Chatbase

The Security page lists 'Do you use my data to train AI models?' as an FAQ but provides no answer in the provided text. The ToS Section 9.2 grants Chatbase a 'non-exclusive, worldwide, royalty-free, transferable license to use, process, and display User Submissions solely to provide the Service,' which is limited to service provision. However, the DPA Section 2 states Company processes data 'for purposes other than those set forth in the Agreement' only if required by law, but does not explicitly prohibit training. The absence of a clear 'no training' commitment combined with broad license language creates moderate concern.

“[ToS 9.2] 'Customers grant Chatbase a non-exclusive, worldwide, royalty-free, transferable license to use, process, and display User Submissions solely to provide the Service.' [Security FAQ] Lists 'Do you use my data to train AI models?' but provides no explicit answer in documents.”

ToS Section 9.2 grants a license 'solely to provide the Service' with customers retaining 'all rights to User Submissions.' However, ToS Section 8.4 on Feedback grants Chatbase a 'royalty-free, worldwide, perpetual, irrevocable, fully transferable, and sublicensable license' to use feedback for any purpose. The User Submissions license is narrower but the Feedback clause is extremely broad. The distinction between these two creates ambiguity about scope.

“[ToS 9.2] 'Customers grant Chatbase a non-exclusive, worldwide, royalty-free, transferable license to use, process, and display User Submissions solely to provide the Service. Beyond the rights granted here, Customers retain all rights to User Submissions.' [ToS 8.4] Feedback license is 'perpetual, irrevocable, fully transferable, and sublicensable.'”

The DPA Section 4 permits engagement of Authorized Sub-Processors with a published list at https://trust.chatbase.co/subprocessors and 10-day notice requirement. However, ToS Section 3 states Chatbase may interface with Third-Party Services and customers must provide login credentials, with Chatbase disclaiming liability. The DPA requires written agreements with sub-processors imposing 'comparable' data protection obligations, but the ToS Third-Party Services section lacks equivalent protections. The mechanism exists but with some gaps in clarity.

“[DPA 4.2] 'At least ten (10) days before enabling any third party other than existing Authorized Sub-Processors to access or participate in the processing of Personal Data, Company will add such third party to the List.' [ToS 3] 'Chatbase does not endorse any Third-Party Services' and 'Chatbase expressly disclaims all representations and warranties concerning Third-Party Services.'”

ToS Section 5.3 states 'Within thirty (30) days of termination for cause, upon the Customer's request, or if the Customer deletes its workspace within the Service, Chatbase will delete the Customer's User Information.' However, it also states 'For Customers using the Free Version, Chatbase may retain User Submissions and User Information to facilitate continued use' and 'Chatbase may delete all User Submissions and User Information if an account remains inactive for more than one (1) year.' The DPA Exhibit A states retention is 'as long as required (i) to provide the Services...or (iii) by applicable law.' This creates vagueness about actual retention periods and free tier treatment.

“[ToS 5.3] 'Within thirty (30) days of termination for cause, upon the Customer's request...Chatbase will delete the Customer's User Information...For Customers using the Free Version, Chatbase may retain User Submissions and User Information to facilitate continued use.' [DPA Exhibit A] 'Company will process Customer's Personal Data as long as required (i) to provide the Services...or (iii) by applicable law.'”

ToS Section 9.2 explicitly states 'Beyond the rights granted here, Customers retain all rights to User Submissions, with no implied licenses under this Agreement.' This clearly establishes that the customer/company owns all generated outputs and the vendor claims no ownership rights to outputs. The license granted is limited strictly to service provision.

“[ToS 9.2] 'Customers grant Chatbase a non-exclusive, worldwide, royalty-free, transferable license to use, process, and display User Submissions solely to provide the Service. Beyond the rights granted here, Customers retain all rights to User Submissions, with no implied licenses under this Agreement.'”

The Security page explicitly states 'GDPR & SOC 2 Type II Compliance' and 'Ensuring data privacy, security, and compliance with GDPR and SOC 2 Type II standards.' The DPA incorporates EU SCCs and UK SCCs for international data transfers, and Exhibit C provides detailed technical and organizational security measures. The company maintains published security documentation and a trust page with sub-processor list.

“[Security] 'GDPR & SOC 2 Type II Compliance - Ensuring data privacy, security, and compliance with GDPR and SOC 2 Type II standards.' [DPA] Incorporates EU SCCs and UK SCCs with detailed Exhibit C security measures and published sub-processor list at https://trust.chatbase.co/subprocessors.”