Beehiiv

The Privacy Policy and ToS do not explicitly state whether user data is used to train AI models. The Privacy Policy mentions using information to 'improve our Digital Services' and 'deliver a better and more personalized service,' which is vague language typical of moderate concern. No explicit opt-out or clear statement that data is NOT used for AI training is provided.

“[Privacy] 'to improve our Digital Services and to deliver a better and more personalized service by enabling us to: estimate our audience size and usage patterns; store information about your preferences'”

The ToS does not explicitly define the scope of the license users grant over their content. While the ToS states beehiiv owns its own intellectual property, it does not clearly state whether users retain ownership of their published newsletters or what rights beehiiv claims over user-generated content. This vague treatment of content ownership creates moderate concern.

“[ToS] 'beehiiv's trademarks, logos, intellectual property, content, features, and functionality...are owned by beehiiv, its licensors, or other providers of such content' — but no explicit statement about user content ownership”

The Privacy Policy states data may be shared with 'affiliates, contractors, service providers, and other third parties' and mentions Google Analytics, but does not provide a comprehensive list of sub-processors or detail the scope of sharing. The policy mentions sharing with 'health care Provider partners' and 'service providers' without clear DPA requirements or published sub-processor list.

“[Privacy] 'to affiliates, contractors, service providers, and other third parties we use to support our business (e.g., third parties providing IT and infrastructure support services, and ordering, marketing, and payment processing services)'”

The Privacy Policy does not specify clear retention periods for user data. It states users can request deletion and that beehiiv will 'remove you from all newsletters' upon request, but does not state how long data is retained before automatic deletion or what happens to backup copies. The vague language creates moderate concern.

“[Privacy] 'If you would like to be deleted from our service, you can submit a request to [email protected]. This will remove you from all newsletters you are subscribed to using the beehiiv platform.' — No explicit retention period stated”

The ToS does not explicitly state who owns content created by users (newsletters, posts, etc.). While it protects beehiiv's own IP, it is silent on whether users retain exclusive ownership of their published content or what rights beehiiv claims to use, sublicense, or derive from user-generated content.

“Not found in documents — scored conservatively. ToS addresses beehiiv IP but not user content ownership.”

The Privacy Policy mentions CCPA compliance and references GDPR in the AUP, but does not provide evidence of SOC 2 Type II, ISO 27001, HIPAA, or other formal certifications. A security page is referenced but not provided in the documents. The absence of published compliance certifications creates moderate concern.

“[Privacy] 'This notice is to comply with the California Consumer Privacy Act of 2018 ("CCPA")' and [AUP] references 'GDPR' — but no SOC 2, ISO 27001, or HIPAA certifications mentioned”