy-policy", "policyLastUpdated": "2026-01-02", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/avoma.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 54, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "guru", "name": "Guru", "vendor": "Guru Technologies, Inc.", "domain": "getguru.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 62, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Guru explicitly prohibits training on public models while allowing private model training, grants user ownership of outputs, supports data subject rights with 90-day post-termination deletion, but lacks specificity on breach notification, special category data governance, and named security certifications.", "highlights": [ { "label": "D1.1 Input Training Prohibition", "text": "will not use your Content to train any publicly available machine learning or artificial intelligence models" }, { "label": "D2.2 & D3.2 Data Deletion Timeline", "text": "Guru will delete your Content from the Service promptly after ninety (90) days has elapsed from date of expiration or termination" }, { "label": "D4.4 International Transfer Safeguards", "text": "we will provide an appropriate safeguard such as binding corporate rules, standard data protection clauses, or your consent" }, { "label": "D7.1 Security Controls (Adjective-Only)", "text": "commercially reasonable physical, managerial, and technical safeguards" } ], "policyUrl": "https://www.getguru.com/privacy", "policyLastUpdated": "2026-03-25", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/getguru.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 53, "grade": "D" }, { "date": "2026-06-21", "score": 62, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "dashworks", "name": "Dashworks", "vendor": "Dashworks AI, Inc.", "domain": "dashworks.ai", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 67, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Dashworks provides comprehensive data subject rights, transparent AI use with opt-out, and baseline security practices, but lacks minimization commitments and explicitly does not age-gate children's access.", "highlights": [ { "label": "D4.3: No-sell commitment", "text": "WE DO NOT SELL YOUR PERSONAL INFORMATION, NOR DO WE INTEND TO DO SO." }, { "label": "D7.2: 72-hour breach notification", "text": "we will notify you within 72 hours via (i) email and/or (ii) our Platform notification system." }, { "label": "D1.2: Named opt-out mechanism", "text": "User/Business Customer may opt-out by sending an email to support@dashworks.ai and communicating their intent to opt-out." }, { "label": "D6.4: Adverse, no age-gating", "text": "we do not age-screen or otherwise prevent the collection, use, and personal disclosure of persons identified as under 13." } ], "policyUrl": "https://www.dashworks.ai/legal/privacy-policy", "policyLastUpdated": "2025-04-03", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/dashworks.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-21", "score": 67, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "ADVERSE" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "hebbia", "name": "Hebbia", "vendor": "Hebbia AI Inc.", "domain": "hebbia.com", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Hebbia does not train on customer inputs, permits opt-out for ad-sharing, grants GDPR-style deletion/access/correction/object rights, discloses subprocessor list and standard contractual clauses for transfers, and discloses AI interaction and data categories, but lacks named security controls, breach notification timeline, or government-request response standards.", "highlights": [ { "label": "No customer-data training", "text": "We do not use Personal Data contained in Customer Data to train or improve generalized or third-party artificial intelligence or machine learning models. To the extent we use Personal Data to improve our Services, such use is limited to internal purposes such as debugging, performance monitoring, and developing features." }, { "label": "Data deletion + portability", "text": "You may request that Hebbia erase that data or cease processing it. When technically feasible, Hebbia will, at your request, provide your personal data to you." }, { "label": "Standard contractual clauses + UK IDTA", "text": "Hebbia provides appropriate safeguards by entering into the European Commission's standard contractual clauses (2021). For transfers of personal data from the United Kingdom, Hebbia relies on the UK International Data Transfer Addendum." }, { "label": "Appointed Data Protection Officer", "text": "We have appointed a Data Protection Officer (DPO) to oversee our data protection compliance. If you have any questions about this notice or how we handle your personal data, including requests to exercise your rights, please contact our DPO at: Email: privacy@hebbia.ai" } ], "policyUrl": "https://www.hebbia.com/privacy", "policyLastUpdated": "2026-05-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/hebbia.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 65, "grade": "C" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "robin-ai", "name": "Robin AI", "vendor": "Robin AI Limited", "domain": "robinai.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.1: 'we will process and store your inputs as well as the outputs from the platform, for the purposes of training our models'" ], "summary": "Robin AI trains on user inputs and outputs without a named opt-out; offers standard GDPR rights; retention is vague; shares data with Google Analytics and Mixpanel; prohibits automated decisions and special-category processing; security measures lack named controls.", "highlights": [ { "label": "Training-data use (D1.1)", "text": "Policy explicitly states 'we will process and store your inputs as well as the outputs from the platform, for the purposes of training our models' with no opt-out or named consent mechanism (adverse)." }, { "label": "User rights (D2.1–D2.5)", "text": "Policy grants access, deletion ('without undue delay'), portability in machine-readable format, correction, and objection/opt-out rights , all with named mechanisms meeting GDPR standards." }, { "label": "AI and sensitive data (D6.1, D6.2)", "text": "Policy confirms 'we will not use AI for automated decision making in relation to personal data' and states 'We do not process special categories of data.'" }, { "label": "Data retention (D3.1) and security (D7.1)", "text": "Retention is vague ('as long as necessary' with no number); security is 'appropriate technical and organisational measures' without named controls like TLS/AES." } ], "policyUrl": "https://robinai.com/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/robinai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 52, "grade": "D" }, { "date": "2026-06-21", "score": 47, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "forethought", "name": "Forethought", "vendor": "Forethought Technologies, Inc.", "domain": "forethought.ai", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 54, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Forethought's privacy policy discloses consumer rights (access, erasure, portability, rectification, objection) and recipient sharing categories with named safeguards for international transfers, but is silent on input training practices, AI interaction disclosure, and breach notification requirements.", "highlights": [ { "label": "D1 Training silence", "text": "Policy completely silent on whether customer inputs train models or any opt-in/out mechanism; three zeros awarded." }, { "label": "Vague retention period", "text": "Data is kept 'as long as necessary' without a specific period named" }, { "label": "D2 Rights strong", "text": "All five consumer rights (access, erasure, portability, correction, object) explicitly named in policy section 11; all five awarded full." }, { "label": "D4 Sharing with safeguards", "text": "Recipient categories named (affiliates, vendors, sponsors); international transfers use 'standard contractual clauses approved by European Commission'; DPA referenced but not enumerated." } ], "policyUrl": "https://forethought.ai/privacy-policy", "policyLastUpdated": "2026-05-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/forethought.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 54, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "ada", "name": "Ada", "vendor": "Ada Support Inc.", "domain": "ada.cx", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: Nothing in this Agreement shall restrict Ada Support from using Inputs for its own purposes, or for other customers, where such Inputs are generic in nature and do not include Confidential Information of Customer", "D4.3: Our use of certain online advertising and analytics technologies as discussed above in the 'Online Analytics and Advertising' section may be considered 'sales' and/or 'online targeted advertising.' To opt out of these activities, please follow the instructions in the 'Online Analytics and Advertising' section above. Ada does not sell or share data received through Meta Platform Services for third-party advertising or cross-context behavioral advertising purposes" ], "summary": "Ada's policy discloses strong data governance for deletions, access, and subprocessors, but reserves harmful rights on output reuse and targeted advertising sales with only opt-out protection.", "highlights": [ { "label": "D1.4 adverse", "text": "Ada explicitly reserves right to use customer inputs for its own purposes and for other customers where generic, defeats output ownership" }, { "label": "D4.3 adverse", "text": "Policy states Ada's advertising technologies 'may be considered sales' with only opt-out escape; explicitly reserves right to sell/share for targeted advertising" }, { "label": "D3.2 vague retention", "text": "Post-termination retention is 'reasonable period of time', undefined and unquantified, not a concrete deadline" }, { "label": "D1.2 silent on general opt-out", "text": "Quote only discloses non-use of Meta end-user data for public models; silent on whether general user inputs can be opted out of training" } ], "policyUrl": "https://www.ada.cx/legal/privacy-policy/", "policyLastUpdated": "2026-04-21", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/ada.cx.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 73, "grade": "B" }, { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "ADVERSE" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "rogo", "name": "Rogo", "vendor": "Rogo Technologies, Inc.", "domain": "rogo.ai", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Rogo discloses user ownership of outputs and input data, lists privacy rights for some jurisdictions, and commits to responsible AI use, but lacks concrete retention periods, government-access standards, named security controls, and data-minimization guarantees.", "highlights": [ { "label": "Input & Output Ownership", "text": "\"As between you and Anthropic, and to the extent permitted by applicable law, you retain any right, title, and interest that you have in the Inputs you submit. Subject to your compliance with our Terms, we assign to you all of our right, title, and interest in Outputs." }, { "label": "Data Retention Vagueness", "text": "\"We retain Personal Data about you for as long as necessary to provide you with our web site or to perform our business or commercial purposes for collecting your Personal Data." }, { "label": "Privacy Rights (Conditional)", "text": "\"Under the EU GDPR, UK DPA 2018, and several US state laws, users are entitled to the following: The right to access... The right to erasure... The right to data portability... The right to rectification... The right to object to processing." }, { "label": "Children's Age Gate", "text": "\"We do not knowingly collect or solicit Personal Data from children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the web site or send us any Personal Data." } ], "policyUrl": "https://rogo.ai/privacy-policy", "policyLastUpdated": "2025-03-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/rogo.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 50, "grade": "D" }, { "date": "2026-06-21", "score": 42, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "eightfold-ai", "name": "Eightfold AI", "vendor": "Eightfold AI Inc.", "domain": "eightfold.ai", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 65, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Eightfold AI discloses moderate privacy protections with clear data retention limits, deletion rights, and industry-standard security practices, though some claims lack concrete specificity and adverse sharing practices are absent from the policy.", "highlights": [ { "label": "Data Anonymization for Model Training", "text": "Personal Data that will be a part of any such datasets is anonymized by Eightfold prior to use by Eightfold in building, training or validating our model" }, { "label": "Customer Data Retention & Deletion", "text": "Eightfold will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days upon Customer's written request, but thereafter Eightfold may delete such Customer Data" }, { "label": "EU-U.S. Data Privacy Framework Compliance", "text": "Eightfold complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework" }, { "label": "SOC 2 Security Audits", "text": "The security program will be subject to periodic Service Organization Control 2 (SOC 2) audits or other similar independent third-party audits" } ], "policyUrl": "https://eightfold.ai/privacy-notice/", "policyLastUpdated": "2026-05-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/eightfold.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 70, "grade": "B" }, { "date": "2026-06-21", "score": 65, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "hirevue", "name": "HireVue", "vendor": "HireVue, Inc.", "domain": "hirevue.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "HireVue's privacy policy for website visitors discloses data collection and use transparently but with vague retention terms and limited security specifics; the policy explicitly excludes customer job applicants from this notice.", "highlights": [ { "label": "Training data scope exclusion", "text": "This Privacy Notice does not apply to personal information we process about: Our customer's job applicants, managed through technology services we offer through one or more of Hirevue platform(s) ('Customer Candidate Data')." }, { "label": "Data retention vagueness", "text": "We store the personal information we collect for as long as is necessary for the purpose for which it was collected (for example, as long as is necessary to provide you with the services and features you request when you Interact With Us) or as otherwise necessary to comply with applicable legal requirements." }, { "label": "AI transparency in sales calls", "text": "This includes analyzing the content of such communications and online meetings using AI-powered tools to gain better insights into our interactions with our customers and customer prospects" }, { "label": "Advertising opt-out mechanism", "text": "If you do not wish for us or our providers to 'sell' or 'share' personal information relating to your Website visits for advertising purposes, you can manage your choices by using controls described in the Cookie Statement." } ], "policyUrl": "https://legal.hirevue.com/legal-center/privacy-policy", "policyLastUpdated": "2025-09-16", "modalities": [ "text", "video" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/hirevue.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 27, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "thoughtspot", "name": "ThoughtSpot", "vendor": "ThoughtSpot, Inc.", "domain": "thoughtspot.com", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 40, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "ThoughtSpot discloses enumerated data categories, conditional privacy rights (access, deletion, portability, correction), a no-sell pledge for personal data, recipient categories (subsidiaries and vendors), Standard Contractual Clauses for EEA transfers, basic security safeguards (categories unnamed), and parental consent for children's data, but omits training-data transparency, retention periods with numbers, breach notification timelines, and named security certifications.", "highlights": [ { "label": "Data Categories", "text": "Enumerated: Contact, Payment, Demographic, Event, Online Identifiers, Device, Search Query, Diagnostic" }, { "label": "No-Sell Pledge", "text": "We do not sell Personal Data nor do we rent or trade Personal Data collected through the Website with third-parties for their promotional purposes" }, { "label": "International Transfers", "text": "When we disclose Personal Data of customers in the EEA, the UK, or Switzerland, we make use of the Standard Contractual Clauses or will implement other appropriate legal mechanisms" }, { "label": "Silence on Training & Retention", "text": "No disclosure of whether inputs train models; no numeric retention period; no breach notification timeline; no named security certifications" } ], "policyUrl": "https://www.thoughtspot.com/privacy", "policyLastUpdated": "2025-12-15", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/thoughtspot.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-21", "score": 40, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "sigma-computing", "name": "Sigma Computing", "vendor": "Sigma Computing, Inc.", "domain": "sigmacomputing.com", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 54, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Sigma Computing's privacy policy provides strong legal rights (access, deletion, portability, correction, opt-out) but is silent on AI model training, output ownership, and security controls beyond industry-standard assertions.", "highlights": [ { "label": "Critical Finding: D1.1–D1.4 Contained Wrong Policy", "text": "The original ledger quoted Claude's training language (\"training our models, unless you opt out\", \"Outputs\") which does NOT appear in Sigma's policy. Sigma Computing's privacy policy is silent on model training, LLM use, and output ownership, it governs a cloud analytics platform, not an AI service. D1.1, D1.2, D1.4 all downgraded to zero." }, { "label": "D3.4 Downgraded to Half", "text": "Original quote about \"aggregation and de-identification techniques\" does not appear verbatim; actual policy text says \"we may disclose or use aggregated or de-identified information or data for any purpose\", vague commitment without minimization mechanism detail, hence half not full." }, { "label": "D4.2 Upgraded to Full", "text": "Original award was half; policy explicitly requires third parties to \"abide by contractual, technical, and organizational measures\" with named scope: \"processed only to the extent that such processing is necessary, consistent with this Privacy Notice, and in accordance with applicable law\", named mechanisms present, merits full." }, { "label": "D4.3 Upgraded to Full", "text": "Original award was half; policy clearly states \"if you opt out, going forward, we will not disclose your Personal Data to third parties (including Advertising and Marketing Partners) for the purposes of online analytics, targeted advertising, or cross-context behavioral advertising\", negative covenant with no-opt-out carve-out, merits full." } ], "policyUrl": "https://www.sigmacomputing.com/legal/privacy-policy", "policyLastUpdated": "2026-02-11", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/sigmacomputing.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 56, "grade": "C" }, { "date": "2026-06-21", "score": 54, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "pigment", "name": "Pigment", "vendor": "Pigment SAS", "domain": "pigment.com", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 46, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Pigment's privacy policy discloses data inputs used for model training with no named opt-out, grants users standard GDPR rights, retains data for mixed periods (3 years or contract duration), shares with named service provider categories under standard contractual clauses, enumerates data categories and legal bases in a table, and implements named security controls including ISO 27001 with a named DPO contact.", "highlights": [ { "label": "Model Training , No Opt-Out", "text": "Policy states data used 'to provide, develop and improve our Pigment AI Features' and 'training our models' with no explicit opt-out mechanism disclosed in the privacy policy itself." }, { "label": "Full GDPR Rights Enumerated", "text": "Access, erasure, rectification, portability, and objection rights are all explicitly listed in the 'Your rights?' section without procedural complexity." }, { "label": "Named ISO 27001 + DPO", "text": "Security section cites ISO 27001 and SOC 1 & SOC 2 Type 2 certifications; Data Protection Officer contact explicitly provided at dpo@pigment.com." }, { "label": "Purposes-to-Legal-Bases Table", "text": "Policy includes explicit table mapping data purposes (marketing, service improvement, billing) to legal bases and retention periods, supporting full transparency on D5.4." } ], "policyUrl": "https://www.pigment.com/privacy-policy", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pigment.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 55, "grade": "C" }, { "date": "2026-06-21", "score": 46, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "jasper", "name": "Jasper", "vendor": "Jasper AI, Inc.", "domain": "jasper.ai", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.1: Jasper uses Customer Property... for developing and enhancing Jasper's artificial intelligence models. [EU/UK object right conditional; global population has no opt-out]", "D1.4: you expressly grant... to Jasper a royalty-free, sublicensable, transferable, perpetual, irrevocable, non-exclusive, worldwide license... for (b) modifying, improving, and enhancing artificial intelligence models" ], "summary": "Jasper trains on user inputs globally without opt-out except in EU/UK, grants itself broad perpetual sublicensable rights to train on outputs, and provides basic GDPR/CCPA rights but lacks granular transparency on data uses and security controls.", "highlights": [ { "label": "Global model training without opt-out", "text": "Jasper uses Customer Property... for developing and enhancing Jasper's artificial intelligence models [globally, with opt-out only for EU/UK]" }, { "label": "Broad perpetual sublicensable license on outputs", "text": "you expressly grant... to Jasper a royalty-free, sublicensable, transferable, perpetual, irrevocable... license... for modifying, improving, and enhancing artificial intelligence models" }, { "label": "GDPR/CCPA rights present", "text": "Request access, deletion, correction, portability, and object to processing; categories of personal information disclosed; legal bases enumerated" }, { "label": "Vague retention and no security detail", "text": "will retain Personal Data only for as long as is necessary [no number given]; no named TLS/AES/certs; no breach notification commitment" } ], "policyUrl": "https://www.jasper.ai/legal/privacy", "policyLastUpdated": "2025-05-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/jasper.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 53, "grade": "D" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "moveworks", "name": "Moveworks", "vendor": "Moveworks, Inc.", "domain": "moveworks.com", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 46, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Moveworks discloses GDPR-style data rights (access, deletion, portability, correction, objection) with location-based application; no AI training opt-out; limited security detail (industry standards, no named certs); adequate international transfer safeguards named.", "highlights": [ { "label": "Rights (D2.1–D2.5)", "text": "right to access; right to request erasure/deletion; right to data portability (structured, commonly-used, machine readable format); right to rectify/correct; right to object to processing" }, { "label": "No AI training disclosure (D1.1–D1.4)", "text": "No statement that user inputs or content are used to train AI/ML models; no training opt-out named" }, { "label": "Security (D7.1–D7.3)", "text": "Follows current industry standards to protect data in transit and at rest; security contact: security@moveworks.com; privacy contact: privacy@moveworks.ai" }, { "label": "International transfers (D4.4)", "text": "European Commission adequacy decisions (Canada); U.S. Data Privacy Framework; Standard Contractual Clauses (EEA/Switzerland); UK International Data Transfer Agreement" } ], "policyUrl": "https://www.moveworks.com/content/dam/pdfs/legal/moveworks-privacy-policy.pdf", "policyLastUpdated": "2024-04-18", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/moveworks.