Artisan

The ToS explicitly prohibits using Customer Data to train AI models. The DPA reinforces this with clear language stating Artisan 'shall not use, or permit any third party to access or use Customer Data...to train, modify, or improve any AI model, other than the AI model used to provide the Services.' Only aggregated, de-identified Usage Data may be used for model improvements.

“[ToS] 'Artisan shall not use, or permit any third party to access or use Customer Data, other than in anonymized or aggregated form that cannot be re-identified, to train, modify, or improve any AI model, other than the AI model used to provide the Services under this Agreement.'”

The ToS clearly establishes that the Customer is 'the sole and exclusive owner of the Customer Data' and 'any deliverables developed by Artisan for the Customer.' The license granted to Artisan is limited to providing the Service and does not extend to sublicensing or commercial use of customer content.

“[ToS] 'Customer is and will be the sole and exclusive owner of the Customer Data (as defined below) and of any deliverables developed by Artisan for the Customer in connection with Services provided under these Terms and the Order Form (the "Output").'”

While the DPA requires sub-processors to be bound by 'at least as restrictive' terms and provides a sub-processor list (Exhibit C), the ToS states subcontractors 'shall be bound by provisions at least as restrictive as these Legal Terms' but does not explicitly prohibit all third-party sharing. The DPA allows engagement of sub-processors for infrastructure, features, and support with 30-day notice and objection rights, which provides some control but leaves room for interpretation.

“[ToS] 'You understand that Customer Data and Submissions may be viewable by our subcontractors and vendors related to the Services we provide. These subcontractors and vendors shall be bound by provisions at least as restrictive as these Legal Terms, including governing confidentiality and data use.'”

The DPA explicitly addresses data retention and deletion. It states Artisan 'will delete or return all Customer Data, including Personal Data (including copies thereof) Processed pursuant to this DPA, on termination or expiration of your Subscription Service' with exceptions only for legally required retention and archived backup data that will be 'securely isolate[d] and protect[ed] from any further Processing and delete[d] in accordance with our deletion practices.'

“[DPA] 'We will delete or return all Customer Data, including Personal Data (including copies thereof) Processed pursuant to this DPA, on termination or expiration of your Subscription Service...except where we are required by applicable law to retain some or all of the Customer Data, or where we have archived Customer Data on back-up systems, which data we will securely isolate and protect from any further Processing and delete in accordance with our deletion practices.'”

The ToS unambiguously states that 'Customer is and will be the sole and exclusive owner of the Customer Data...and of any deliverables developed by Artisan for the Customer.' Artisan retains no ownership rights to outputs or customer-provided content.

“[ToS] 'Customer is and will be the sole and exclusive owner of the Customer Data (as defined below) and of any deliverables developed by Artisan for the Customer in connection with Services provided under these Terms and the Order Form (the "Output").'”

The DPA's Exhibit B states that 'The physical and environmental security controls are currently being audited for SOC 2 Type II compliance and prepared for other certifications' and that 'Processor maintains a SOC 2 Type II report covering the Security Trust Services Criteria.' However, the language 'currently being audited' and 'prepared for' suggests certifications are in progress rather than completed. GDPR compliance is addressed through the DPA and SCCs, but no mention of ISO 27001 or HIPAA compliance is made.

“[DPA Exhibit B] 'The physical and environmental security controls are currently being audited for SOC 2 Type II compliance and prepared for other certifications. Processor maintains a SOC 2 Type II report covering the Security Trust Services Criteria.'”