Attio

The ToS references AI workflows and OpenAI compliance but does not explicitly state whether user data trains Attio's own AI models. The Privacy Policy mentions using data to 'improve our services' but lacks clarity on whether this includes model training. Language is vague regarding AI training on customer data.

“[ToS] 'where your use of the Attio Services incorporates AI workflow, fail to comply in any way with Open AI's terms of use'; [Privacy] 'analyze data usage of our platform and use that information to improve our services'”

The ToS grants Attio a broad, irrevocable, sublicensable license to Customer Data 'solely to the extent necessary to provide' services, but also permits use 'after the Term' for Integration Apps and derivative works. The license survives termination for certain purposes, creating moderate concern about scope creep.

“[ToS] 'Attio grants to You a non-exclusive, worldwide, fully paid up, royalty free, irrevocable, sub-licensable license to use your Customer Data...and additionally after the Term, to host, use, distribute, run, publicly perform or display, translate, and create derivative works'”

The Privacy Policy states data is shared with 'service providers, sub-contractors, and agents' under instructions, with some DPA protections mentioned. However, Integration Apps are treated as independent controllers, and the policy allows sharing in mergers/acquisitions with notice. Sub-processor list is not explicitly published.

“[Privacy] 'we may share your personal data with any service providers, sub-contractors, and agents...including payment providers, IT service providers'; 'each developer of an Integration App shall be deemed to be a separate and independent controller'”

The ToS states Customer Data is available for 30 days post-termination, after which Attio 'may, but is not obligated to, delete' it. The Privacy Policy references retention 'in accordance with applicable laws' but lacks specific timelines. Anonymized data may be retained indefinitely.

“[ToS] 'Upon any termination, Attio will make all Customer Data available to You for electronic retrieval for a period of thirty (30) days, but thereafter Attio may, but is not obligated to, delete stored Customer Data'; [Privacy] 'we may anonymize your personal data...in which case we may use this information indefinitely'”

The ToS explicitly states that the Customer 'remain[s] the owner of all Intellectual Property Rights in the Customer Data' and that Attio claims no ownership of outputs. The license granted to Attio is limited to service delivery and does not transfer IP ownership to Attio.

“[ToS] 'You will, as between the parties, remain the owner of all Intellectual Property Rights in the Customer Data...the foregoing license will automatically terminate' upon termination”

The Privacy Policy mentions GDPR compliance, data protection legislation, and references a Data Processing Addendum (DPA), but does not explicitly list SOC 2, ISO 27001, HIPAA, or other formal certifications. Security measures are described generically without published trust documentation or certification details.

“[Privacy] 'We shall process your personal data in a manner that ensures appropriate security...by using appropriate technical or organizational measures'; [ToS] 'Data Processing Addendum or DPA means the data processing agreement which forms and is hereby incorporated'”