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 50, "grade": "D" }, { "date": "2026-06-21", "score": 46, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "uipath", "name": "UiPath", "vendor": "UiPath, Inc.", "domain": "uipath.com", "category": "Automation", "audience": "Enterprise", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "UiPath discloses conditional data training use with opt-out mechanism, comprehensive data subject rights listed but minimally detailed, specific retention periods for recruitment data, named recipient categories with contractual safeguards, explicit no-sell for advertising, and DPO contact.", "highlights": [ { "label": "Training data controls", "text": "Data may be used for product improvement and machine learning based on contract; users can opt out via account settings" }, { "label": "Data retention", "text": "Candidate data up to 1 year; interview recordings 3 months; Customer Advisory Board data 18 months maximum" }, { "label": "Sharing limits", "text": "Explicitly does not sell or share mobile/personal data with third parties for advertising or promotional use" }, { "label": "International transfers", "text": "Standard Contractual Clauses or UK International Data Transfer Addendum for EU/UK transfers" } ], "policyUrl": "https://www.uipath.com/legal/trust-and-security/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/uipath.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 76, "grade": "B" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "zapier", "name": "Zapier", "vendor": "Zapier, Inc.", "domain": "zapier.com", "category": "Automation", "audience": "Enterprise", "scoreOutOf100": 72, "letterGrade": "A", "displayedGrade": "A", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Zapier discloses model training with opt-out (half), named opt-out mechanism, tier differences, user data ownership, comprehensive rights, vague retention except auto-deletion after 24 months, sharing categories with DPA reference, but lacks specific security controls and breach notification timeline.", "highlights": [ { "label": "Unnamed opt-out mechanism", "text": "Opting out of training is done 'by submitting this opt-out form,' but no concrete link or process is given to confirm how" }, { "label": "Indefinite default retention", "text": "There is no named retention period; data is kept indefinitely and Zapier only 'reserves the right' to delete inactive accounts after 24 months" }, { "label": "D5.1 remains half: ADM disclosed but no human review or impact rights", "text": "Policy discloses automated decision-making is used, but provides no mechanism for human review, right to object, or explanation of impact. Half-award appropriate for disclosure without safeguards." } ], "policyUrl": "https://zapier.com/privacy", "policyLastUpdated": "2026-04-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/zapier.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 50, "grade": "D" }, { "date": "2026-06-21", "score": 72, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "full", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "n8n", "name": "n8n", "vendor": "n8n GmbH", "domain": "n8n.io", "category": "Automation", "audience": "Enterprise", "scoreOutOf100": 68, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [ "D1.4: You do however provide us with a worldwide, royalty-free, non-exclusive, transferable and sublicensable right to use your data to improve our Platform." ], "summary": "n8n has strong data minimization and user rights disclosures but grants sublicensable usage rights to user data without limiting reuse scope, which is adverse.", "highlights": [ { "label": "No ML training (D1.1)", "text": "We do not use personal data processed in connection with the Website or Services, including data from third-party services or integrations, to train n8n or third party machine learning (ML) models." }, { "label": "Sublicensable reuse (D1.4 adverse)", "text": "You do however provide us with a worldwide, royalty-free, non-exclusive, transferable and sublicensable right to use your data to improve our Platform." }, { "label": "Deletion after account close (D3.2)", "text": "Your data is usually deleted 6 months after the deactivation of your account with us" }, { "label": "Named DPO contact (D7.3)", "text": "For confidential inquiries to our external Data Protection Officer, please contact them at dsb@freshcompliance.de." } ], "policyUrl": "https://n8n.io/legal/privacy/", "policyLastUpdated": "2026-04-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/n8n.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 81, "grade": "B" }, { "date": "2026-06-21", "score": 68, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "lindy", "name": "Lindy", "vendor": "Lindy AI, Inc.", "domain": "lindy.ai", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 52, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: user retains ownership but grants 'irrevocable license to use Contributions for analytics purposes in perpetuity'" ], "summary": "Lindy discloses explicit no-train on Google API data, reasonable access/correction/objection rights, and named security contacts, but lacks concrete retention periods, named security controls, and has an adverse perpetual-analytics license on user contributions.", "highlights": [ { "label": "Perpetual analytics licence", "text": "Claims an 'irrevocable license to use Contributions for analytics purposes in perpetuity,' reserving perpetual reuse of your contributions" }, { "label": "Vague retention period", "text": "Data is kept 'as long as necessary to fulfill the purposes' with no concrete retention period named" }, { "label": "Boilerplate security", "text": "Describes measures as 'appropriate and reasonable' but names no specific controls such as encryption or access controls" } ], "policyUrl": "https://www.lindy.ai/privacy", "policyLastUpdated": "2025-03-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/lindy.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 49, "grade": "D" }, { "date": "2026-06-21", "score": 52, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "cline", "name": "Cline", "vendor": "Cline Bot Inc.", "domain": "cline.bot", "category": "Coding", "audience": "Enterprise", "scoreOutOf100": 24, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: sublicensable and transferable right and license... (perpetual and irrevocable with respect to any de-identified or aggregated data)" ], "summary": "Cline discloses data use for model training with opt-out, telemetry control, and transfers inputs to third-party AI providers, but grants itself perpetual sublicensable rights over aggregated data; lacks deletion rights, portability, correction, named security controls, and breach notification.", "highlights": [ { "label": "Training Data Use", "text": "We may use Materials... including training our models, unless you opt out of training through your account settings" }, { "label": "AI Provider Transmission", "text": "Inputs and Outputs transmitted to third-party AI Model Providers... OpenRouter, Google Vertex, Amazon Bedrock, Anthropic or OpenAI" }, { "label": "Perpetual Aggregated Data License (Adverse)", "text": "sublicensable and transferable right and license... (perpetual and irrevocable with respect to any de-identified or aggregated data)" }, { "label": "Telemetry Control", "text": "Telemetry is on by default and can be disabled at any time in the extension settings" } ], "policyUrl": "https://cline.bot/privacy", "policyLastUpdated": "2025-09-25", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cline.bot.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 38, "grade": "F" }, { "date": "2026-06-21", "score": 24, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "spellbook", "name": "Spellbook", "vendor": "Rally Legal, Inc.", "domain": "spellbook.legal", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Spellbook explicitly prohibits using customer data to train third-party LLMs, owns outputs to customers, and limits retention to 90 days for quality assurance; however it silently lacks data portability, deletion rights, and automated-decision disclosures, and its international transfer safeguards are only stated for EU residents.", "highlights": [ { "label": "No Third-Party LLM Training", "text": "Spellbook will prohibit Third Party LLMs from using Customer Data for training, improvement, or development of their AI models, and will opt out of all available opt-out mechanisms for such use." }, { "label": "Customer Data Ownership", "text": "Customer owns all Customer Data, Outputs, and custom work product created by Spellbook, with Spellbook retaining only a non-exclusive license for service provision." }, { "label": "90-Day QA Retention", "text": "QA Data (Inputs and Outputs for quality assurance) is retained for no longer than 90 days from collection, then permanently deleted." }, { "label": "Silent on Data Rights", "text": "Policy does not disclose user rights to delete personal data, port data, correct inaccurate information, or challenge automated decisions." } ], "policyUrl": "https://www.spellbook.legal/legal/privacy-policy", "policyLastUpdated": "2026-06-04", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/spellbook.legal.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 49, "grade": "D" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "half", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "hippocratic-ai", "name": "Hippocratic AI", "vendor": "Hippocratic AI", "domain": "hippocraticai.com", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 22, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Hippocratic AI's privacy policy discloses data categories and non-sale commitment but lacks specificity on training, retention periods, and security controls.", "highlights": [ { "label": "D4.3 (No sale)", "text": "We are not in the business of selling our customers' personal information to others. No sale of personal information." }, { "label": "D5.3 (Data enumeration)", "text": "identifying information such as your name, address, email address, business affiliation, and phone numbers; your location information; your IP address; corporate and financial information" }, { "label": "D6.4 (Child age gate)", "text": "We do not knowingly collect personal information from children under the age of 13." }, { "label": "D4.1 (Recipient categories)", "text": "We employ other companies and individuals to perform functions on our behalf. Examples include sending postal mail and email, analyzing data, providing marketing assistance, processing payments, and providing customer service." } ], "policyUrl": "https://www.hippocraticai.com/privacy-policy", "policyLastUpdated": "2023-09-13", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/hippocraticai.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 45, "grade": "D" }, { "date": "2026-06-21", "score": 22, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "suki", "name": "Suki AI", "vendor": "Suki AI, Inc.", "domain": "suki.ai", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 23, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Suki AI trains models on customer data with opt-out, acts as HIPAA Business Associate for medical data, does not actively sell data, but retains broad perpetual rights to use customer data for model improvement with vague security and children's protections.", "highlights": [ { "label": "Broad training rights", "text": "Reserves broad, ongoing rights to use customer data for model improvement, not limited to delivering the service, with no clear user ownership of outputs" }, { "label": "Correction not guaranteed", "text": "Correction relies on a 'reasonable steps' standard, and for medical data it depends on a separate business associate agreement rather than the privacy policy" }, { "label": "No firm sale prohibition", "text": "States Suki is 'not in the business of selling' data, which describes current practice rather than a binding commitment not to sell in future" }, { "label": "Weak children's protection", "text": "Says it does 'not knowingly collect' data from children under 13 but describes no age verification at signup" } ], "policyUrl": "https://www.suki.ai/privacy-policy/", "policyLastUpdated": "2025-05-16", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/suki.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 39, "grade": "F" }, { "date": "2026-06-21", "score": 23, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "alphasense", "name": "AlphaSense", "vendor": "AlphaSense, Inc.", "domain": "alpha-sense.com", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "AlphaSense discloses limited training-data controls but provides clear GDPR-aligned user rights, EU-standard data-sharing transparency, named retention vagueness, and age-based children protections.", "highlights": [ { "label": "Training silence", "text": "Policy contains zero disclosure on whether customer Inputs train models, no opt-out mechanism, and no tier differences, all indicators D1.1-D1.3 silent and awarded zero." }, { "label": "User rights (D2)", "text": "Full 'full' awards across access, deletion, portability, correction, and objection, policy explicitly names GDPR-standard mechanisms with clear language." }, { "label": "Vague retention period", "text": "Data is kept 'as long as we actually need it' with no concrete period named" }, { "label": "No adverse clauses detected", "text": "No evidence of trains-no-opt-out, perpetual/sublicensable licenses, deletion refusal, or sells-no-opt-out; all adverse flags remain false." } ], "policyUrl": "https://www.alpha-sense.com/privacy-policy/", "policyLastUpdated": "2025-09-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/alpha-sense.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "dbt-labs", "name": "dbt Labs", "vendor": "dbt Labs, LLC", "domain": "getdbt.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "dbt Labs discloses GDPR data subject rights comprehensively with named recipients and safeguards for international transfers, but lacks transparency on AI model training use and breach notification timelines.", "highlights": [ { "label": "GDPR Rights Disclosure", "text": "Policy explicitly references Arts. 15-22 GDPR for access, erasure, portability, rectification, and objection rights with actionable mechanisms (Art. 15, Art. 17, Art. 20, Art. 16, Art. 21)" }, { "label": "International Transfer Safeguards", "text": "Named mechanisms for EEA-to-US transfers: standard contractual clauses and EU-U.S. Data Privacy Framework certification explicitly documented" }, { "label": "Retention Period Limit", "text": "Concrete upper bound disclosed: 'for no more than ten years after termination of the applicable account' (10-year cap, not indefinite)" }, { "label": "Training Data Use , Silent", "text": "No disclosure of whether visitor inputs to website or plugin telemetry trains any dbt Labs models; policy mentions AI-Aided Tools model training only for enterprise clients in Terms of Use" } ], "policyUrl": "https://www.getdbt.com/cloud/privacy-policy", "policyLastUpdated": "2025-06-11", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/getdbt.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 83, "grade": "B" }, { "date": "2026-06-21", "score": 45, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "monte-carlo", "name": "Monte Carlo", "vendor": "Monte Carlo Data, Inc.", "domain": "montecarlodata.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 48, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Monte Carlo does not disclose whether customer inputs train its models, lacks opt-out mechanisms for training, and provides vague retention periods (\"as long as necessary\"), though it does clearly prohibit selling personal data and certifies DPF compliance.", "highlights": [ { "label": "Training disclosure gap", "text": "Policy is completely silent on whether customer data/inputs train Monte Carlo models. D1.1-D1.3 all zero (silent)." }, { "label": "Data ownership clear", "text": "D1.4 and D3.2 correctly cap scope: customer owns data, Monte Carlo uses only \"as necessary to provide the Service\" with deletion upon request." }, { "label": "No model training opt-out", "text": "Unlike Anthropic (which offers opt-out in account settings), Monte Carlo provides no disclosed mechanism to decline model training use." }, { "label": "Vague retention baseline", "text": "D3.1 says \"as long as necessary\", no named number, no deletion timeline (30-day floor), ladder correctly set to 0.2." } ], "policyUrl": "https://www.montecarlodata.com/privacy-policy/", "policyLastUpdated": "2025-04-10", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/montecarlodata.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-21", "score": 48, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "pinecone", "name": "Pinecone", "vendor": "Pinecone Systems, Inc.", "domain": "pinecone.io", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 25, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Pinecone's privacy policy is minimalist on data subject rights, offering vague, conditional mechanisms primarily for EU residents, with no global transparency on model training, data security certifications, or breach notification procedures.", "highlights": [ { "label": "Training data silence", "text": "Policy completely silent on whether website user inputs train Pinecone models; notes only that B2B customer data is 'processed only as instructed' per DPA." }, { "label": "Rights gated to EU", "text": "Access, deletion, portability, correction, objection rights all stated only in 'Notice to European Users' section; global policy offers only vague 'contact us' mechanism." }, { "label": "Retention: vague indefinite standard", "text": "'We retain personal information for as long as necessary to fulfill the purposes for which we collected it', no concrete timeline, no minimization commitment." }, { "label": "No security certifications named", "text": "Policy states 'various physical, electronic and procedural safeguards' but names no ISO, SOC2, or security standard; only contact email privacy@pinecone.io for global users." } ], "policyUrl": "https://www.pinecone.io/privacy/", "policyLastUpdated": "2024-05-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pinecone.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 54, "grade": "D" }, { "date": "2026-06-21", "score": 25, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "airbyte", "name": "Airbyte", "vendor": "Airbyte, Inc.", "domain": "airbyte.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 59, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: fully sublicensable right to use and otherwise freely exercise and exploit the Feedback", "D4.3: We may also share information about our users with these companies to facilitate interest-based advertising" ], "summary": "Airbyte does not train on customer data and discloses transfer to third-party AI platforms, but lacks named output-ownership protections, retention periods are vague, and sensitive-data minimization is only passive.", "highlights": [ { "label": "D1.1: No model training", "text": "Airbyte does not collect or use customer data to develop, improve, or train generalized artificial intelligence and/or machine learning models." }, { "label": "D1.4: Broad sublicense on Feedback", "text": "You agree that we may use the Feedback however we choose without any obligation or other payment to you (grant: nonexclusive, royalty-free, fully-paid, perpetual, irrevocable, transferable, and fully sublicensable)" }, { "label": "D3.1: Vague retention", "text": "We keep personal information for as long as reasonably necessary for the purposes described in this Privacy Policy" }, { "label": "D4.3: Interest-based advertising", "text": "We may also share information about our users with these companies to facilitate interest-based advertising to our or similar users (known as a lookalike audience)" } ], "policyUrl": "https://airbyte.com/privacy-policy", "policyLastUpdated": "2026-04-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/airbyte.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 65, "grade": "C" }, { "date": "2026-06-21", "score": 59, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "ADVERSE" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "atlan", "name": "Atlan", "vendor": "Atlan", "domain": "atlan.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 80, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Atlan discloses no-train commitments for customer data except for customer-specific training, opt-in/off mechanism for AI, user ownership of outputs with carve-outs, data subject rights, deletion timelines, sub-processor list, and multiple named security certifications and controls.", "highlights": [ { "label": "D1.4 downgrade: owner claim qualified by carve-out", "text": "Customer owns outputs but \"understands that AI Inputs...may generate same or similar AI Outputs\" to other customers' outputs, shared/ambiguous reuse." }, { "label": "D5.1 downgrade: vague disclosure", "text": "Outputs \"tagged as such\" is a labeling assertion without concrete disclosure mechanism, half for naming without detail." }, { "label": "D6.1 upgrade: explicit refusal of ADM", "text": "\"We do not use any automated processes to make decisions about you that produce legal or significant effects\" is a direct, named prohibition, full." }, { "label": "All adverse flags: false", "text": "No silence on training, deletion, sales, or licensing. No perpetual/sublicensable clauses, no opt-out-only for harmful use, no indefinite retention." } ], "policyUrl": "https://atlan.com/privacy-policy/", "policyLastUpdated": "2024-06-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/atlan.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 59, "grade": "C" }, { "date": "2026-06-21", "score": 80, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "fivetran", "name": "Fivetran", "vendor": "Fivetran, Inc.", "domain": "fivetran.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 66, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Fivetran discloses solid data access and deletion rights with concrete timelines, transparent data sharing categories, and named security controls, but is vague on training data use beyond sensitive data, AI choice, and government access standards.", "highlights": [ { "label": "Deletion & Access Rights", "text": "Average 2 business days for deletion requests with published metrics (2025), plus explicit rights to access, correct, restrict, and port personal data." }, { "label": "Data Minimization & Categories", "text": "Seven enumerated data categories with transparent purposes linked to legal bases (contract, legitimate interest, consent); sensitive data excluded from commercial/advertising use." }, { "label": "Training Data Opacity", "text": "Policy unclear on whether general (non-sensitive) inputs are used to train models without explicit opt-in; quote only addresses sensitive data limits, not opt-out mechanism for training." }, { "label": "Limited governance detail", "text": "The policy is thin on retention timelines after deletion, automated-decision safeguards, children's protection, and a named framework for handling sensitive data" } ], "policyUrl": "https://www.fivetran.com/legal/privacy", "policyLastUpdated": "2026-05-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/fivetran.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 77, "grade": "B" }, { "date": "2026-06-21", "score": 66, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "workday", "name": "Workday", "vendor": "Workday, Inc.", "domain": "workday.