Is Pigment safe with your data?

Rights listed without a mechanism

The rights section is a bare seven-item list qualified by "Within the limits and conditions of applicable data protection laws", with no request timeline or verification process, so access, erasure, portability and rectification each drop to half; only the objection right is tied to the named dpo@pigment.com channel.

AI use disclosed only in a definitions clause

AI Features appear as a defined term inside the Solution definition and the policy notes inputs and outputs are processed "to provide, develop and improve our Pigment AI Features", but there is no user-facing AI-interaction disclosure, no opt-out mechanism and no tier differences.

Government access is a bare permission

"We may also have to share your personal data with a regulator or to otherwise comply with the law" reserves disclosure without any legal threshold, user-notice commitment or challenge process, which is not a disclosed government-access standard.

Security and retention thinly specified

The only named control is "Website SSL" with no cipher, key length or access-control scheme, there is no breach-notification clause at all, and the shortest stated retention is 3 years from contract end or last positive engagement.