Clari

Clari explicitly states that user data is NOT used to train AI models. The Privacy Policy clearly commits: 'Clari does not use, or allow our vendors to use, the data collected through these interactions to train or improve any AI models.' This protection applies across all service tiers and data types.

“[Privacy] 'Clari does not use, or allow our vendors to use, the data collected through these interactions to train or improve any AI models. This data is used solely for the purpose of providing and improving the specific service or feature you are interacting with.'”

The DPA restricts Clari's license to Personal Data strictly to providing the Services. Clari explicitly commits not to sell, share, or use data outside the direct business relationship. The license is limited in scope and purpose, with no sublicensing rights beyond service delivery.

“[DPA] 'Salesloft shall not: (i) sell or share Personal Data; (ii) retain, use, or disclose Personal Data outside of Salesloft's direct business relationship with Customer or for any purpose other than for a business purpose under the CCPA on behalf of Customer or as necessary to perform the Services for Customer.'”

Clari shares data with service providers and sub-processors, with a published list available. However, the Privacy Policy mentions sharing with 'Affiliates' and 'advertising partners' with limited detail on controls. Sub-processors are listed but the scope of their access and DPA requirements could be clearer. The DPA requires sub-processors to have 'substantially similar' protections but enforcement mechanisms are not explicitly detailed.

“[Privacy] 'We disclose your Personal Data to the following categories of service providers and other parties: Service providers (a full list of which can be found here), including Hosting and other technology and communications providers, Ad networks, Security and fraud prevention companies, Analytics providers, Staff augmentation and contract personnel. Our affiliates.'”

The DPA provides a 90-day window for deletion requests after account termination, but retention periods during active service are vague ('for the duration of the Agreement'). The Privacy Policy allows indefinite retention of aggregated data and data required for legal compliance. Backup retention and specific timelines for different data types are not clearly documented.

“[DPA] 'Upon request made by Customer within ninety (90) days following the expiration or termination of the Subscription Term, Salesloft will return or delete the Personal Data, except as required to be retained by applicable laws. After ninety (90) days, Salesloft will have no obligation to maintain any Personal Data.'”

The documents do not explicitly address IP ownership of outputs generated by the Service. However, the Privacy Policy and DPA focus on Clari's role as a processor of customer data, not on claiming ownership of generated content. The absence of any claim to output ownership, combined with Clari's processor role, suggests outputs remain with the customer.

“[DPA] 'Salesloft will Process Personal Data only: (i) for the purposes described in the Agreement and this DPA; (ii) in accordance with any other reasonable Instructions provided by Customer in accordance with this DPA and the Agreement; (iii) in compliance with Data Protection Laws.'”

Clari demonstrates strong compliance certifications: ISO 27001 audits performed annually by independent third parties, Data Privacy Framework (EU-U.S., UK, Swiss) certification, GDPR compliance with published DPA, and commitment to SOC 2 standards. The DPA references annual ISO 27001 audits and a published security addendum.

“[DPA] 'Salesloft also uses external auditors to verify the adequacy of its security measures. This audit (a) will be performed at least annually; (b) will be performed according to ISO 27001 standards or substantially equivalent standards; (c) will be performed by independent third-party security professionals at Salesloft's selection and expense.'”