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Workday's privacy policy discloses AI interactions, enumerated data categories, user rights mechanisms, and basic security measures, but lacks named data retention periods, synthetic output marking, and specificity on training data governance.", "highlights": [ { "label": "AI Transparency", "text": "analyzing the content of such calls and online meetings using AI-powered tools to determine or infer your professional interests" }, { "label": "User Rights", "text": "Obtain access, Request the deletion, Request the portability, Correct inaccurate personal information, Opt out of the sale or sharing" }, { "label": "Training Data Silence", "text": "Policy does not explicitly disclose whether user inputs train Workday models or the default opt-in/opt-out status" }, { "label": "Retention Vagueness", "text": "We keep your personal information for as long as we have a legitimate business need to do so (no named number)" } ], "policyUrl": "https://www.workday.com/en-us/privacy.html", "policyLastUpdated": "2026-02-27", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/workday.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "gusto", "name": "Gusto", "vendor": "Gusto, Inc.", "domain": "gusto.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 60, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Gusto prohibits third-party AI training on user data and provides opt-out for AI integrations, with clear user data rights and basic security disclosure, though AI output ownership and deletion timelines lack specificity.", "highlights": [ { "label": "AI Training Prohibition", "text": "Gusto does not permit its third-party artificial intelligence and large language model service providers to use your personal information to train, fine-tune, or improve their AI models" }, { "label": "AI Integration Opt-Out", "text": "AI-powered integrations are optional and are not required to use Gusto's Platform or Services. If you have previously enabled an AI-powered integration, you may disconnect it at any time through your account settings" }, { "label": "Data Rights", "text": "request access to a copy of the personal information we hold about you; request the deletion of your personal information; request the correction of inaccurate, incomplete, or outdated personal information" }, { "label": "Vague Retention", "text": "We will retain your personal information for as long as necessary to fulfill the purposes described in the How We Use Personal Information section above, unless otherwise required by applicable laws" } ], "policyUrl": "https://gusto.com/about/privacy", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gusto.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 63, "grade": "C" }, { "date": "2026-06-21", "score": 60, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "NA" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "half", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "lattice", "name": "Lattice", "vendor": "Degree, Inc. (Lattice)", "domain": "lattice.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 41, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Lattice discloses key user rights and basic data handling, with named safeguards for international transfers and children, but lacks transparency on automated decision-making disclosure and training data use.", "highlights": [ { "label": "Rights disclosure", "text": "Explicit access, deletion (conditional), correction, and marketing opt-out rights named" }, { "label": "Data safeguards", "text": "Standard Contractual Clauses for international transfers; SSL encryption for transmission; named Data Protection Officer contact" }, { "label": "Children protection", "text": "Clear statement: does not process or disclose Personal Information of minors under 16 years" }, { "label": "Key gaps", "text": "Silent on input training use, automated decision-making disclosure, breach notification timelines, and retention periods use specific numbers" } ], "policyUrl": "https://lattice.com/trust/privacy-policy", "policyLastUpdated": "2026-05-05", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/lattice.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 61, "grade": "C" }, { "date": "2026-06-21", "score": 41, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "bamboohr", "name": "BambooHR", "vendor": "BambooHR LLC", "domain": "bamboohr.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 50, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "BambooHR discloses user access and portability rights, post-closure data download windows, retention periods, and basic security measures, but is silent on AI training use and lacks detailed vendor lists or breach timelines.", "highlights": [ { "label": "D2.1-D2.4 (Data Rights)", "text": "You have the right to view, request copies, delete, transfer, and update your Personal Information" }, { "label": "D5.3 (Data Categories)", "text": "We collect your name, title, business phone number and email address...resume...photograph, signature, social security number...health insurance information" }, { "label": "D3.2 (Post-Closure Access)", "text": "You will continue to have the ability to download Customer Data for 30 days after the effective date of expiration or termination" }, { "label": "D1.1-D1.3 (Training Silence)", "text": "[SILENT: no disclosure of whether inputs are used to train models or any AI training practices]" } ], "policyUrl": "https://www.bamboohr.com/privacy-policy/", "policyLastUpdated": "2025-09-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/bamboohr.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-21", "score": 50, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "hibob", "name": "HiBob", "vendor": "Hi Bob Ltd.", "domain": "hibob.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "HiBob's privacy policy discloses training-data use with opt-out, standard-contract data transfers, and ISO 27001/SOC2 compliance, but lacks concrete output ownership disclosure and is silent on synthetic-output marking and automated-decision review.", "highlights": [ { "label": "D1.2 downgrade (account settings too vague)", "text": "\"unless you opt out of training through your account settings\" – lacks concrete named mechanism, should be half not full" }, { "label": "D1.4 downgrade (input quote, not output)", "text": "\"you retain any right, title, and interest that you have in the Inputs you submit\" – quote discusses inputs only; policy silent on output ownership/reuse, should be zero" }, { "label": "D4.3 downgrade (silent on actual practice)", "text": "\"disclosure...may be considered as a 'sale' or 'sharing'\" – conditional language does not confirm actual sell/share practice nor disclose opt-out mechanism, should be zero" }, { "label": "No synthetic output marking", "text": "The policy says nothing about marking or identifying AI-generated output" } ], "policyUrl": "https://www.hibob.com/privacy/privacy-policy/", "policyLastUpdated": "2026-02-16", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/hibob.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 60, "grade": "C" }, { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "greenhouse", "name": "Greenhouse", "vendor": "Greenhouse Software, Inc.", "domain": "greenhouse.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Greenhouse discloses AI training with weak opt-out mechanisms, strong user rights frameworks, and certification compliance but lacks specific technical controls and retention transparency.", "highlights": [ { "label": "AI Training Disclosure", "text": "Greenhouse states it 'develop[s] and train[s] artificial intelligence (AI) models' but policy is silent on opt-out rights or user control over training data." }, { "label": "User Rights & Data Portal", "text": "Strong GDPR-aligned rights framework: access, deletion, portability, correction, and objection all available via Data Subject Request Portal (applies only to EEA/UK/Swiss users)." }, { "label": "Retention Policy Vagueness", "text": "Retention governed by 'ongoing legitimate business need' with no named timeframe; backup archives retained indefinitely until deletion is possible." }, { "label": "Data Privacy Framework Certification", "text": "Greenhouse certified for EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF but provides no ISO 27001, SOC2, or named DPO contact." } ], "policyUrl": "https://www.greenhouse.com/privacy-policy", "policyLastUpdated": "2026-05-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/greenhouse.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 67, "grade": "C" }, { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "15five", "name": "15Five", "vendor": "15Five, Inc.", "domain": "15five.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 59, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "15Five discloses user data access, deletion, portability, and correction rights under CCPA/GDPR; adopts Standard Contractual Clauses for international transfers; does not sell personal data; requires explicit consent for special categories; maintains SOC 2 Type II certification; but offers limited transparency on AI use, training data opt-out mechanisms, and deletion/closure timelines.", "highlights": [ { "label": "D4.3 (Do not sell)", "text": "15Five does not sell your Personal Information" }, { "label": "D2.1 (Access right)", "text": "The right to be provided with a copy of your Personal Information" }, { "label": "D6.2 (Special category limit)", "text": "special category personal information...we will only process with your explicit consent" }, { "label": "D4.4 (International transfers)", "text": "Standard Contractual Clauses (SCC) as set forth by the provisions of the European General Data Protection Regulation" } ], "policyUrl": "https://www.15five.com/privacy-policy/", "policyLastUpdated": "2026-02-19", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/15five.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 68, "grade": "C" }, { "date": "2026-06-21", "score": 59, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "culture-amp", "name": "Culture Amp", "vendor": "Culture Amp Pty Ltd", "domain": "cultureamp.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Culture Amp discloses basic data rights, AI transparency, and retention periods but lacks named opt-out mechanisms for model training and contains no evidence of assigned output ownership rights.", "highlights": [ { "label": "Critical Error: D1.1 quote is from Anthropic Claude policy, not Culture Amp", "text": "The quote 'We may use Materials to provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out...' does not appear in the Culture Amp snapshot. This appears to be from Claude policy." }, { "label": "D1.4 quote not found", "text": "The quote about 'we assign to you all of our right, title, and interest in Outputs' does not appear in the snapshot. Culture Amp policy covers 'Customer Data' ownership but not Outputs assignment." }, { "label": "D3.2 quote not found", "text": "Quote about 'delete individual conversations...automatically deleted from our back-end within 30 days' does not appear in Culture Amp snapshot. This quote is from Claude policy." }, { "label": "D2.2 accurately quoted", "text": "'If you want to...delete the information that we have collected and hold about you, please contact our Privacy Officer at privacy@cultureamp.com' , properly reflects the actual deletion process in line 278." } ], "policyUrl": "https://www.cultureamp.com/privacy", "policyLastUpdated": "2025-07-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cultureamp.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 47, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "zero", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "betterworks", "name": "Betterworks", "vendor": "Betterworks Systems, Inc.", "domain": "betterworks.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 72, "letterGrade": "A", "displayedGrade": "A", "confidence": "High", "dealbreakerFlags": [], "summary": "Betterworks discloses privacy rights and retention limits but does not disclose model training practices on user inputs; the disclosed policy only governs third-party OpenAI's LLM service.", "highlights": [ { "label": "D1.1 fabricated quote", "text": "The quoted text 'Betterworks may use Materials to provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out of training through your account settings' does not appear in the policy. Policy is SILENT on Betterworks' own model training." }, { "label": "D4.3 clear non-sale commitment", "text": "Betterworks does not sell personal data" }, { "label": "D2 rights enumeration", "text": "Policy explicitly lists access, deletion, portability, correction, and opt-out rights with specific mechanisms" }, { "label": "D7.1 named security controls", "text": "Encryption in transit (TLS), encryption at rest for sensitive data, role-based access controls named specifically" } ], "policyUrl": "https://www.betterworks.com/privacy-policy/", "policyLastUpdated": "2026-05-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/betterworks.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 89, "grade": "A" }, { "date": "2026-06-21", "score": 72, "grade": "A" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "visier", "name": "Visier", "vendor": "Visier Inc.", "domain": "visier.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Visier's privacy policy discloses user rights to access, delete, and port data, with named controls including ISO 27001 and a DPO contact, but lacks transparency on model training use of inputs and any automated decision-making disclosures.", "highlights": [ { "label": "User Rights", "text": "Full disclosure of access (D2.1), deletion (D2.2), portability (D2.3), and correction (D2.4) rights with named mechanisms." }, { "label": "Security Controls", "text": "Named controls: ISO 27001 family of standards, SSL technology with server authentication and data encryption, DPO contact at dpo@visier.com." }, { "label": "Data Sharing Limits", "text": "\"Do not sell, share or otherwise disclose information we collect except as described in this Privacy Statement\" with named recipient categories and SCC safeguards for EEA transfers." }, { "label": "Training Data Silence", "text": "No disclosure of whether user inputs train models, no opt-out mechanism, no tier differences, and no clarity on user ownership of outputs." } ], "policyUrl": "https://www.visier.com/privacy/", "policyLastUpdated": "2025-10-07", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/visier.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 66, "grade": "C" }, { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "rippling", "name": "Rippling", "vendor": "Rippling People Center, Inc.", "domain": "rippling.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 48, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Rippling's privacy policy discloses core user rights (access, deletion, portability, correction, objection) with explicit mechanisms, transparent recipient categories and purposes/legal bases, with no training-data use disclosed.", "highlights": [ { "label": "Key change: D4.3 downgrade", "text": "Policy explicitly offers opt-out mechanism for ad-targeting disclosures (\"opt out of our disclosure of personal information in exchange for valuable consideration\"), so award is half (sells with opt-out), not zero/adverse." }, { "label": "Strengths verified", "text": "All D2 rights (access, deletion, portability, correction, objection) supported by named mechanisms. D5.3-5.5 comprehensive: full enumeration of data categories, explicit purposes/legal bases table, dated notice (March 14, 2025) with change notification." }, { "label": "Vagueness confirmed", "text": "Retention (D3.1) is pure boilerplate (\"as long as required\", \"actual retention periods can vary significantly\", no numbers), ladder 0.2. Security (D7.1-7.3) names encryption protocols but no algorithms; DPO only in \"regions where appointed." }, { "label": "Silences", "text": "No disclosure on: AI model training (D1.1-1.4), deletion timelines post-closure (D3.2), AI-specific log retention (D3.3), automated decision-making (D6.1), AI interaction (D5.1), govt-access standards (D4.5), breach notification (D7.2)." } ], "policyUrl": "https://app.rippling.com/legal/privacy", "policyLastUpdated": "2025-03-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/rippling.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 48, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "deel", "name": "Deel", "vendor": "Deel, Inc.", "domain": "deel.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D4.3: we may share Personal Information with third-party advertising partners...to deliver targeted advertisements based on your interests (contradicts claim of no data selling)" ], "summary": "Deel explicitly prohibits training on user personal data but shares data with advertising partners despite claiming not to \"sell\" it, and provides a named DPO contact without formal breach notification timelines or security certifications.", "highlights": [ { "label": "Training prohibition", "text": "Deel does not use users' personal data to train or develop AI models" }, { "label": "Advertising data sharing (adverse)", "text": "We may share Personal Information with third-party advertising partners, such as social networks to perform marketing activities and to deliver targeted advertisements based on your interests" }, { "label": "Named DPO but no breach timeline", "text": "If you become aware of any breach of security or privacy, please contact us immediately at dpo@deel.com" }, { "label": "Security controls are vague", "text": "We implement suitable measures to safeguard the information you entrust to us... we control access to your personal data on a need-to-know basis" } ], "policyUrl": "https://www.deel.com/legal/privacy-policy/", "policyLastUpdated": "2026-06-15", "modalities": [ "text" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/deel.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 58, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "ADVERSE" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "half", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "personio", "name": "Personio", "vendor": "Personio SE", "domain": "personio.com", "category": "HR & recruiting", "audience": "Enterprise", "scoreOutOf100": 68, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Personio does not train on user inputs, limits data retention to 30 days post-termination, offers standard GDPR rights, but provides vague security controls and minimal change notification in its public privacy policy.", "highlights": [ { "label": "Training data", "text": "Policy is silent on whether user inputs train models , no opt-out or opt-in mechanism disclosed." }, { "label": "Data retention", "text": "30-day post-termination retention with customer deletion right explicitly stated in DPA section 10.2." }, { "label": "Breach notification", "text": "Commits to notify without undue delay per GDPR Article 33, with reference to legal standard." }, { "label": "Security controls", "text": "References generic 'Technical and Organisational Measures' (TOM) but names no specific controls (TLS, encryption, RBAC) or certifications (ISO 27001, SOC2)." } ], "policyUrl": "https://www.personio.com/privacy-policy/", "policyLastUpdated": "2025-10-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/personio.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 58, "grade": "C" }, { "date": "2026-06-21", "score": 68, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "evenup", "name": "EvenUp", "vendor": "EvenUp, Inc.", "domain": "evenuplaw.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.1: we may use personal information to develop, improve, train, and provide our proprietary AI technologies and services for all of our customers" ], "summary": "EvenUp trains user inputs on proprietary AI models for all customers with no opt-out, collects broad personal and technical data, and offers conditional access/deletion rights tied to jurisdiction, with partial AI transparency and generic security claims.", "highlights": [ { "label": "D1.1 Training adverse", "text": "We may use personal information to develop, improve, train, and provide our proprietary AI technologies and services for all of our customers , no opt-out mechanism disclosed, meets adverse criteria" }, { "label": "D2.5 Marketing opt-out", "text": "Opt out of the sale of your information or sharing of your information for interest-based advertising...Your Privacy Choices , named mechanism with explicit website link" }, { "label": "Vague retention period", "text": "Data is kept 'only for as long as is necessary to fulfill the purposes for which it was collected,' with no specific timeframe named" }, { "label": "D7.1 Generic safeguards", "text": "We employ a number of technical, organizational, and physical safeguards , boilerplate language without naming TLS, encryption, or specific controls" } ], "policyUrl": "https://www.evenuplaw.com/privacy-policy", "policyLastUpdated": "2026-06-05", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/evenuplaw.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 49, "grade": "D" }, { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "eve", "name": "Eve", "vendor": "Butler Labs, Inc.", "domain": "eve.legal", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Eve discloses user rights including access, deletion, and opt-out mechanisms, owns output rights, explicitly does not sell personal data, provides minimal security details, and gates children under 13.", "highlights": [ { "label": "Output ownership", "text": "we assign to you all of our right, title, and interest, if any, in Outputs" }, { "label": "No data sales", "text": "We will not sell your Personal Data, and have not done so over the last 12 months" }, { "label": "Deletion right", "text": "You have the right to request that we delete the Personal Data that we have collected about you" }, { "label": "Post-termination deletion", "text": "After such thirty (30) day grace period, Customer will have no further rights or access to the Service, and Customer's Service instance, including any Customer Data, will be permanently deleted by Eve" } ], "policyUrl": "https://www.eve.legal/privacy-policy", "policyLastUpdated": "2025-08-15", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/eve.legal.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 42, "grade": "D" }, { "date": "2026-06-21", "score": 42, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "garfield-ai", "name": "Garfield AI", "vendor": "Garfield Law Ltd", "domain": "garfield.law", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 33, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Garfield AI discloses fundamental GDPR rights (access, correction, portability) and explicitly states AI use in claim estimation with mandatory human review, but lacks detail on training-data use, longer data retention (12 years), and security standards beyond basic descriptions.", "highlights": [ { "label": "AI disclosure", "text": "The Estimator Tool uses automated processing, including AI-based models, to analyse uploaded documents and generate an estimate." }, { "label": "Human review safeguard", "text": "Final decisions regarding any claim are subject to review by qualified professionals and are not based solely on the output of the tool." }, { "label": "Security controls", "text": "encryption in transit and at rest, access controls and secure deletion procedures" }, { "label": "Data retention", "text": "We keep information stored for no more than twelve years." } ], "policyUrl": "https://www.garfield.law/privacy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/garfield.law.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 42, "grade": "D" }, { "date": "2026-06-21", "score": 33, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "darrow", "name": "Darrow", "vendor": "Darrow AI, Inc.", "domain": "darrow.ai", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: irrevocable, perpetual, non-exclusive, worldwide, royalty-free, fully paid, sub-licensable right and license for training foundation models" ], "summary": "Darrow trains on user inputs with no opt-out mechanism disclosed; grants itself irrevocable perpetual sublicensable license to all user data; collects extensive browser content and activity history.", "highlights": [ { "label": "Training without opt-out", "text": "train foundation models of the Service in accordance with the purposes set forth under clause 3 below" }, { "label": "Irrevocable license grant", "text": "irrevocable, perpetual, non-exclusive, worldwide, royalty-free, fully paid, sub-licensable right and license for training foundation models" }, { "label": "No deletion timeline", "text": "We retain your personal data for the time period reasonably necessary to achieve the purposes described" }, { "label": "Browser content collected", "text": "Any prompt text you enter and metadata is generated that provides additional context about the way you use the Service" } ], "policyUrl": "https://www.darrow.ai/privacy-policy", "policyLastUpdated": "2026-05-19", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/darrow.