123RF

The Privacy Policy does not explicitly address whether user data or uploaded content is used to train AI models. The policy mentions processing data to 'improve Our services and your experience' under legitimate interest (Art. 6(1)(f) GDPR), but this is vague and does not clearly exclude AI training. Absence of explicit protection against AI training on user content warrants a moderate concern score.

“[Privacy] 'We will analyse your Personal Data in order to improve Our services and your experience with Our Website' — vague language that could encompass AI training but does not explicitly state it.”

The Privacy Policy does not address intellectual property rights or content licensing terms. It describes data collection and processing but does not specify what rights 123RF claims over user-uploaded content or generated outputs. This critical gap in the provided documents requires a conservative moderate concern score.

“Not found in documents — scored conservatively. Privacy Policy addresses personal data processing but not content licensing or IP rights over user submissions.”

The Privacy Policy states that Personal Data may be disclosed to 'third parties such as (i) IT providers; (ii) financial institutions or payment gateway providers; (iii) marketing agencies; (iv) legal, accounting, tax, labour consultants; (v) other Inmagine Group companies within the EEA.' While some categories are specified, the language is broad and includes 'marketing agencies' without explicit DPA requirements or sub-processor list publication, creating moderate concern.

“[Privacy] 'third parties such as (i) IT providers; (ii) financial institutions or payment gateway providers in connection with the processing of financial and payment information; (iii) marketing agencies to carry out marketing campaigns, surveys and promotions' — broad sharing with marketing partners without explicit DPA safeguards.”

The Privacy Policy provides some clarity on retention: 'Data are retained as long as necessary for the performance of the services provided on the Website and to comply with legal obligations' and 'If you choose to close the account or if your account is closed, We will delete your Personal Data and information within thirty (30) days.' However, it also states 'This is without prejudice to Our right to retain the information (such as username and transaction details) to comply with legal obligations, prevent frauds and protect its legal interest,' creating ambiguity about what data persists indefinitely.

“[Privacy] 'We will delete your Personal Data and information within thirty (30) days. This is without prejudice to Our right to retain the information (such as username and transaction details) to comply with legal obligations, prevent frauds and protect its legal interest.'”

The provided Privacy Policy does not address IP ownership of outputs or content created/generated through the platform. Terms of Service or a separate IP clause would typically cover this, but no such document was provided. Absence of explicit IP ownership protection for user-generated or AI-generated content warrants a moderate concern score.

“Not found in documents — scored conservatively. Privacy Policy does not address IP ownership of user-uploaded content or AI-generated outputs.”

The Privacy Policy references GDPR compliance (Art. 6 citations, DPO contact, EU/UK representatives, data subject rights) and mentions 'appropriate safeguards, including binding corporate rules or standard data protection clauses adopted by the European Commission,' but does not explicitly state SOC 2 Type II, ISO 27001, HIPAA, or other formal certifications. GDPR compliance is mentioned but formal certification status is unclear.

“[Privacy] 'We ensure that We have adopted appropriate safeguards, including binding corporate rules or standard data protection clauses adopted by the European Commission, in order to guarantee the data subjects with an adequate level of protection' — references compliance mechanisms but no explicit SOC 2, ISO 27001, or HIPAA certification stated.”