CapCut

CapCut explicitly uses user data to train AI models and improve machine learning algorithms with no opt-out mechanism. The Privacy Policy states they use User Content to 'train, test, and improve technology, such as machine learning models and algorithms' and this applies to all users regardless of tier.

“[Privacy] 'review, support, improve, and develop the Services, and train, test, and improve technology, such as machine learning models and algorithms, including by analyzing how people are using the Services'”

CapCut claims perpetual, irrevocable, worldwide, sublicensable rights to all user content. The ToS grants them an 'unconditional, irrevocable, non-exclusive, royalty-free, fully transferable (including sub-licensable), perpetual, worldwide license' to use, modify, adapt, and create derivative works of user content for any purpose.

“[ToS] 'you grant TikTok USDS Joint Venture and our affiliates, agents, services providers, partners and other connected third parties an unconditional, irrevocable, non-exclusive, royalty-free, fully transferable (including sub-licensable), perpetual, worldwide license to use, modify, adapt, reproduce, make derivative works of, display, publish, transmit, distribute and/or store your User Content'”

CapCut shares user data broadly with service providers, business partners, affiliates, advertising partners, and TT Commerce & Global Services with minimal restrictions. The Privacy Policy explicitly states sharing occurs for 'advertising services, including targeted ads' and with 'Advertising and measurement partners' without detailed DPA requirements or sub-processor transparency.

“[Privacy] 'We share the categories of personal information listed above with our service providers and business partners as necessary to help us perform business operations and for business purposes, including providing, supporting, and developing the Services, cloud hosting, content generation, content delivery, customer and technical support, content moderation, marketing, analytics, and online payment'”

CapCut provides vague retention language stating data is retained 'as long as necessary' for service provision and legal obligations, with retention periods 'differ[ing] depending on the type of information.' No specific timelines are provided, and backup/archival retention is not clearly addressed.

“[Privacy] 'We retain information for as long as necessary to provide the Services and for the other purposes set out in this Privacy Policy. The retention periods differ depending on the type of information and the purposes for which we use the information.'”

CapCut claims extensive rights to user-generated content including the right to create derivative works, sublicense, and use content for any purpose. While users technically retain copyright, CapCut's license is so broad that the company can effectively use outputs as they wish, including for training and commercial purposes.

“[ToS] 'you grant TikTok USDS Joint Venture and our affiliates, agents, services providers, partners and other connected third parties...a royalty-free fully transferable (including sub-licensable), worldwide license to use your username, image and likeness to identify you as the source of any of your User Content, including for use in sponsored content'”

No compliance certifications (SOC 2, GDPR, ISO 27001, HIPAA) are mentioned in either the ToS or Privacy Policy. No security documentation, trust page, or formal DPA is referenced. The documents only mention general 'technical, administrative, and organizational measures' without third-party validation.

“[Privacy] 'We maintain technical, administrative, and organizational measures designed to protect your information from unauthorized access, theft, disclosure, modification, or loss, and to provide a level of security appropriate to the processing risk.' [No certifications mentioned]”