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 62, "grade": "C" }, { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "legora", "name": "Legora", "vendor": "Legora AB", "domain": "legora.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 56, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Legora discloses a no-train-on-user-data commitment, clear data subject rights with conditions, limited retention periods, and ISO 27001/42001 security certifications, but is silent on breach notification timelines, automated decision-making governance, and children's protections.", "highlights": [ { "label": "D1.1 upgraded: explicit no-train commitment", "text": "\"Legora will not use Subscriber's Confidential Information to train or fine-tune AI models\" is a blanket prohibition, not an opt-out, stronger than award 'half' indicated. Changed to full." }, { "label": "D3.1 ladder justified at 0.2", "text": "Vague \"as long as necessary\" plus named periods (5-7 years) for compliance data = ladder 0.2 (mid-range for ambiguous retention with some specificity)." }, { "label": "Silent on: breach notification, ADM, children's protections", "text": "D7.2 (breach timeline), D6.1 (automated decisions), D6.4 (children's age gate) all zero because privacy policy is silent on these; terms document also does not disclose." }, { "label": "All other awards verified as correct", "text": "D1.4 half (limited license), D2.1-2.5 correctly calibrated, D4.1/4.4 full (enumerated), D5.3-5.5 full (enumerated, versioned), D7.1/7.3 full (named controls & certs)." } ], "policyUrl": "https://legora.com/legal/privacy-policy", "policyLastUpdated": "2026-06-04", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/legora.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 64, "grade": "C" }, { "date": "2026-06-21", "score": 56, "grade": "C" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "paxton-ai", "name": "Paxton AI", "vendor": "Paxton AI, Inc.", "domain": "paxton.ai", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 33, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Paxton AI's policy is largely silent on AI model training, automated decisions, and security specifications, with basic rights acknowledgments but limited specificity on data retention timelines and international safeguards.", "highlights": [ { "label": "Data categories transparent", "text": "Enumerated list: names, phone numbers, email addresses, mailing addresses, job titles, passwords, usernames, contact preferences, contact or authentication data, billing addresses, debit/credit card numbers" }, { "label": "No sensitive data processing", "text": "We do not process sensitive information" }, { "label": "Named marketing opt-out", "text": "You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, replying STOP or UNSUBSCRIBE to the SMS messages" }, { "label": "Age gate enforced", "text": "The Services are intended for users who are at least 18 years old. Persons under the age of 18 are not permitted to use or register for the Services" } ], "policyUrl": "https://www.paxton.ai/legal/privacy-policy", "policyLastUpdated": "2026-02-20", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/paxton.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 46, "grade": "D" }, { "date": "2026-06-21", "score": 33, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "supio", "name": "Supio", "vendor": "Supio, Inc.", "domain": "supio.com", "category": "Legal", "audience": "Enterprise", "scoreOutOf100": 34, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Supio's privacy policy offers moderate transparency with core consumer rights (access, deletion, objection to marketing) and explicit no-sell commitments, but lacks detail on AI training, data minimization, and security practices.", "highlights": [ { "label": "No-sell pledge", "text": "Supio does not sell or otherwise disclose your information except as may be required by law or as set forth herein" }, { "label": "Consumer rights", "text": "you may ask us to inform you of how we use and disclose your data, you may request access to the data and you may be entitled to dispute the accuracy and completeness of the information we have collected and amend it" }, { "label": "Children protections", "text": "We do not knowingly collect, use, process, or disclose personally identifiable data from any visitor to the Website that is under the age of 13...we will immediately revoke their access to the Services...and delete any information" }, { "label": "International safeguards", "text": "For all such transfers we ensure that these countries are either considered adequate...or that appropriate safeguards are in place such as standard contractual clauses" } ], "policyUrl": "https://www.supio.com/privacy-policy", "policyLastUpdated": "2025-03-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/supio.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 55, "grade": "C" }, { "date": "2026-06-21", "score": 34, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "corti", "name": "Corti", "vendor": "Corti ApS", "domain": "corti.ai", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 62, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: with the right to grant sublicenses, to reproduce, execute, use, store, archive, modify, perform, display and distribute Your Data" ], "summary": "Corti's privacy policy discloses retention timelines, data subject rights, and named security certifications, but lacks explicit training-data optionality and contains ambiguous security boilerplate on several indicators.", "highlights": [ { "label": "D1.4 DOWNGRADED: Adverse license grant", "text": "The quote \"with the right to grant sublicenses, to reproduce, execute, use, store, archive, modify, perform, display and distribute Your Data\" explicitly grants Corti a sublicensable, perpetual licence over user data. This is a reserved-harm clause meeting the adverse criterion. Award downgraded from half to zero." }, { "label": "D4.1 DOWNGRADED: Vague recipient categories", "text": "The quote \"These third parties may include service providers such as IT support, cloud storage and data analytics\" is illustrative boilerplate listing only examples. No named processor list, DPA references, or defined scope. This is half, not full." }, { "label": "D4.3 UPGRADED: Explicit no-sale disclosure", "text": "The policy explicitly states \"we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A.\" This is a named, concrete disavowal of a harmful practice, meeting full criteria. Upgraded from zero (silent) to full." }, { "label": "D6.2 UPGRADED: Named special categories with explicit consent requirement", "text": "The policy explicitly requires opt-in consent for sensitive data and enumerates categories: \"health conditions, racial or ethnic origin, political opinions, and more.\" This is named, specific, and mechanism-explicit. Upgraded from half to full." } ], "policyUrl": "https://www.corti.ai/legal/privacy-policy", "policyLastUpdated": "2026-06-16", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/corti.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 57, "grade": "C" }, { "date": "2026-06-21", "score": 62, "grade": "B" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "navina", "name": "Navina", "vendor": "Navina Technologies Ltd", "domain": "navina.ai", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 26, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Navina discloses core privacy rights (access, deletion, correction, objection) and names retention conditions, but is silent on training data use, model ownership, security controls, breach notification, and children's interaction protections beyond age gating.", "highlights": [ { "label": "Vague correction right", "text": "Offers a right to data 'such as accessing or correcting Personal Information' in general terms, without specifying correction of inaccurate data" }, { "label": "No model training disclosure", "text": "All D1 indicators (D1.1-D1.4) remain zero - the policy is completely silent on whether user inputs are used to train AI models, opt-out mechanisms, or output ownership" }, { "label": "D2.2 deletion right confirmed with standard legal carve-out", "text": "Award remains 'full' - deletion right is named and only subject to standard legal exception ('establishment, exercise or defense of legal claims') which is not marked adverse" } ], "policyUrl": "https://www.navina.ai/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/navina.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 41, "grade": "D" }, { "date": "2026-06-21", "score": 26, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "zero", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "deepscribe", "name": "DeepScribe", "vendor": "DeepScribe, Inc.", "domain": "deepscribe.ai", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 40, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D2.2: We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes...if you cease using such Service, we may retain or destroy, at our discretion, all Personal Data" ], "summary": "DeepScribe discloses model training with opt-out and claims outputs are user-owned, but lacks concrete retention periods, security certifications, and synthetic-output marking.", "highlights": [ { "label": "D1.4 , Outputs & Reuse", "text": "The quote conflates output ownership with Customer Data reuse: \"we assign to you all of our right, title, and interest, if any, in Outputs\" but separately grants \"worldwide, royalty-free license to use...Customer Data...for operating, analyzing and improving\" , this dual license structure is ambiguous/shared, not clear user-only ownership." }, { "label": "D2.2 & D3.2 , Deletion Refusal", "text": "Both award zero+adverse=true: the policy explicitly reserves discretion to retain indefinitely: \"we may retain or destroy, at our discretion, all Personal Data\" and permits retention \"as necessary to prevent fraud or future abuse, or for legitimate business purposes.\" This is a no-deletion-on-demand clause." }, { "label": "D3.1 , Retention Vagueness", "text": "\"We will keep Personal Data for as long as it remains necessary for the identified purpose\" , no named period, ladder=0.2 reflects vague 'as necessary' language (the lowest specific boilerplate tier)." }, { "label": "D7.1 , Security Adjective-Only", "text": "\"The Company takes reasonable steps to protect the Personal Data\" , 'reasonable steps' is an adjective, not a named control (TLS, AES, RBAC, etc.). No concrete mechanism disclosed; award zero per rubric." } ], "policyUrl": "https://www.deepscribe.ai/privacy", "policyLastUpdated": "2025-10-08", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/deepscribe.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 40, "grade": "D" }, { "date": "2026-06-21", "score": 40, "grade": "D" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "ADVERSE" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "ADVERSE" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "truewind", "name": "Truewind", "vendor": "Truewind, Inc.", "domain": "truewind.ai", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 31, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Truewind discloses restricted third-party data handling and basic privacy rights, but lacks comprehensive training opt-out mechanisms, data portability, deletion timelines, and international transfer safeguards.", "highlights": [ { "label": "Output Ownership", "text": "We assign to you all of our right, title, and interest, if any, in Outputs (Terms Section 4)" }, { "label": "No Data Sales", "text": "We do not sell personal data (Privacy Policy line 172)" }, { "label": "Third-Party Data Protection", "text": "Does not train generalized AI on Google, Slack, or Teams data (Policy lines 109, 118, 161)" }, { "label": "Data Retention Vagueness", "text": "Retains data as long as needed to provide service, no named numeric period disclosed (Policy line 176)" } ], "policyUrl": "https://www.truewind.ai/privacy-policy", "policyLastUpdated": "2026-06-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/truewind.ai.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 53, "grade": "D" }, { "date": "2026-06-21", "score": 31, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "puzzle", "name": "Puzzle", "vendor": "Puzzle Financial, Inc.", "domain": "puzzle.io", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Puzzle's privacy policy provides baseline US compliance with access and deletion rights but lacks AI transparency, data minimization, and robust security disclosures.", "highlights": [ { "label": "No output ownership stated", "text": "The licence wording covers use of Puzzle's website, not your outputs, and the policy says nothing about who owns AI outputs or how they may be reused" }, { "label": "No general do-not-sell", "text": "Limits sharing of phone numbers for marketing but says nothing about whether other personal information is sold or shared for advertising" }, { "label": "D7.3 upgraded to full", "text": "Named privacy contact privacy@puzzle.io satisfies the rubric's 'named DPO/privacy contact' criterion (the 'OR' includes this alternative to named security certifications)." } ], "policyUrl": "https://puzzle.io/legal/privacy", "policyLastUpdated": "2025-12-19", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/puzzle.io.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 44, "grade": "D" }, { "date": "2026-06-21", "score": 32, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "cube", "name": "Cube", "vendor": "Cube Planning, Inc.", "domain": "cubesoftware.com", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 23, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: continuous, binding and completely sub-licensable license" ], "summary": "Cube's policies disclose named sharing recipients and no-sell commitment, enumerate data categories, and implement basic technical controls, but are silent on training use, data retention periods, international transfer safeguards, breach notification, and most user rights mechanisms.", "highlights": [ { "label": "D4.3 - Do Not Sell", "text": "Cube does not sell, rent or lease your personal information to third parties" }, { "label": "D5.3 - Data Categories", "text": "Contact Information...Device Information...Billing Information...Employment information...Account Information" }, { "label": "D7.1 - Technical Controls", "text": "All data transmitted...is transmitted over encrypted Transport Layer Security (TLS) connections...Password and Cryptographic Authentication...Secured Data Centers" }, { "label": "D1.4 - Content Licence (adverse)", "text": "continuous, binding and completely sub-licensable license" } ], "policyUrl": "https://www.cubesoftware.com/privacy-policy", "policyLastUpdated": "2025-05-19", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cubesoftware.com.ico", "history": { "firstAssessed": "2026-06-20", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 2, "scoreHistory": [ { "date": "2026-06-20", "score": 40, "grade": "D" }, { "date": "2026-06-21", "score": 23, "grade": "F" } ], "lastChange": { "date": "2026-06-21", "changes": "Re-graded under the additive 29-indicator engine (score computed in code) reading privacy policy + terms of service." } }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "augmedix", "name": "Augmedix", "vendor": "Augmedix", "domain": "augmedix.com", "category": "Healthcare", "scoreOutOf100": 44, "letterGrade": "D", "displayedGrade": "D", "confidence": "Low", "dealbreakerFlags": [], "summary": "Augmedix discloses some user rights and AI use but lacks named training-opt-out mechanisms, data minimization commitments, and concrete security controls.", "highlights": [ { "label": "D2.2: Deletion Right , Full", "text": "to erasure/deletion of Your Personal Data...By requesting deletion by emailing support@Augmedix.com with the subject line REQUEST FOR PERSONAL DATA DELETION" }, { "label": "Named retention period", "text": "Keeps personal data while you hold an account and for up to six years after the account is closed" }, { "label": "D1.4: User Output Ownership , Half (perpetual/sublicensable)", "text": "perpetual, non-exclusive, fully paid and royalty-free, transferable, sublicensable, worldwide license to use Your Content" }, { "label": "D5.1: AI Disclosure , Full", "text": "Certain Augmedix Services include features powered by Artificial Intelligence" } ], "policyUrl": "https://www.augmedix.com/privacy-policy", "policyLastUpdated": "2025-11-18", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/augmedix.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 44, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "browser-use", "name": "Browser Use", "vendor": "Browser Use", "domain": "browser-use.com", "category": "Automation", "scoreOutOf100": 53, "letterGrade": "C", "displayedGrade": "C", "confidence": "Low", "dealbreakerFlags": [ "D1.4: a non-exclusive, worldwide, royalty-free, fully paid-up, transferable, sublicensable (directly and indirectly through multiple tiers), perpetual, and irrevocable license to copy, display, upload, perform, distribute, store, modify, and otherwise use your User Content" ], "summary": "Browser Use trains inputs on models without named opt-out, permits perpetual sublicensable content reuse, conditionally deletes data, lacks concrete security certifications in policy text, and discloses basic data practices with vague retention periods.", "highlights": [ { "label": "Perpetual content licence", "text": "Grants Browser Use a perpetual, sublicensable, irrevocable licence to user content that allows indefinite reuse beyond running the service" }, { "label": "Conditional deletion", "text": "Data is deleted only when Browser Use decides it is no longer needed, rather than on an unconditional request to erase" }, { "label": "Certification only in footer", "text": "Names a privacy contact and references SOC 2 in the footer, but the policy itself gives no certification details or dates" } ], "policyUrl": "https://browser-use.com/privacy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/browser-use.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 53, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "langchain", "name": "LangChain", "vendor": "LangChain", "domain": "langchain.com", "category": "Data platform", "scoreOutOf100": 63, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [], "summary": "LangChain explicitly prohibits training on customer data and includes comprehensive data rights, but retention standards and security controls remain vague.", "highlights": [ { "label": "Training data protection", "text": "LangChain agrees that it will not use Customer Data to train on, develop, or otherwise improve its products, including any large language models" }, { "label": "Data subject rights", "text": "Explicit rights to access, correct, delete (within 30 days), port, and object to processing" }, { "label": "Retention vagueness", "text": "Retention period stated only as 'for as long as it is reasonably needed' with no concrete timeframe" }, { "label": "Security controls", "text": "Administrative, technical, and physical safeguards mentioned but no named controls (TLS, AES-256, RBAC, certifications silent)" } ], "policyUrl": "https://www.langchain.com/privacy-policy", "policyLastUpdated": "2026-06-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/langchain.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 63, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "sift", "name": "Sift", "vendor": "Sift", "domain": "sift.com", "category": "Security & compliance", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Sift discloses limited training data controls but provides concrete deletion timelines and clear data use restrictions for customers.", "highlights": [ { "label": "Data Ownership & Limited Reuse", "text": "Customer owns and retains all right, title, and interest in Customer Data; Sift gets only limited, royalty-free license for stated purposes (providing, maintaining, improving service)." }, { "label": "Deletion Timeline", "text": "Upon termination, Sift deletes customer data within 90 days upon request, with named legal mechanism and specific timeframe." }, { "label": "No Ad Sharing", "text": "Explicit commitment: We will not share your data with marketers or advertisers." }, { "label": "Training Without Explicit Opt-Out", "text": "Sift may use customer data to improve ML algorithms for as long as reasonably necessary, but no named opt-out mechanism disclosed in customer-facing terms." } ], "policyUrl": "https://sift.com/legal-and-compliance/website-privacy-notice/", "policyLastUpdated": "2026-04-20", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/sift.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 49, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "scale-ai", "name": "Scale AI", "vendor": "Scale AI", "domain": "scale.com", "category": "Data platform", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Scale AI discloses basic rights (access, correction, deletion via privacy@scale.com) and data categories but relies heavily on vague adjectives and restricts key rights to EEA residents only, with no disclosure of training-data practices or input ownership.", "highlights": [ { "label": "Training disclosure", "text": "Policy completely SILENT on whether user inputs train models, any opt-out mechanism, tier differences, or user output ownership" }, { "label": "Rights access", "text": "\"You can access, correct, amend, and delete your personal information by contacting us at privacy@scale.com\" , vague contact-based mechanism without timeline or named process" }, { "label": "EEA-only gating", "text": "\"If you are based in the EEA, the UK, or Switzerland, you can object to the processing... request the portability\" , key rights restricted to European residents only" }, { "label": "Data categories enumerated", "text": "\"Identifiers... Professional or employment-related information... Inference data... Commercial information... Internet or network information... Financial information... Geolocation data" } ], "policyUrl": "https://scale.com/legal/privacy", "policyLastUpdated": "2024-07-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/scale.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 32, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "warp", "name": "Warp", "vendor": "Warp", "domain": "warp.dev", "category": "Coding", "scoreOutOf100": 24, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: Licensee hereby grants to Warp a non-exclusive, transferable and sublicensable license to use, reproduce, modify and perform the Licensee Data solely as reasonably required to operate and provide the Services" ], "summary": "Warp's privacy policy discloses AI data collection with user control options, but grants Warp a sublicensable license to train on user data, broadly shares with advertising partners, and provides limited deletion and retention transparency.", "highlights": [ { "label": "Sublicensable data licence", "text": "Grants Warp a 'non-exclusive, transferable and sublicensable' licence to use, reproduce, and modify your data including for training models, so third parties can access and reuse it" }, { "label": "D5.1 Strong: Named AI Feature Disclosure", "text": "Policy explicitly names Active AI and Agent Mode, discloses that prompts, inputs, and outputs are collected, and states 'You can control our collection of these inputs and outputs at any time in your settings.' Meets full award criteria with named mechanism and defined scope." }, { "label": "D1.1 & D1.2 Remain Half: Vague Training Language", "text": "D1.1 uses boilerplate 'training, fine-tuning and improving performance' without naming a no-train default. D1.2 offers user 'control' via settings but does not specify what control means (block collection vs. prevent training use). Both are named-but-vague, correctly scored as half." }, { "label": "No retention period named", "text": "The policy does not say how long data is kept, with no retention timeline and no zero-retention option" } ], "policyUrl": "https://www.warp.dev/legal/privacy-policy", "policyLastUpdated": "2025-09-25", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/warp.dev.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 24, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "abnormal-security", "name": "Abnormal Security", "vendor": "Abnormal AI", "domain": "abnormal.ai", "category": "Security & compliance", "scoreOutOf100": 34, "letterGrade": "F", "displayedGrade": "F", "confidence": "Low", "dealbreakerFlags": [ "D1.4: you grant us a perpetual, non-exclusive, fully paid, royalty-free, irrevocable, sublicenseable, worldwide license and right to display, use, perform, reproduce, modify, distribute and create derivative works" ], "summary": "Abnormal Security's global privacy policy is largely silent on data minimization and rights disclosure, with a problematic perpetual sublicensable license on user submissions and no explicit training opt-out mentioned.", "highlights": [ { "label": "Fabricated training opt-out quote", "text": "D1.1 claims \"unless you opt out of training through your account settings\" , this exact phrase does not appear anywhere in Abnormal Security's policy. The policy is completely silent on whether user inputs train models." }, { "label": "Adverse sublicensable license on submissions", "text": "Terms of Use Section 'Submissions' (line 239): \"you grant us a perpetual, non-exclusive, fully paid, royalty-free, irrevocable, sublicenseable, worldwide license and right to display, use, perform, reproduce, modify, distribute and create derivative works...\" This is an explicit sublicensable clause, making D1.4 adverse." }, { "label": "Jurisdiction-conditional rights (not global)", "text": "Lines 159 and 165 state \"Depending upon your place of residence...you may have rights...\" The global policy does NOT affirm access, deletion, correction, or portability as universal rights, only conditional on jurisdiction." }, { "label": "Silent on security controls", "text": "The policy mentions a \"Security Hub\" and \"Security Exhibit\" but does not name any technical controls (TLS, AES-256, RBAC, etc.). D7.1 quote 'We implement appropriate technical and organizational security measures' does not appear in this policy." } ], "policyUrl": "https://abnormal.ai/privacy-notice", "policyLastUpdated": "2025-07-03", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/abnormal.ai.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 34, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "full", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "v0", "name": "v0", "vendor": "Vercel", "domain": "v0.app", "category": "Coding", "scoreOutOf100": 61, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Vercel v0 discloses an opt-out model for training data (Enterprise customers fully opt out; Hobby/Pro users can opt out with limitations for safety-flagged content), supports core user rights (access, deletion, correction, portability, restriction), but lacks concrete timeframes, named security controls, or breach notification procedures.", "highlights": [ { "label": "Training-data opt-out available but conditional", "text": "If you purchase an Enterprise subscription, or another subscription plan that is entitled to opt out of training, Vercel represents and warrants that it will not use v0 Customer Content to train...except with your consent" }, { "label": "Hobby/Pro users: de-identified sharing to AI partners", "text": "For Hobby and Pro plan users, subject to your data preferences in your team settings, we may disclose de-identified information to AI business partners for their product improvement and development, including training and improving AI and machine learning models" }, { "label": "Rights framework present but vague retention", "text": "We retain your information for the minimum necessary period to fulfill our legal and contractual obligations...as recommended by industry standards. [No named timeframe given]" }, { "label": "Security controls stated as adjectives, not mechanisms", "text": "We use reasonable and appropriate administrative, technical, and physical safeguards designed to protect the information" } ], "policyUrl": "https://vercel.com/legal/privacy-notice", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/v0.app.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 61, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "weaviate", "name": "Weaviate", "vendor": "Weaviate", "domain": "weaviate.io", "category": "Data platform", "scoreOutOf100": 53, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Weaviate's privacy policy discloses named certifications, granular personal data categories, mapped processing purposes, and explicit user rights (access, deletion, correction, portability, objection), but lacks explicit limits on AI training reuse, opt-out mechanisms, and breach notification timelines.", "highlights": [ { "label": "Data Rights Disclosed", "text": "Five explicit rights (access, deletion, correction, portability, objection) with contact mechanism (legal@weaviate.io) and named legal bases per GDPR structure" }, { "label": "Security Controls Named", "text": "SOC2 Type 1/2, ISO27001 certifications and end-to-end encryption for stored personal data; 5-year named retention period" }, { "label": "Personal Data Mapping", "text": "Detailed table mapping data categories (user info, device, usage, organization) to stated purposes (contract, support, marketing, improvement)" }, { "label": "Training Reuse Silent", "text": "No explicit opt-out mechanism, no no-train clause, no limit on provider reuse of outputs beyond vague 'compliance' caveat; feedback used for training without opt-in" } ], "policyUrl": "https://weaviate.io/privacy", "policyLastUpdated": "2026-03-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/weaviate.io.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 53, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "browserbase", "name": "Browserbase", "vendor": "Browserbase", "domain": "browserbase.com", "category": "Automation", "scoreOutOf100": 37, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Browserbase discloses no-train without opt-in for AI models, opt-out for training via account settings, and limited recipient categories, but lacks explicit access, deletion, and data-transfer safeguard mechanisms.", "highlights": [ { "label": "Unnamed consent mechanism", "text": "Affirmative consent is required for training, but the policy names no actual way to give or withdraw it beyond a contact email" }, { "label": "Access right not stated", "text": "Lists a support email but does not clearly disclose a right to access your personal data" }, { "label": "Core Issue", "text": "Browserbase policy is thin on user rights disclosure. Most indicators in D2 (access, deletion, portability, correction) are silent. D1.2 and D2.1 conflate contact email with rights mechanisms, not equivalent." } ], "policyUrl": "https://www.browserbase.com/privacy-policy", "policyLastUpdated": "2025-08-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/browserbase.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 37, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "full", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "chroma", "name": "Chroma", "vendor": "Chroma", "domain": "trychroma.com", "category": "Data platform", "scoreOutOf100": 22, "letterGrade": "F", "displayedGrade": "F", "confidence": "Low", "dealbreakerFlags": [], "summary": "Chroma prohibits training on customer data unless explicitly permitted, but provides no opt-out mechanism and grants itself sublicensable content rights.", "highlights": [ { "label": "Training: Opt-In Only, No Opt-Out", "text": "Unless expressly permitted by Customer, Chroma will not use Customer Data to train the artificial intelligence or machine learning models." }, { "label": "Sublicensable Content Rights", "text": "Customer grants Chroma the non-exclusive, worldwide, sublicensable right to use, copy, store, disclose, transmit, transfer, publicly display, modify, and create derivative works from Customer Data" }, { "label": "Discretionary Post-Termination Deletion", "text": "After that 30 day period, Chroma will be under no obligation to store or retain the applicable Customer Data and may delete the applicable Customer Data at any time in our sole discretion." }, { "label": "Subprocessor Transparency", "text": "maintain a current list of Subprocessors at trychroma.com/subprocessors" } ], "policyUrl": "https://www.trychroma.com/privacy", "policyLastUpdated": "2024-10-02", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/trychroma.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 22, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "truveta", "name": "Truveta", "vendor": "Truveta", "domain": "truveta.com", "category": "Healthcare", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "Low", "dealbreakerFlags": [], "summary": "Truveta's policy is transparent on data access, deletion, correction, and sharing, but lacks critical opt-in/opt-out mechanisms for model training and offers vague security controls without named standards.", "highlights": [ { "label": "D2 Rights", "text": "Explicit access, correction, and deletion rights with named contact method (info@truveta.com); opt-out from promotional communications" }, { "label": "D4.5 Govt Access", "text": "Clear standard for law enforcement disclosure: \"necessary to comply with applicable law or respond to valid legal process" }, { "label": "D1 Training Data", "text": "Silent on whether inputs train models; no named opt-in/opt-out mechanism disclosed" }, { "label": "D7.1 Security", "text": "Vague security language (\"reasonable and appropriate steps\") without naming specific controls like TLS, AES-256, or RBAC" } ], "policyUrl": "https://www.truveta.com/privacy-notice/", "policyLastUpdated": "2026-03-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/truveta.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 45, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "cohere-health", "name": "Cohere Health", "vendor": "Cohere Health", "domain": "coherehealth.com", "category": "Healthcare", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Cohere Health's privacy policy discloses basic rights for authorized users on its B2B platform, HIPAA protections for health data, encryption in transit/at rest, and a no-sell-without-consent commitment, but lacks granular controls like data portability, breach notification timelines, specific security algorithms, and explicit international transfer safeguards.", "highlights": [ { "label": "Training data", "text": "Cohere does not solicit or collect Personal Information directly from individuals for use on platform; user data not disclosed as training input" }, { "label": "Healthcare data", "text": "Cohere may receive Protected Health Information (PHI) subject to HIPAA; has implemented required safeguards pursuant to HIPAA" }, { "label": "No opt-out sell", "text": "Cohere does not sell or trade Personal Information to third parties without your prior consent" }, { "label": "Encryption", "text": "All Sensitive Information protected by encryption software, both in transit and at rest" } ], "policyUrl": "https://www.coherehealth.com/privacy-policy", "policyLastUpdated": "2024-11-18", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/coherehealth.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 27, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "mercury", "name": "Mercury", "vendor": "Mercury", "domain": "mercury.com", "category": "Finance", "scoreOutOf100": 50, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Mercury discloses user rights comprehensively including data access, deletion, and opt-out mechanisms, but lacks retention timelines and does not disclose AI model training or use of AI services for users.", "highlights": [ { "label": "D3.2 upgrade from half to full", "text": "The policy specifies a concrete 30-day deletion timeline: 'automatically deleted from our back-end within 30 days,' meeting the 'named mechanism / concrete number' standard for full." }, { "label": "No user-facing AI disclosed", "text": "References to AI and machine learning cover internal fraud detection and categorization, not any user-facing AI service, so AI interaction is not disclosed" }, { "label": "No automated-decision rights", "text": "The policy says nothing about automated decisions affecting users, human review, or related governance" } ], "policyUrl": "https://mercury.com/legal/privacy", "policyLastUpdated": "2026-06-18", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/mercury.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 50, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "NA" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "veriff", "name": "Veriff", "vendor": "Veriff", "domain": "veriff.com", "category": "Security & compliance", "scoreOutOf100": 38, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Veriff discloses automated identity verification with human-review rights, biometric retention limits (3 years for Illinois), and does not sell identity verification data for ads, but lacks explicit opt-out mechanisms for model training and synthetic-output marking.", "highlights": [ { "label": "Biometric retention (D6.3)", "text": "For Illinois residents, we will permanently destroy their biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with Veriff, whichever occurs first." }, { "label": "No-sell for ads (D4.3)", "text": "Our 'sale,' 'sharing' and 'targeted advertising' activities do not apply to personal information that we collect in the course of providing identity verification services to our Customers." }, { "label": "Automated decision rights (D6.1)", "text": "Fully automated verification process... you will have the right to request human intervention or object to the decision made on grounds relating to your particular situation." }, { "label": "Data minimization (D3.4)", "text": "Veriff aims to delete/blur or make in other ways unreadable any data or documents presented in the session that are not necessary for Veriff's service provision." } ], "policyUrl": "https://www.veriff.com/privacy-notice", "policyLastUpdated": "2026-04-16", "modalities": [ "text", "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/veriff.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 38, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "half", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "llamaindex", "name": "LlamaIndex", "vendor": "LlamaIndex", "domain": "llamaindex.ai", "category": "Data platform", "scoreOutOf100": 20, "letterGrade": "F", "displayedGrade": "F", "confidence": "Low", "dealbreakerFlags": [ "D1.4: transferable, perpetual, irrevocable, non-exclusive, and worldwide license" ], "summary": "LlamaIndex explicitly prohibits model training on User Content and provides basic security (encryption), but lacks comprehensive data subject rights disclosures, retention detail, and sales/sharing restrictions.", "highlights": [ { "label": "No model training on User Content", "text": "We do not train any models on User Content (Terms 3.2)" }, { "label": "User Content encryption & retention", "text": "LlamaIndex will encrypt the User Content both in transit and at rest...will only retain such User Content and other data provided by you in S3 for up to 48 hours after processing (Terms 3.2)" }, { "label": "Perpetual sublicensable license to inputs", "text": "transferable, perpetual, irrevocable, non-exclusive, and worldwide license, with the right to grant and authorize sublicenses (Terms 3.2)" }, { "label": "Silent on deletion rights and data access", "text": "Privacy Notice lacks explicit right-to-know or deletion rights disclosures; deletion only mentioned as retention policy outcome" } ], "policyUrl": "https://www.llamaindex.ai/files/privacy-notice.pdf", "policyLastUpdated": "2024-03-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/llamaindex.ai.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 20, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "qdrant", "name": "Qdrant", "vendor": "Qdrant", "domain": "qdrant.tech", "category": "Data platform", "scoreOutOf100": 52, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Qdrant discloses GDPR-compliant data rights and retention controls but is silent on AI training practices, lacks comprehensive sub-processor transparency, and does not disclose AI interaction to users.", "highlights": [ { "label": "Vague recipient categories", "text": "Recipients are listed with open-ended 'for example' wording rather than a defined scope of who receives your data" }, { "label": "D1.1-D1.4 Silent on Training", "text": "Policy contains no disclosure of whether user inputs/outputs train Qdrant models, no opt-in/opt-out mechanism, no tier differences. All correctly marked zero." }, { "label": "D5.1 No AI Disclosure", "text": "Policy does not disclose to users that they interact with AI or that outputs are AI-generated. Correctly marked zero." }, { "label": "D2.1-D2.5 Rights Complete", "text": "All GDPR rights (access, deletion, portability, correction, objection) explicitly cited with Article numbers. All correctly marked full." } ], "policyUrl": "https://qdrant.tech/legal/privacy-policy/", "policyLastUpdated": "2026-07-08", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/qdrant.tech.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 52, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "bolt-new", "name": "Bolt.new", "vendor": "StackBlitz", "domain": "bolt.new", "category": "Coding", "scoreOutOf100": 36, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Bolt.new discloses AI-powered code features and deletion timelines, but lacks transparency on training data use mechanisms, retention policies, security controls, and breach procedures.", "highlights": [ { "label": "D2.2 / D3.2: Clear 30-day deletion deadline", "text": "We will delete or anonymize such data within a commercially reasonable period following account closure not to exceed thirty days" }, { "label": "D5.1 / D5.3: AI features and data categories disclosed", "text": "Bolt provides artificial intelligence–powered features...We collect account registration details, billing and payment information, communications with us, prompts, code, configuration files" }, { "label": "D4.4: Standard contractual clauses for transfers", "text": "we rely on appropriate safeguards for such transfers, such as standard contractual clauses approved by relevant authorities" }, { "label": "D7.1 / D7.2: No named security controls or breach procedures", "text": "Policy is silent on TLS, encryption, RBAC, breach notification timelines, or security certifications" } ], "policyUrl": "https://stackblitz.com/privacy-policy", "policyLastUpdated": "2026-05-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/bolt.new.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 36, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "incode", "name": "Incode", "vendor": "Incode", "domain": "incode.com", "category": "Security & compliance", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: royalty-free, perpetual, sublicensable, irrevocable, and worldwide (line 533)" ], "summary": "Incode trains biometric data on ML models with no opt-out and sells personal data with only cookie-based opt-out; retains data indefinitely per contract, but provides comprehensive GDPR-aligned user rights (access, delete, object), SOC 2 certification, and explicit AI transparency disclosures.", "highlights": [ { "label": "Training adverse", "text": "to train the AI/ML models we use in operating and improving our Services (line 95-96, biometric with no opt-out)" }, { "label": "Content sublicensable", "text": "royalty-free, perpetual, sublicensable, irrevocable, and worldwide (line 533)" }, { "label": "GDPR rights full", "text": "Access, Deletion, Portability, Correction, Objection rights disclosed (lines 215-299)" }, { "label": "Sales with opt-out", "text": "We sell and share personal data...You may opt out via Cookie preference center (lines 224-229)" } ], "policyUrl": "https://www.incode.com/privacy-policy", "policyLastUpdated": "2026-02-13", "modalities": [ "text", "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/incode.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "ramp", "name": "Ramp", "vendor": "Ramp", "domain": "ramp.com", "category": "Finance", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: royalty-free, fully-paid, irrevocable, perpetual, non-exclusive, worldwide, assignable and otherwise transferrable license" ], "summary": "Ramp discloses comprehensive privacy rights and data-sharing recipients, but lacks training-data controls, provides vague retention periods, and grants perpetual sublicensable feedback rights.", "highlights": [ { "label": "D1.4 adverse - perpetual sublicensable licence", "text": "Feedback receives \"royalty-free, fully-paid, irrevocable, perpetual, non-exclusive, worldwide, assignable and otherwise transferrable license...with unrestricted and unlimited right to grant sublicenses." }, { "label": "D2.1-D2.4 full rights - concrete", "text": "Access, deletion, correction named with concrete mechanisms; portability is \"electronic copy." }, { "label": "D3.1 ladder=0.2 - vague \"as long as necessary", "text": "\"as long as we continue to have a business or operational purpose\" , no numeric period stated." }, { "label": "D4.1 full - named recipient categories", "text": "Affiliates, Service Providers, Business Customers, Financial Institution Partners, Credit Reporting Agencies, Vendors, Analytics Providers." } ], "policyUrl": "https://ramp.com/legal/privacy-terms/privacy-terms/privacy-policy", "policyLastUpdated": "2026-05-20", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/ramp.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 42, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "NA" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "dropzone-ai", "name": "Dropzone AI", "vendor": "Dropzone", "domain": "dropzone.ai", "category": "Security & compliance", "scoreOutOf100": 66, "letterGrade": "C", "displayedGrade": "C", "confidence": "Low", "dealbreakerFlags": [], "summary": "Dropzone AI's privacy policy discloses user rights and international transfer protections but lacks disclosure of AI model training, output ownership, and product-specific data governance for its AI SOC analyst service.", "highlights": [ { "label": "Training Data", "text": "Policy contains no disclosure of whether user inputs train AI models or how outputs are handled for reuse." }, { "label": "Transparency Gap on AI", "text": "Despite providing an AI-centric SOC product, policy makes no disclosure about AI training data use, synthetic outputs, or model behavior." }, { "label": "User Rights Documented", "text": "Deletion, access, and portability rights are clearly documented with regional variations (EEA, Canada, Brazil) and named legal bases." }, { "label": "Limited Scope", "text": "Policy is a generic website notice for account and marketing data; it does not address the AI product's data flows, model training, or outputs." } ], "policyUrl": "https://www.dropzone.ai/privacy-policy", "policyLastUpdated": "2023-08-03", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/dropzone.ai.ico", "history": null, "indicators": null }, { "slug": "labelbox", "name": "Labelbox", "vendor": "Labelbox", "domain": "labelbox.com", "category": "Data platform", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: royalty-free, perpetual, sublicensable, irrevocable, and worldwide" ], "summary": "Labelbox discloses core data rights (access, deletion, correction, portability, objection) and shares categories of personal data collected, but lacks specificity on retention periods, security controls, and breach notification processes.", "highlights": [ { "label": "Output License Scope", "text": "User Submissions granted as royalty-free, perpetual, sublicensable, irrevocable, and worldwide license; Public User Submissions may remain available indefinitely even after account deletion" }, { "label": "Data Rights (D2)", "text": "Explicit disclosure of access (D2.1), deletion (D2.2), portability (D2.3), correction (D2.4), and objection rights (D2.5) all named with contact mechanism" }, { "label": "Third-Party Sharing", "text": "Comprehensive list of 20+ service providers with locations; Standard Contractual Clauses and DPF certification mentioned for international transfers" }, { "label": "Retention & Security", "text": "No named retention period disclosed; security framed only as 'industry-standard' and 'appropriate safeguards' with no specific controls (TLS, encryption, RBAC) named" } ], "policyUrl": "https://docs.labelbox.com/page/privacy-notice", "policyLastUpdated": "2025-10-03", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/labelbox.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 47, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "hex", "name": "Hex", "vendor": "Hex", "domain": "hex.tech", "category": "BI & analytics", "scoreOutOf100": 66, "letterGrade": "B", "displayedGrade": "B", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: Customer retains all rights...in and to the Customer Data...Hex...a nonexclusive, worldwide, transferable, sublicensable, irrevocable, royalty-free, fully paid-up license" ], "summary": "Hex discloses explicit no-train commitments for personal data, with opt-out rights for AI training, but retention language is vague and some sharing mechanisms lack named safeguards.", "highlights": [ { "label": "D1.1 (Training ban)", "text": "Hex does not collect, use, or sell personal information gathered through this Site for the purpose of training large language models or other artificial intelligence models." }, { "label": "D1.4 (Output ownership)", "text": "Customer retains all rights...in and to the Customer Data...Hex...a nonexclusive, worldwide, transferable, sublicensable, irrevocable, royalty-free, fully paid-up license" }, { "label": "D3.1 (Retention period)", "text": "Company will retain personal data we collect from you for so long as we have an ongoing legitimate business need to do so" }, { "label": "D5.1 (AI disclosure)", "text": "Hex does not collect, use, or sell personal information gathered through this Site for the purpose of training large language models or other artificial intelligence models" } ], "policyUrl": "https://learn.hex.tech/docs/legal/privacy", "policyLastUpdated": "2026-05-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/hex.tech.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 66, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "clio", "name": "Clio", "vendor": "Clio", "domain": "clio.com", "category": "Legal", "scoreOutOf100": 70, "letterGrade": "A", "displayedGrade": "A", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Clio's privacy policy discloses training opt-out for generalized LLMs, user-owned outputs with limited provider reuse, comprehensive GDPR-aligned rights (access, deletion, portability, correction, objection), explicit data-sharing disclosures, 90-day post-termination deletion, named security controls and breach notification, but with vague retention periods and weak synthetic-output marking.", "highlights": [ { "label": "Sublicensable content licence", "text": "Provider rights over your content are described as \"non-exclusive, worldwide, sublicensable, royalty-free,\" a broad licence that weakens your control over what you submit" }, { "label": "Strong data-subject rights", "text": "Names concrete access, deletion, portability, correction, and objection rights with mechanisms, alongside a 90-day post-termination deletion window" }, { "label": "Training opt-out, not opt-in", "text": "You can opt out of training on generalized LLMs, but the default is to train, and the opt-out is conditional rather than absolute" }, { "label": "Boilerplate encryption", "text": "Names security controls and a 72-hour breach-notification commitment, but describes data only as \"encrypted\" with no named standard such as AES-256" } ], "policyUrl": "https://www.clio.com/privacy/", "policyLastUpdated": "2026-02-11", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/clio.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 70, "grade": "A" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "full", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "socure", "name": "Socure", "vendor": "Socure", "domain": "socure.com", "category": "Security & compliance", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Socure discloses core privacy rights (access, deletion, portability, opt-out) and named data categories, with defined retention periods and security certifications, but is silent on input-training practices and reserves broad output-reuse rights.", "highlights": [ { "label": "D2 Rights (Access, Deletion, Portability, Correction, Opt-Out)", "text": "Explicit rights with timelines and named mechanisms: access, deletion (within 1 month), data portability in portable format, correction, and opt-out including Global Privacy Control (GPC) signal" }, { "label": "D4.3 No Selling or Sharing", "text": "Socure does not sell or share...any personal information (including biometric data), and has not sold or shared in the preceding 12 months" }, { "label": "D7 Security & Compliance", "text": "Named controls (encryption in transit/at rest, RBAC, data minimization), audit-confirmed, ISO 27001 and SOC 2 Type 2 certifications; named DPO (Aviad Levin-Gur)" }, { "label": "Unclear input training and output reuse", "text": "The policy does not say whether inputs train models, and although users own outputs, Socure reserves rights to reuse them to train other products beyond the service" } ], "policyUrl": "https://www.socure.com/privacy-en", "policyLastUpdated": "2026-06-19", "modalities": [ "text", "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/socure.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "half", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "half", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "nabla", "name": "Nabla", "vendor": "Nabla", "domain": "nabla.com", "category": "Healthcare", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "Medium", "dealbreakerFlags": [ "Silent on whether user inputs train AI models (D1.1)", "Silent on user ownership of outputs and reuse limits (D1.4)", "Silent on data sales or sharing for advertising purposes (D4.3)" ], "summary": "Nabla discloses core user rights and data categories but is silent on AI training data use, output ownership, data sales, and international transfer safeguards, with generic security language and no named controls.", "highlights": [ { "label": "Rights", "text": "Policy grants access, deletion, portability, correction, and objection rights with minor caveats on deletion refusal due to legal reasons." }, { "label": "Training Data", "text": "No disclosure whether inputs train Nabla models or whether users can opt out, critical gap for a healthcare AI application." }, { "label": "Retention", "text": "Policy retains data for as long as necessary with no specific timeframe, including indefinite retention for complaints or litigation concerns." }, { "label": "Security", "text": "Uses only generic secure servers and procedures language with no named encryption, standards, or certifications beyond DPO contact." } ], "policyUrl": "https://nabla.com/privacy-policy", "policyLastUpdated": "2023-05-16", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/nabla.com.ico", "history": null, "indicators": null }, { "slug": "augment-code", "name": "Augment Code", "vendor": "Augment", "domain": "augmentcode.com", "category": "Coding", "scoreOutOf100": 38, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Augment Code limits model training on user code and outputs, provides partial GDPR-aligned access/deletion/portability rights, discloses data categories and international safeguards via Standard Contractual Clauses, but lacks detail on retention periods, breach notification, and special-category restrictions.", "highlights": [ { "label": "Training prohibition", "text": "Company will not train its Models, using the Customer Code or Output" }, { "label": "User output ownership", "text": "Customer owns all right, title and interest in and to your Customer Code and the Output" }, { "label": "Data categories disclosed", "text": "Contact data, Demographic data, Account data, Communications data, Marketing data, User-generated content data, Device data, Online activity data, Payment Information, Inputs and Outputs, Feedback, Verification Data" }, { "label": "International safeguard", "text": "if we transfer your personal information outside of the United States, we shall only do so under appropriate data transfer mechanisms, such as the Standard Contractual Clauses" } ], "policyUrl": "https://www.augmentcode.com/legal/privacy-policy", "policyLastUpdated": "2025-08-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/augmentcode.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 38, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "persona", "name": "Persona", "vendor": "Persona", "domain": "withpersona.com", "category": "Security & compliance", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Persona processes identity and age verification data with explicit no-train and no-sell commitments, immediate default deletion, and DPF compliance, but lacks named security mechanisms and user input ownership guarantees.", "highlights": [ { "label": "No AI training", "text": "Persona does not use any personal data, including biometric data, for any AI or model training" }, { "label": "Immediate deletion default", "text": "Persona's default setting is to automatically delete all personal data immediately as soon as processing is complete" }, { "label": "DPF compliance", "text": "Persona complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)" }, { "label": "No sell/share", "text": "Persona does not sell or share personal data with third parties" } ], "policyUrl": "https://withpersona.com/legal/privacy-policy", "policyLastUpdated": "2026-04-09", "modalities": [ "text", "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/withpersona.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 55, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "full", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "full", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "devin", "name": "Devin", "vendor": "Cognition AI", "domain": "devin.ai", "category": "Coding", "scoreOutOf100": 70, "letterGrade": "A", "displayedGrade": "A", "confidence": "Medium", "dealbreakerFlags": [], "summary": "Devin's policy discloses explicit opt-in model training, access/portability rights, no data sales for ads, and basic security measures, but lacks concrete retention periods, breach timelines, and named security certs.", "highlights": [ { "label": "D1.1 Training opt-in", "text": "Customer Data will not be used for model training unless you opt-in , explicit, named opt-in mechanism present." }, { "label": "D3.2 Deletion discretionary", "text": "Upon termination we may at our option delete any Customer Data , provider retains discretion to delete or indefinitely retain." }, { "label": "D4.3 No data sales", "text": "We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months." }, { "label": "D7.1 Security vague", "text": "commercially reasonable technical, administrative, and organizational measures , adjective-based language, no named controls." } ], "policyUrl": "https://cognition.com/legal/privacy-policy", "policyLastUpdated": "2026-03-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/devin.ai.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 70, "grade": "A" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "ADVERSE" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "cleerly", "name": "Cleerly", "vendor": "Cleerly", "domain": "cleerlyhealth.com", "category": "Healthcare", "scoreOutOf100": 26, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Cleerly discloses data categories, some consumer rights (for state residents), basic retention practices, recipient categories, and children protections, with limited security and no training model transparency.", "highlights": [ { "label": "Data categories disclosed", "text": "Identifiers, Demographics, Internet activity, Geolocation, Health info, Professional info, Inferences" }, { "label": "Recipients named", "text": "Service providers, corporate affiliates, law enforcement, regulators for legal/regulatory compliance" }, { "label": "Children age protection", "text": "Services not intended for children under 16; will delete if collected without parental consent" }, { "label": "Training data silence", "text": "No disclosure of whether inputs/conversations train models; only vague reference to research and development" } ], "policyUrl": "https://cleerlyhealth.com/privacy-policy", "policyLastUpdated": "2025-06-10", "modalities": [ "text", "image" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cleerlyhealth.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 26, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "half", "subFlag": "OK" }, "D2.5": { "award": "half", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "arize", "name": "Arize AI", "vendor": "Arize", "domain": "arize.com", "category": "Data platform", "scoreOutOf100": 20, "letterGrade": "F", "displayedGrade": "F", "confidence": "Low", "dealbreakerFlags": [], "summary": "Arize AI's public privacy policy and terms grant the company broad rights to use customer data for service improvement with de-identified data ownership to Arize, limited user data access and deletion rights, sharing for marketing without explicit opt-out, and boilerplate security claims.", "highlights": [ { "label": "Data Rights Asymmetry", "text": "Customer owns personal inputs but Arize owns all de-identified, aggregated, anonymized data derived from customer usage. Arize retains nonexclusive worldwide rights to use customer data for service improvement." }, { "label": "No Training Opt-Out Named", "text": "Policy is SILENT on opt-in/opt-out mechanism for using customer data in model training. No mechanism disclosed." }, { "label": "Sharing for Marketing , No Opt-Out", "text": "Policy states 'We share aggregate, anonymized, or de-identified information about users with third parties for marketing, advertising, research' without disclosing an explicit opt-out mechanism." }, { "label": "Security: Boilerplate Only", "text": "Policy states 'reasonable precautions' but names no controls (no TLS, AES-256, RBAC, ISO27001, SOC2). No named certifications or DPO contact." } ], "policyUrl": "https://arize.com/privacy-policy/", "policyLastUpdated": "2020-02-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/arize.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 20, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "half", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "half", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "half", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "zero", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "brex", "name": "Brex", "vendor": "Brex", "domain": "brex.com", "category": "Finance", "scoreOutOf100": 13, "letterGrade": "F", "displayedGrade": "F", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: You grant Brex a worldwide, irrevocable license to use, modify, distribute, copy, and create derivative works from Company Data" ], "summary": "Brex discloses enumerated data categories and recipient types with some marketing opt-out rights, but lacks training-data controls, user rights, and specific security/breach standards.", "highlights": [ { "label": "Adverse licensing", "text": "Brex grants itself worldwide, irrevocable license to use, modify, distribute, copy, and create derivative works from Company Data (D1.4)" }, { "label": "Data categories disclosed", "text": "Comprehensive enumeration of 14+ data categories including transaction data, travel data, and device information (D5.3)" }, { "label": "Marketing opt-out", "text": "Users can opt out of data sharing/selling for marketing purposes (D4.3)" }, { "label": "No user rights", "text": "Silent on access, deletion, portability, and correction rights (D2.1-D2.5)" } ], "policyUrl": "https://www.brex.com/legal/privacy", "policyLastUpdated": "2026-04-07", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/brex.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 13, "grade": "F" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "zero", "subFlag": "OK" }, "D2.2": { "award": "zero", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "zero", "subFlag": "OK" }, "D2.5": { "award": "zero", "subFlag": "OK" }, "D3.1": { "award": "zero", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "zero", "subFlag": "NA" }, "D4.5": { "award": "zero", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "zero", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "half", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "multion", "name": "MultiOn", "vendor": "The AGI Company", "domain": "multion.ai", "category": "Automation", "scoreOutOf100": 52, "letterGrade": "C", "displayedGrade": "C", "confidence": "Medium", "dealbreakerFlags": [ "D1.4: Beta User hereby grants Company a non-exclusive, perpetual, irrevocable, worldwide license to display, modify, distribute, perform and reproduce such Beta User Content" ], "summary": "MultiOn claims user data is not trained on, and provides GDPR/CCPA rights, but reserves perpetual irrevocable license to user content with broad reuse rights, lacks named security certifications, and provides minimal data retention specificity.", "highlights": [ { "label": "D1.4 ADVERSE , Perpetual user content licence", "text": "Terms grant Company 'perpetual, irrevocable, worldwide license to display, modify, distribute, perform and reproduce' user content with no limitation to service provision only" }, { "label": "Boilerplate security", "text": "Cites 'industry-standard' measures such as access controls and audit logging but names no specific mechanism such as encryption" }, { "label": "No certifications or DPO", "text": "Provides only a contact email, naming no recognised certification such as ISO 27001 or SOC 2 and no data protection officer" } ], "policyUrl": "https://www.theagi.company/privacy", "policyLastUpdated": "2025-10-05", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/multion.ai.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 52, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "half", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "zero", "subFlag": "OK" } } }, { "slug": "darktrace", "name": "Darktrace", "vendor": "Darktrace", "domain": "darktrace.com", "category": "Security & compliance", "scoreOutOf100": 47, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.1: If you choose to use the conversational AI tool, Olivia, you cannot opt out of this AI processing" ], "summary": "Darktrace discloses explicit opt-out limitations for AI training, basic rights infrastructure, and transfer safeguards, but lacks detailed retention periods, data minimization commitments, and specific security controls.", "highlights": [ { "label": "AI Training No-Opt-Out (Adverse)", "text": "For the conversational AI tool Olivia, data is used for model training with no opt-out available, though alternative non-AI methods are offered upon request." }, { "label": "Conditional Deletion Right", "text": "Users can request erasure only if there is no longer justification for data retention, representing a conditional rather than unconditional deletion right." }, { "label": "Strong Rights Disclosure", "text": "Policy clearly discloses access, correction, objection, and opt-out rights with named contact mechanisms (privacy@darktrace.com)." }, { "label": "Data Transfer Safeguards", "text": "Transfers are protected via EU Standard Contractual Clauses and transfer impact assessments for EU/UK data." } ], "policyUrl": "https://www.darktrace.com/legal/privacy-policy", "policyLastUpdated": "2026-05-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/darktrace.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 47, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "ADVERSE" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "half", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "full", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "zero", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "tempus", "name": "Tempus", "vendor": "Tempus AI", "domain": "tempus.com", "category": "Healthcare", "scoreOutOf100": 45, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Tempus discloses consumer privacy rights and retention principles, but lacks model training transparency, AI interaction disclosure, and named security certifications.", "highlights": [ { "label": "Strong rights framework", "text": "Named access, deletion, portability, correction, and opt-out mechanisms for data sales (D2.1-D2.5)" }, { "label": "Data categories enumerated", "text": "Comprehensive list including identifiers, payment, professional, education, and internet activity information (D5.3)" }, { "label": "Secure transfers named", "text": "Implements Standard Contractual Clauses and UK Addendum for international transfers (D4.4)" }, { "label": "Silent on model training and AI", "text": "No disclosure of whether user inputs train models or whether service interactions involve AI systems (D1.1-D1.4, D5.1)" } ], "policyUrl": "https://www.tempus.com/privacy-policy/", "policyLastUpdated": "2024-05-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/tempus.com.ico", "history": { "firstAssessed": "2026-06-21", "lastChanged": "2026-06-21", "lastChecked": "2026-06-21", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-06-21", "score": 45, "grade": "D" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "OK" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "full", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "half", "subFlag": "OK" } } }, { "slug": "crewai", "name": "crewAI", "vendor": "crewAI Inc.", "domain": "crewai.com", "category": "Automation", "audience": "Enterprise", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.1: including by training and developing models and/or algorithms" ], "summary": "CrewAI's policy permits training on user inputs with no opt-out mechanism, explicitly handles Google data with a no-sell pledge, provides 30-day retention for deleted data with encrypted backup exception to 180 days, and discloses AI integration and data categories but lacks versioning, consent tier detail, and breach notification timeliness.", "highlights": [ { "label": "Trains on your inputs", "text": "Your inputs may be used to train and develop models with no opt-out offered anywhere in the terms" }, { "label": "Output reuse rights", "text": "CrewAI retains broad rights to use your outputs for training and derivative works" }, { "label": "Deletion timeline", "text": "Deleted data is removed or irreversibly anonymized within 30 days, though copies may persist in encrypted backups for up to 180 days" }, { "label": "No sale of Google data", "text": "The policy commits that it never sells Google user data, though this pledge is limited to Google data only" } ], "policyUrl": "https://crewai.com/privacy-policy", "policyLastUpdated": "2025-09-24", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/crewai.com.ico", "history": null, "indicators": null }, { "slug": "relevance-ai", "name": "Relevance AI", "vendor": "Relevance AI Pty", "domain": "relevanceai.com", "category": "Automation", "audience": "Enterprise", "scoreOutOf100": 48, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [ "D1.4: irrevocable licence to use Client Data to the extent reasonably required to provide the Solution and to improve the Solution" ], "summary": "Relevance AI discloses limited privacy controls and retains personal data indefinitely for service provision and marketing; data licensing is irrevocable and broad without user reuse restrictions, creating risk of perpetual commercial reuse absent explicit \"sells no opt-out\" language.", "highlights": [ { "label": "Broad data license", "text": "The provider takes an irrevocable license to use your data to provide and improve the service, with no limit on reuse" }, { "label": "Full data rights", "text": "You can request to access, transfer, correct, or delete your personal data at any time" }, { "label": "Indefinite retention", "text": "Personal information is kept for as long as necessary to provide the service or for marketing purposes, with no fixed period" }, { "label": "Marketing data sharing", "text": "Device, browsing, and usage information may be disclosed to third-party marketing and data analytics providers" } ], "policyUrl": "https://relevanceai.com/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/relevanceai.com.ico", "history": null, "indicators": null }, { "slug": "freed", "name": "Freed", "vendor": "Freed Inc.", "domain": "getfreed.ai", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: You hereby grant Freed a non-exclusive, worldwide, fully paid-up, royalty-free right and license, with the right to grant sublicenses, to reproduce, execute, use, store, archive, modify, perform, display and distribute Your Data... train the AI/ML models" ], "summary": "Freed discloses optional model training opt-out, 30-day auto-deletion, user data ownership with sublicensable provider rights, basic deletion/portability/correction rights, HIPAA BAA obligations, and biometric consent governance, but lacks specifics on synthetic-output marking, detailed ADM transparency, and international-transfer safeguards.", "highlights": [ { "label": "Training Opt-Out", "text": "Inputs may train models with opt-out via account settings; feedback and safety-flagged content always used for training regardless of opt-out." }, { "label": "30-Day Auto-Deletion", "text": "Users can select 30-day auto-deletion of data from platform, then 7-day backup retention before permanent deletion." }, { "label": "User Ownership + Sublicensing Risk", "text": "User owns outputs and data, but grants Freed non-exclusive, sublicensable worldwide rights to use data for service improvement and model training (conditional on settings consent)." }, { "label": "Data Portability & Children", "text": "30-day post-termination data export available; children <18 require parental consent; biometric voice ID requires opt-in consent." } ], "policyUrl": "https://getfreed.ai/privacy-policy", "policyLastUpdated": "2025-12-05", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/getfreed.ai.ico", "history": null, "indicators": null }, { "slug": "numeric", "name": "Numeric", "vendor": "Numeric Inc.", "domain": "numeric.io", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 32, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Numeric discloses data rights and AI features but lacks training transparency, concrete retention limits, or explicit output ownership terms.", "highlights": [ { "label": "Data Rights", "text": "Access, deletion, portability, correction, and objection mechanisms provided via email contact" }, { "label": "AI Disclosure", "text": "Platform includes generative AI features but scope vaguely defined as certain portions" }, { "label": "Retention", "text": "Policy uses vague as-necessary language with no concrete timelines or minimization commitments" }, { "label": "Training Silence", "text": "No disclosure of whether inputs train models, opt-out mechanisms, or data use tiers" } ], "policyUrl": "https://numeric.io/legal/privacy-policy", "policyLastUpdated": "2025-09-23", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/numeric.io.ico", "history": null, "indicators": null }, { "slug": "basis", "name": "Basis", "vendor": "Basis Software Inc.", "domain": "basis.ai", "category": "Finance", "audience": "Enterprise", "scoreOutOf100": 28, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Basis discloses conditional user rights based on location, enumerated data collection categories, and a data retention principle of \"as long as needed\" without numeric periods, but lacks specificity on model training, data minimization, breach notification, security certifications, and cross-border transfer safeguards.", "highlights": [ { "label": "User Rights (conditional)", "text": "Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information." }, { "label": "Data Categories", "text": "Account and profile data (for example, name, email, organization); Usage and log data (for example, request metadata, timestamps, error logs); Integration metadata (for example, connected provider, scopes/permissions granted); Content and data you submit or authorize through the Services; Communications with us" }, { "label": "No personal data sales", "text": "We do not sell personal information." }, { "label": "Sharing recipients", "text": "We may share information with: Service providers that help us run the Services (for example, hosting, logging, or infrastructure vendors); Integration providers you explicitly authorize; Professional advisers and auditors; Regulators, law enforcement, or courts where required by law; Successors in connection with a merger, acquisition, or asset transfer." } ], "policyUrl": "https://basis.ai/privacy-policy", "policyLastUpdated": "2026-03-04", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/basis.ai.ico", "history": null, "indicators": null }, { "slug": "hightouch", "name": "Hightouch", "vendor": "Hightouch Inc.", "domain": "hightouch.com", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Hightouch discloses basic data access/correction/deletion rights, EU data transfer safeguards, and recipient categories, but silent on training-data opt-out, breach timelines, and automated-decision protections.", "highlights": [ { "label": "Data Subject Rights (D2)", "text": "Comprehensive rights to access, delete, correct, and object to processing. Portability in machine-readable format promised but deletion is conditional." }, { "label": "International Transfers (D4.4)", "text": "Named safeguards: EU adequacy decisions, contractual protections, and EU-U.S. Data Privacy Framework certification." }, { "label": "Recipient Categories (D4.1)", "text": "Transparent disclosure of eight recipient categories including affiliates, service providers, advertising partners, and authorities." }, { "label": "Silent on Training & AI (D1, D5.1)", "text": "No disclosure of whether user inputs train models, no opt-out mechanism named, no disclosure of AI interaction points beyond reference to separate AI Addendum." } ], "policyUrl": "https://hightouch.com/privacy-policy", "policyLastUpdated": "2026-04-20", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/hightouch.com.ico", "history": null, "indicators": null }, { "slug": "omni", "name": "Omni", "vendor": "Omni Software Inc.", "domain": "omni.co", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Omni's global privacy policy discloses access, correction, and portability rights; shares data for ads without opt-out; and applies standard contractual clauses for international transfers.", "highlights": [ { "label": "Access and portability", "text": "You can obtain a copy of your data, request correction, and receive it in a structured machine-readable format" }, { "label": "Ad sharing without opt-out", "text": "Personal information may be shared with third-party advertising partners for personalized ads, with no opt-out described" }, { "label": "Vague retention", "text": "Data is kept as long as you use the service or as needed to fulfill its purpose, with no concrete period" }, { "label": "International transfer safeguards", "text": "Cross-border transfers are supported by EU Standard Contractual Clauses" } ], "policyUrl": "https://omni.co/privacy", "policyLastUpdated": "2025-08-14", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/omni.co.ico", "history": null, "indicators": null }, { "slug": "julius-ai", "name": "Julius AI", "vendor": "Caesar Labs Inc.", "domain": "julius.ai", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Julius AI explicitly discloses no-train for personal data, offers 7-day deletion, no sale for ads, and age-gates at 18, but retention is vague and security claims are boilerplate.", "highlights": [ { "label": "No training on your data", "text": "The policy states it does not use your personal information to train its AI models" }, { "label": "Fast deletion", "text": "After you cancel and request deletion, your information is deleted within seven business days" }, { "label": "No selling for marketing", "text": "Personal information is not shared or disclosed to third parties for their own direct marketing purposes" }, { "label": "Boilerplate security", "text": "Security is described only as industry-standard technologies and procedures with no named controls" } ], "policyUrl": "https://julius.ai/privacy-policy", "policyLastUpdated": "2025-09-23", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/julius.ai.ico", "history": null, "indicators": null }, { "slug": "nametag", "name": "Nametag", "vendor": "Nametag Inc.", "domain": "getnametag.com", "category": "Security & compliance", "audience": "Enterprise", "scoreOutOf100": 38, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Nametag discloses strong biometric consent controls and data deletion rights, but lacks concrete training-data opt-out mechanisms and several transparency specifics like synthetic output marking and data portability.", "highlights": [ { "label": "Strong training-data vagueness on D1.1", "text": "Policy claims anonymization and non-identifiable training but uses only adjectives ('strong focus', 'ensuring') without naming the opt-out or opt-in mechanism that triggers this protection." }, { "label": "Explicit no-sell clause (D4.3)", "text": "'We do not sell your information nor will we ever do so' is an unambiguous, perpetual commitment." }, { "label": "Concrete 3-year retention with number (D3.1)", "text": "'within three (3) years of your last interaction with us, whichever occurs first' provides a named, specific retention period." }, { "label": "Biometric & children protections (D6.3, D6.4)", "text": "Explicit consent withdrawal for biometrics and 16+ age gate with no child data selling are clearly stated." } ], "policyUrl": "https://getnametag.com/privacy", "policyLastUpdated": "2025-04-01", "modalities": [ "text", "image" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/getnametag.com.ico", "history": null, "indicators": null }, { "slug": "snyk", "name": "Snyk", "vendor": "Snyk Ltd.", "domain": "snyk.io", "category": "Security & compliance", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Snyk explicitly prohibits training inputs on AI models and discloses AI use, but retains broad data retention policies and offers limited transparency on international transfers beyond standard contractual clauses.", "highlights": [ { "label": "Training prohibition", "text": "Snyk will not use (or permit any of its Affiliates, sub-processors, or other third parties to use) any Inputs to train, enhance or improve any AI Models incorporated within the Services" }, { "label": "Vague retention", "text": "for as long as reasonably necessary to fulfill the purposes for which we collected (no concrete period)" }, { "label": "Sells personal data for ads", "text": "We may share or sell your personal information for third-party advertising purposes (with opt-out via cookie manager or privacy@snyk.io)" }, { "label": "Breach notice timeframe", "text": "within 72 hours, notify you of the Security Incident" } ], "policyUrl": "https://snyk.io/privacy", "policyLastUpdated": "2026-03-09", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/snyk.io.ico", "history": null, "indicators": null }, { "slug": "cyera", "name": "Cyera", "vendor": "Cyera Inc.", "domain": "cyera.com", "category": "Security & compliance", "audience": "Enterprise", "scoreOutOf100": 51, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Cyera discloses GDPR-compliant data rights and retention policies with opt-out controls for data sharing, but lacks transparency on AI training practices and relies on vague retention timelines.", "highlights": [ { "label": "Rights disclosure", "text": "Full rights enumeration: access, deletion, correction, portability, objection to automated decision-making with named opt-out mechanism (Cookie icon)" }, { "label": "Data transfer safeguards", "text": "Named mechanisms for international transfers: Standard Contractual Clauses, EU Adequacy Decisions, EU-U.S. Data Privacy Framework (DPF) certification" }, { "label": "Gap: Retention vagueness", "text": "Retention defined as 'as long as we need' for 'legitimate business purposes' without numeric period, though internal policy promised" }, { "label": "Gap: No AI training disclosure", "text": "No disclosure of whether user data/inputs train Cyera's AI models; silence on model training or synthetic output marking" } ], "policyUrl": "https://cyera.com/privacy", "policyLastUpdated": "2026-02-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/cyera.com.ico", "history": null, "indicators": null }, { "slug": "intercom-fin", "name": "Intercom Fin", "vendor": "Intercom Inc.", "domain": "intercom.com", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 37, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [ "D1.4: Customer will retain all of Customer's Intellectual Property Rights in and to the Customer Data; Intercom granted a perpetual, non-exclusive, transferable, irrevocable, worldwide, royalty-free license to Feedback" ], "summary": "Intercom Fin's privacy disclosures are heavily regionalized, with meaningful rights (access, deletion, portability) only for EEA/UK residents; global US-default users lack deletion rights, have vague retention (\"as long as necessary\"), and face perpetual sublicensable Feedback licensing.", "highlights": [ { "label": "Perpetual feedback license", "text": "Feedback you provide is licensed to Intercom on a perpetual, irrevocable, worldwide, sublicensable basis" }, { "label": "Rights limited by region", "text": "Access, deletion, and correction rights are described only for EEA and UK residents, leaving others without them" }, { "label": "Vague retention", "text": "Personal data is kept only as long as necessary to fulfill stated purposes, with no fixed period" }, { "label": "Boilerplate security", "text": "Commits only to commercially reasonable technical and organizational measures with no named standard" } ], "policyUrl": "https://intercom.com/privacy", "policyLastUpdated": "2026-04-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/intercom.com.ico", "history": null, "indicators": null }, { "slug": "cresta", "name": "Cresta", "vendor": "Cresta Intelligence Inc.", "domain": "cresta.com", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 31, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Cresta discloses standard data rights (access conditional, deletion with exceptions, correction unspecified), enumerated data categories, and international transfer safeguards via standard-form contracts, but lacks named AI training disclosures, breach notification procedures, and specific security controls beyond generic boilerplate.", "highlights": [ { "label": "Data categories", "text": "Policy exhaustively enumerates 12 data categories (A-L) with YES/NO collection indicators, supporting full award for D5.3" }, { "label": "Conditional access right", "text": "States users 'may have the right' to access data and that 'these rights are not absolute,' making access conditional rather than guaranteed" }, { "label": "No AI training disclosure", "text": "Policy is silent on whether user inputs train AI models, no mechanism named, contradicting prior 'half' award for D5.1 which requires explicit AI disclosure" }, { "label": "Safeguards for transfers", "text": "Policy names 'standard-form contracts approved by the relevant authorities' for international transfers, supporting full award for D4.4" } ], "policyUrl": "https://cresta.com/privacy-policy", "policyLastUpdated": "2025-11-27", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/cresta.com.ico", "history": null, "indicators": null }, { "slug": "regie-ai", "name": "Regie.ai", "vendor": "Regie Inc.", "domain": "regie.ai", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Regie.ai explicitly prohibits training on user data obtained through Google Workspace APIs and discloses access, deletion, portability, and correction rights; retains data indefinitely for fraud prevention and legal compliance; shares data with named vendor categories and offers opt-out from targeted advertising; lists security controls including encryption and MFA with breach notification timeline; and has an EU GDPR representative named.", "highlights": [ { "label": "No-train commitment", "text": "Regie.ai does not use any data, including data obtained through Google Workspace APIs, to train generalized AI or machine learning models" }, { "label": "Deletion rights (conditional)", "text": "Request deletion: Request removal of your data where applicable" }, { "label": "Security controls named", "text": "Encryption: Your data is encrypted both in transit and at rest using industry-standard encryption protocols. Access Controls: Only authorized personnel with a legitimate business need have access to your data, protected by role-based permissions. Multi-Factor Authentication (MFA): Required for internal administrative accounts" }, { "label": "Breach notification", "text": "In the event of a data breach impacting your personal information, Regie.ai will notify affected users within the legally required timeframe, following applicable data protection laws" } ], "policyUrl": "https://www.regie.ai/privacy-policy", "policyLastUpdated": "2025-03-06", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/regie.ai.ico", "history": null, "indicators": null }, { "slug": "11x", "name": "11x", "vendor": "11x Inc.", "domain": "11x.ai", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 38, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "11x restricts AI training on customer data and Google Workspace API data, secures data with database encryption and SSL, but offers limited transparency on data rights and retention periods.", "highlights": [ { "label": "No training on customer data", "text": "Notwithstanding anything to the contrary in this Agreement, 11x shall not use any Customer Data to train any artificial intelligence or machine learning models." }, { "label": "No Google Workspace data for generalized AI", "text": "We affirm that 11x does not use data obtained through Google Workspace APIs (including Gmail) to develop, improve, or train any generalized or non-personalized AI or ML models." }, { "label": "Customer data ownership", "text": "Customer exclusively owns all right, title and interest in and to the Customer Data and Performance Data. 11x shall acquire no rights in or to the Customer Data." }, { "label": "Encryption safeguards", "text": "All the Personal Information we have where 11x acts as a processor for a customer's data is encrypted via database encryption. All connections to our Website or Services are protected via the use of encrypted connections, such as the Secure Socket Layer (SSL) protocol." } ], "policyUrl": "https://11x.ai/privacy", "policyLastUpdated": "2025-09-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/11x.ai.ico", "history": null, "indicators": null }, { "slug": "common-room", "name": "Common Room", "vendor": "Common Room PBC", "domain": "commonroom.io", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 35, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Common Room discloses basic access, deletion, and portability rights with conditions, but lacks mechanisms for opting out of training-data use, lacks named retention periods or security certifications, and does not explicitly commit to avoiding sensitive-data collection categories.", "highlights": [ { "label": "Access & Rights", "text": "In accordance with applicable law, you may...obtain access to or a copy of your personal information...request erasure...receive an electronic copy...seek correction or amendment...object to or restrict our uses" }, { "label": "No-Sell Commitment", "text": "For purposes of the CCPA, Common Room does not 'sell' personal information, nor do we have actual knowledge of any 'sale' of personal information of minors under 16 years of age" }, { "label": "Data Categories Enumerated", "text": "The categories of personal information we collect include: email address, phone number, mailing address, IP address, device type, browser information, MAC address, cookie identifiers, location information, usage data, Analytics, Cookies, Pixel Tags, information from conferences, job applications, business development, professional or employment-related information" }, { "label": "Children Protections", "text": "The Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If we learn that we have collected a child's personal information in violation of applicable law, we will promptly take steps to delete such information" } ], "policyUrl": "https://commonroom.io/privacy-policy", "policyLastUpdated": "2021-03-30", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/commonroom.io.ico", "history": null, "indicators": null }, { "slug": "circleback", "name": "Circleback", "vendor": "Circleback Inc.", "domain": "circleback.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 50, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Circleback discloses basic data rights and sharing practices for its meeting automation service, with limited transparency on model training, data retention granularity, and security controls.", "highlights": [ { "label": "User content ownership", "text": "You own all right, title, and interest in your submissions, with no implied licenses granted" }, { "label": "Deletion on request", "text": "You can request deletion through your account, and user information is deleted within 30 days of termination" }, { "label": "Training use is silent", "text": "The policy says nothing about whether your inputs or outputs are used to train models" }, { "label": "No named security controls", "text": "Security is described only as appropriate measures with no named mechanisms such as encryption standards" } ], "policyUrl": "https://circleback.ai/privacy", "policyLastUpdated": "2024-07-15", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/circleback.ai.ico", "history": null, "indicators": null }, { "slug": "dust", "name": "Dust", "vendor": "Dust PBC", "domain": "dust.tt", "category": "Enterprise copilot", "audience": "Enterprise", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Dust discloses data access, deletion, portability, and correction rights as bare commitments without concrete mechanisms, names sharing recipients and DPA contact, restricts model training via third-party providers and prohibits internal ads/marketing use, but lacks dated versioning, breach notice timeframes, and AI-interaction transparency.", "highlights": [ { "label": "No ads or marketing reuse", "text": "The policy states your data will not be used for any other purpose like advertising or marketing" }, { "label": "Named retention period", "text": "Data is kept for the agreement duration and then archived for five years" }, { "label": "Concrete security controls", "text": "Data is stored in an encrypted database on Google Cloud with user-specific logins and access rights" }, { "label": "No effective date", "text": "The policy points to an effective date at the top of the page but shows no actual date or change history" } ], "policyUrl": "https://dust.tt/home/platform-privacy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/dust.tt.ico", "history": null, "indicators": null }, { "slug": "mem", "name": "Mem", "vendor": "Mem Labs Inc.", "domain": "mem.ai", "category": "Productivity", "audience": "Enterprise", "scoreOutOf100": 40, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Mem discloses strong no-train pledges and basic access/deletion rights, but lacks versioned change notices and fully explicit output ownership terms.", "highlights": [ { "label": "No generalized AI training", "text": "We do not use your personal information, notes, or the information we collect via third parties (e.g. Google Workspace APIs) to develop, improve, or train any generalized AI and/or ML models" }, { "label": "Transparent sub-processor list", "text": "For a current list of subprocessors, including their purpose and data location, please visit our Trust Center at trust.mem.ai" }, { "label": "Named security controls", "text": "We encrypt all user content in transit and at rest. Mem is SOC 2 Type II compliant. 128-bit TLS encryption" }, { "label": "Input ownership retained", "text": "As between you and Anthropic, and to the extent permitted by applicable law, you retain any right, title, and interest that you have in the Inputs you submit" } ], "policyUrl": "https://get.mem.ai/privacy-policy", "policyLastUpdated": "2026-03-24", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/mem.ai.ico", "history": null, "indicators": null }, { "slug": "heidi-health", "name": "Heidi Health", "vendor": "Heidi Health Pty", "domain": "heidihealth.com", "category": "Healthcare", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Heidi Health discloses opt-out data training only for de-identified queries, grants core user rights with 30-day response promise, but lacks named retention periods and automated decision-making governance.", "highlights": [ { "label": "Training-data governance", "text": "PHI will not be used for model training; queries may be reviewed in de-identified form only" }, { "label": "User rights enforcement", "text": "Access, deletion, correction, data portability, and object-to-processing requests answered within 30 days" }, { "label": "Health data protection", "text": "Unless permitted or required by law, health information not used without explicit consent; no marketing without consent" }, { "label": "Security implementation", "text": "Robust encryption, multi-layered encryption, stringent access controls, continuous threat monitoring named" } ], "policyUrl": "https://www.heidihealth.com/en-us/legal/privacy-policy", "policyLastUpdated": "2024-10-01", "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/heidihealth.com.ico", "history": null, "indicators": null }, { "slug": "outreach", "name": "Outreach", "vendor": "Outreach Corporation", "domain": "outreach.io", "category": "Sales & marketing", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Outreach discloses limited but reasonable baseline privacy controls, with strong rights to access and portability, but insufficient transparency on AI training and retention policies, relying heavily on vague standards like \"as necessary.", "highlights": [ { "label": "Strong data rights", "text": "Access, portability, correction, and marketing opt-out are all explicitly named and available" }, { "label": "Sells data with opt-out", "text": "It discloses CCPA sales of identifiers, network activity, and inferences, but you can opt out via a form" }, { "label": "Named security controls", "text": "Commits to encryption of data in transit and at rest, SSO integration, and regular security reviews" }, { "label": "Vague retention", "text": "Data is kept as long as reasonably necessary to fulfill stated purposes, with no concrete timeframe" } ], "policyUrl": "https://www.outreach.ai/privacy-statement", "policyLastUpdated": "2026-02-17", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/outreach.io.ico", "history": null, "indicators": null }, { "slug": "abacus-ai", "name": "Abacus.AI", "vendor": "Abacus.AI Inc.", "domain": "abacus.ai", "category": "Model provider", "audience": "Enterprise", "scoreOutOf100": 51, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Abacus.AI explicitly prohibits training inputs on its models and maintains zero-retention agreements with third-party AI services, with clear rights to data access, portability, and correction, though post-termination retention uses vague timelines and lacks international transfer safeguards.", "highlights": [ { "label": "No-train commitment", "text": "We do not use any personal information, Google user data, or customer-provided content (including prompts, uploads, or API data) to develop, improve, or train any generalized or proprietary AI or ML models." }, { "label": "Zero third-party AI retention", "text": "Abacus.AI maintains a zero data retention agreement with all foundation and third-party AI models integrated into our product. Any data exchanged with such models occurs only for real-time inference and is never stored, logged, or reused by the model provider for training or product improvement." }, { "label": "Data rights", "text": "You have a right to request us to provide you with a copy of your personal data in electronic format... You have a right to request us to amend or update your personal data if it is inaccurate or incomplete." }, { "label": "Age gating", "text": "If you are under 18, you may use the Site and Services only with the supervision of your parent or guardian. The Services are not directed to anyone under the age of 16." } ], "policyUrl": "https://abacus.ai/privacy-policy", "policyLastUpdated": null, "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/abacus.ai.ico", "history": null, "indicators": null }, { "slug": "tonic-ai", "name": "Tonic.ai", "vendor": "Tonic.ai Inc.", "domain": "tonic.ai", "category": "Data platform", "audience": "Enterprise", "scoreOutOf100": 27, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Tonic.ai discloses moderate protections for data handling, with explicit non-selling commitments and clear age gates, but lacks named technical controls and comprehensive opt-out mechanisms for training data usage.", "highlights": [ { "label": "No sales commitment", "text": "Tonic does not sell your personal information to any third party for monetary consideration" }, { "label": "Age gate", "text": "Tonic Services are not directed to children under 13; minimum age 18" }, { "label": "Vague training data use", "text": "Tonic may use that data to improve its systems, products, and services (no named opt-out mechanism)" }, { "label": "Generic security language", "text": "measures designed to protect your personal information (no named technical standards, TLS, or encryption algorithms disclosed)" } ], "policyUrl": "https://docs.tonic.ai/trust-center/privacy-notice", "policyLastUpdated": "2026-02-05", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/tonic.ai.ico", "history": null, "indicators": null }, { "slug": "together-ai", "name": "Together AI", "vendor": "Together Computer Inc.", "domain": "together.ai", "category": "Model provider", "audience": "Enterprise", "scoreOutOf100": 51, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Together AI discloses explicit opt-in consent for model training, user data ownership with provider reuse rights, zero-data-retention mode with instant deletion, limited recipient categories, and a named privacy contact, but is silent on data access, portability, correction, subprocessors, breach notification, and automated decisions.", "highlights": [ { "label": "Opt-in training only", "text": "Your data is not used to train models without your explicit opt-in consent, which you can revoke at any time" }, { "label": "Zero-data-retention mode", "text": "Under ZDR, submitted content is removed from systems as soon as processing concludes" }, { "label": "No sale of data", "text": "The policy states the company does not sell your information" }, { "label": "Boilerplate security", "text": "Commits only to a security program in accordance with industry standards with no named controls" } ], "policyUrl": "https://www.together.ai/privacy", "policyLastUpdated": "2025-12-17", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/together.ai.ico", "history": null, "indicators": null }, { "slug": "amplitude", "name": "Amplitude", "vendor": "Amplitude Inc.", "domain": "amplitude.com", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 42, "letterGrade": "D", "displayedGrade": "D", "confidence": "High", "dealbreakerFlags": [], "summary": "Amplitude discloses limited data rights (access, deletion, portability) via email requests, vague retention (\"as long as necessary\"), and shares personal data with ad partners with opt-out available; it names international transfer safeguards (SCCs and three DPF frameworks) and data security controls, but lacks AI transparency, concrete breach timelines, or certification disclosures.", "highlights": [ { "label": "Ad sharing with opt-out", "text": "Personal data may be shared with third-party ad partners via cookies or email lists, with opt-out in cookie settings" }, { "label": "International transfer safeguards", "text": "Cross-border transfers use Standard Contractual Clauses and the EU, UK, and Swiss Data Privacy Frameworks" }, { "label": "Vague retention", "text": "Data is kept no longer than necessary for the stated purpose, with no concrete period" }, { "label": "Data rights by email", "text": "Access, correction, deletion, and portability are available but routed through email requests rather than self-service" } ], "policyUrl": "https://www.amplitude.com/privacy", "policyLastUpdated": "2026-06-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/amplitude.com.ico", "history": null, "indicators": null }, { "slug": "observe-ai", "name": "Observe.AI", "vendor": "Observe.AI Inc.", "domain": "observe.ai", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 17, "letterGrade": "F", "displayedGrade": "F", "confidence": "High", "dealbreakerFlags": [], "summary": "Observe.AI discloses basic data rights (access, deletion, objection contact) and limited retention guidance, but lacks concrete opt-out mechanisms, security details, and transparent data governance practices in its global privacy policy.", "highlights": [ { "label": "Data retention vague", "text": "We retain your personal information for as long as necessary to provide the services you have requested" }, { "label": "Rights by contact only", "text": "Right to Access / Right to erase - Contact our Privacy team at privacy@observe.ai" }, { "label": "Marketing data sharing undisclosed opt-out", "text": "Promotional and Marketing agency to send promotional emails to our customers and prospective customers" }, { "label": "No security controls named", "text": "Observe.AI has implemented reasonable physical, technical and administrative security measures" } ], "policyUrl": "https://www.observe.ai/privacy-policy", "policyLastUpdated": null, "modalities": [ "text", "audio" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/observe.ai.ico", "history": null, "indicators": null }, { "slug": "fireworks-ai", "name": "Fireworks AI", "vendor": "Fireworks AI Inc.", "domain": "fireworks.ai", "category": "Model provider", "audience": "Enterprise", "scoreOutOf100": 68, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Fireworks AI explicitly commits to no-train-without-opt-in for user inputs and zero-retention for open model logs, offers full GDPR rights including deletion within 30 days and data portability, does not sell personal information, uses standard contractual clauses for international transfers, and appoints a GDPR representative; however, the terms grant Fireworks perpetual sublicensable rights over all user-generated outputs, and lacks named security controls and breach notification standards.", "highlights": [ { "label": "Training data protection", "text": "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in" }, { "label": "Output rights concern", "text": "you hereby expressly grant...to Fireworks a fully paid, royalty-free, transferable, perpetual, irrevocable, non-exclusive, and worldwide license, with the right to grant and authorize sublicenses" }, { "label": "Data deletion timeline", "text": "If you delete your account, we aim to delete your personal information from our servers within 30 days" }, { "label": "Privacy representative", "text": "appointed GDPR Local with its local partners as our privacy representative" } ], "policyUrl": "https://fireworks.ai/privacy-policy", "policyLastUpdated": "2025-11-12", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/fireworks.ai.ico", "history": null, "indicators": null }, { "slug": "pendo", "name": "Pendo", "vendor": "Pendo.io Inc.", "domain": "pendo.io", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 55, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [ "D1.4: grant and agree to grant to Pendo, its affiliates and their successors and assigns a perpetual, irrevocable, non-exclusive, royalty-free right and license (with right to sublicense)" ], "summary": "Pendo discloses privacy rights and data practices with fair transparency but reserves perpetual sublicensable rights over user submissions, conducts training only on de-identified data with no raw-data training, limits sensitive data, and requires age 18 minimum.", "highlights": [ { "label": "Training data practice", "text": "AI/ML functionality developed only post-de-identification; no raw personal data used for model training" }, { "label": "Perpetual licence on submissions", "text": "User-submitted content assigned perpetual, irrevocable, sublicensable rights to Pendo in Terms of Use Section 5" }, { "label": "Strong data subject rights", "text": "Full access, deletion, portability, correction, and objection rights with named mechanisms" }, { "label": "International transfer safeguards", "text": "Adequacy decisions, standard contractual clauses, and EU-U.S. Data Privacy Framework compliance named" } ], "policyUrl": "https://www.pendo.io/legal/privacy-policy/", "policyLastUpdated": "2024-11-04", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/pendo.io.ico", "history": null, "indicators": null }, { "slug": "plaud", "name": "Plaud", "vendor": "Plaud Inc.", "domain": "plaud.ai", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 65, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Plaud's privacy policy commits to never training AI on user content without explicit opt-in consent, names in-app access, correction, and deletion mechanisms, and discloses SCC-based international transfers, but it shares hashed identifiers for advertising with only a GPC opt-out, gives only vague retention and security language, and is silent on breach notification and synthetic-output marking.", "highlights": [ { "label": "No-train commitment", "text": "Explicitly commits to never using Content to train AI models absent explicit informed opt-in consent, and requires LLM providers not to train on shared content." }, { "label": "Advertising sharing lowered", "text": "D4.3 downgraded to half: the policy says it does not sell data but concedes sharing hashed identifiers for advertising qualifies as CCPA 'sharing,' offered only with a GPC opt-out." }, { "label": "Vague security and retention", "text": "Security is boilerplate 'appropriate technical and organizational measures' (half), retention is 'as long as necessary' with no number (ladder 0.2), and breach notice is absent (zero)." } ], "policyUrl": "https://www.plaud.ai/policies/privacy-policy", "policyLastUpdated": "2026-06-16", "modalities": [ "audio", "text" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/plaud.ai.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 65, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "half", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "half", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "zoom", "name": "Zoom", "vendor": "Zoom Communications", "domain": "zoom.com", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 62, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Zoom explicitly commits not to train AI on customer content and enumerates rights, recipients, biometric governance and named certifications, but is silent on deletion timelines, AI-log retention, breach notice and synthetic-output marking.", "highlights": [ { "label": "No AI training on content", "text": "Zoom states it does not use audio, video, chat, screen sharing or attachments to train its or third-party AI models, earning full on D1.1." }, { "label": "Biometric governance is concrete", "text": "Facial geometry and voiceprint data are deleted when no longer necessary or after two years of inactivity, whichever comes first, supporting full on D6.3." }, { "label": "Retention period stays vague", "text": "Retention is only 'as long as required' with no number, capping D3.1 at half (ladder 0.2), and deletion timeline, AI-log retention and breach notice are all silent." } ], "policyUrl": "https://www.zoom.com/en/trust/privacy/privacy-statement/", "policyLastUpdated": "2026-02-02", "modalities": [ "audio", "video", "text" ], "processesBiometrics": true, "iconUrl": "https://icons.duckduckgo.com/ip3/zoom.com.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 62, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "half", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "full", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "full", "subFlag": "OK" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "churnzero", "name": "ChurnZero", "vendor": "ChurnZero, Inc.", "domain": "churnzero.com", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "ChurnZero discloses named user rights, EU standard contractual clauses, an age gate, and a DPO contact, but stays vague or silent on training use, retention periods, sub-processor lists, and security controls.", "highlights": [ { "label": "Named EU transfer safeguard", "text": "Cites standard contractual clauses under Commission Implementing Decision 2021/914 for international transfers (D4.4 full)." }, { "label": "Region-gated deletion timeline", "text": "The 30-day export-then-delete clause applies only to EEA/UK/Swiss data, so the global default earns half not full (D3.2)." }, { "label": "No sub-processor list", "text": "The D4.2 quote is a vendor-obligation clause, not a referenced sub-processor list or DPA, so it drops to zero." }, { "label": "Vague on training and retention", "text": "AI use is only \"consistent with this Policy\" and retention is \"as long as necessary,\" keeping D1.1 zero and D3.1 at ladder 0.2." } ], "policyUrl": "https://churnzero.com/wp-content/uploads/2025/05/Privacy_Policy_6.28.25.pdf", "policyLastUpdated": "2025-05-28", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/churnzero.com.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 58, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "full", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "half", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "zero", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "half", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "gainsight", "name": "Gainsight", "vendor": "Gainsight, Inc.", "domain": "gainsight.com", "category": "Customer support", "audience": "Enterprise", "scoreOutOf100": 49, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Gainsight's website privacy policy discloses solid data rights, enumerated data categories and recipient categories, and named international-transfer safeguards, but reserves a broad perpetual sublicensable content licence over user submissions and gives only vague retention and security disclosures.", "highlights": [ { "label": "Adverse content licence", "text": "Terms grant Gainsight a non-exclusive, worldwide, royalty-free, perpetual, irrevocable, sublicenseable and transferable right to fully exploit User Submissions (D1.4 zero, adverse)." }, { "label": "Portability is EU-only", "text": "Portability, objection and restriction rights are limited to EU residents, so under the global/US-default region rule D2.3 is half not full." }, { "label": "Vague retention and security", "text": "Retention is only 'can vary significantly' (no number, ladder 0.2) and security names only 'encryption technologies' without TLS/AES-256/RBAC." } ], "policyUrl": "https://www.gainsight.com/privacy-policy/", "policyLastUpdated": "2026-04-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/gainsight.com.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 49, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "zero", "subFlag": "ADVERSE" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "half", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "half", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "domo", "name": "Domo", "vendor": "Domo, Inc.", "domain": "domo.com", "category": "BI & analytics", "audience": "Enterprise", "scoreOutOf100": 58, "letterGrade": "C", "displayedGrade": "C", "confidence": "High", "dealbreakerFlags": [], "summary": "Domo's controller Privacy Notice and SaaS Agreement grant strong access and rights disclosures with named DPAs and a 30-day export window, but stay silent on AI training of inputs and offer only vague retention and boilerplate security language.", "highlights": [ { "label": "AI training silence", "text": "The default Privacy Notice never says user inputs are excluded from model training; it only carves out Google Workspace API data, so D1.1/D1.2/D1.3 are silent (zero)." }, { "label": "Fabricated quote removed", "text": "D1.4's original quote spliced in Anthropic's 'we assign to you all Outputs' language absent from Domo; the real Domo clause grants a broad sublicense/publish license scoped to providing the Services, supporting half." }, { "label": "Concrete export timeline", "text": "Section 6.3 gives a named 30-day post-termination window to export Subscriber Data, supporting a full award on D3.2 while D3.1 retention stays vague at 0.2." }, { "label": "Vague security and breach language", "text": "Encryption is only 'available' and 'industry standard' with 'prompt' breach notice and no timeframe, holding D7.1 and D7.2 at half." } ], "policyUrl": "https://www.domo.com/company/privacy-policy", "policyLastUpdated": "2026-03-01", "modalities": [ "text" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/domo.com.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 58, "grade": "C" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "zero", "subFlag": "OK" }, "D1.2": { "award": "zero", "subFlag": "OK" }, "D1.3": { "award": "zero", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "full", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "full", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "zero", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "full", "subFlag": "OK" }, "D5.1": { "award": "zero", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "NA" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "half", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "full", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "zero", "subFlag": "OK" }, "D7.1": { "award": "half", "subFlag": "OK" }, "D7.2": { "award": "half", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } }, { "slug": "slack", "name": "Slack", "vendor": "Salesforce (Slack Technologies)", "domain": "slack.com", "category": "Meeting intelligence", "audience": "Enterprise", "scoreOutOf100": 65, "letterGrade": "B", "displayedGrade": "B", "confidence": "High", "dealbreakerFlags": [], "summary": "Slack's public policy discloses no-train for LLMs with a named opt-out for global models, strong data-subject rights, named sharing recipients and SCC transfers, but is thin on retention periods, synthetic-output marking, named security controls and breach notice.", "highlights": [ { "label": "No LLM training", "text": "Slack states Customer Data (messages, files) is not used to train LLMs, with a named opt-out mechanism for global ML models." }, { "label": "Strong rights", "text": "Access, deletion, correction and objection rights are all named with concrete contacts (privacy@slack.com, dpo@slack.com)." }, { "label": "Weak security disclosure", "text": "Security section names no concrete controls (no TLS/AES/RBAC), gives no breach-notice timeline, and retention is only 'as long as necessary'." }, { "label": "Ownership vs reuse", "text": "Terms say Customer owns Customer Data but do not clearly limit provider reuse to the service, so D1.4 is only partial." } ], "policyUrl": "https://slack.com/trust/privacy/privacy-policy", "policyLastUpdated": "2023-07-05", "modalities": [ "text", "audio" ], "processesBiometrics": false, "iconUrl": "https://icons.duckduckgo.com/ip3/slack.com.ico", "history": { "firstAssessed": "2026-07-08", "lastChanged": "2026-07-08", "lastChecked": "2026-07-08", "assessmentCount": 1, "scoreHistory": [ { "date": "2026-07-08", "score": 65, "grade": "B" } ], "lastChange": null }, "indicators": { "D1.1": { "award": "full", "subFlag": "OK" }, "D1.2": { "award": "full", "subFlag": "OK" }, "D1.3": { "award": "half", "subFlag": "OK" }, "D1.4": { "award": "half", "subFlag": "OK" }, "D2.1": { "award": "full", "subFlag": "OK" }, "D2.2": { "award": "full", "subFlag": "OK" }, "D2.3": { "award": "zero", "subFlag": "OK" }, "D2.4": { "award": "full", "subFlag": "OK" }, "D2.5": { "award": "full", "subFlag": "OK" }, "D3.1": { "award": "half", "subFlag": "OK" }, "D3.2": { "award": "zero", "subFlag": "OK" }, "D3.3": { "award": "zero", "subFlag": "OK" }, "D3.4": { "award": "half", "subFlag": "OK" }, "D4.1": { "award": "full", "subFlag": "OK" }, "D4.2": { "award": "full", "subFlag": "OK" }, "D4.3": { "award": "half", "subFlag": "OK" }, "D4.4": { "award": "full", "subFlag": "OK" }, "D4.5": { "award": "half", "subFlag": "OK" }, "D5.1": { "award": "full", "subFlag": "OK" }, "D5.2": { "award": "zero", "subFlag": "OK" }, "D5.3": { "award": "full", "subFlag": "OK" }, "D5.4": { "award": "full", "subFlag": "OK" }, "D5.5": { "award": "half", "subFlag": "OK" }, "D6.1": { "award": "zero", "subFlag": "NA" }, "D6.2": { "award": "half", "subFlag": "OK" }, "D6.3": { "award": "zero", "subFlag": "NA" }, "D6.4": { "award": "full", "subFlag": "OK" }, "D7.1": { "award": "zero", "subFlag": "OK" }, "D7.2": { "award": "zero", "subFlag": "OK" }, "D7.3": { "award": "full", "subFlag": "OK" } } } ] }