Clay

Clay states it will use aggregated performance data to improve products, but does not explicitly state whether user-uploaded content trains AI models. The language is vague about what 'service improvement' entails, and there's no clear opt-out mechanism or distinction between free and paid tiers regarding training.

“[ToS] 'Clay will use aggregated performance data, including how you use your account, to improve our product.' [ToS] 'Clay does not use user-uploaded content for any purpose other than providing Clay services to the account that uploaded content.'”

The license granted is broad but somewhat limited in scope. Users grant Clay a 'worldwide, non-exclusive, royalty-free, transferable and perpetual license' to use, reproduce, modify, adapt, publish, translate, distribute, and display content. The perpetual nature and sublicensing rights to service providers create moderate concern, though the license is stated as non-exclusive.

“[ToS] 'you grant Clay Labs a worldwide, non-exclusive...perpetual license to use, reproduce, modify, adapt, publish, translate, distribute, and display such content for the purpose of providing and improving the Services.'”

Clay states it does not make user-uploaded content available to third parties beyond workspace users and the Clay team. However, the Privacy Policy mentions sharing with 'service providers' under written contracts and references to 'affiliates' and 'partners' without detailed sub-processor lists. Anonymized analytics data sharing is mentioned but not fully detailed.

“[ToS] 'Clay does not make data uploaded by users available to anyone other than those using the Clay workspace of the uploading account and the Clay team.' [Privacy] 'We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider.'”

Clay provides clear retention and deletion policies. Data is retained as long as the account is active, and is deleted when the account is deleted. Users can request deletion by contacting support, and the Privacy Policy confirms deletion within 30 days of request. This is enterprise-friendly.

“[ToS] 'Clay Labs retains user data as long as your user account is active. If your account is deleted, your data is deleted with it. Users can request data deletion by contacting support@clay.run' [Privacy] 'We will respond to your request within 30 days.'”

Clay explicitly states that users retain ownership of their content and that Clay does not claim ownership of uploaded data. The license granted is for service provision only, and users can still license their content to others (non-exclusive license).

“[ToS] 'You retain ownership of your User Content.' [ToS] 'Clay does not claim ownership of any data that you upload to Clay.'”

Clay mentions maintaining a comprehensive information security program and offers Data Processing Agreements (DPAs) with GDPR compliance upon request. However, no specific certifications like SOC 2 Type II, ISO 27001, or HIPAA are mentioned. The security documentation is limited to general statements without published trust pages or detailed security practices.

“[ToS] 'Clay Labs maintains a comprehensive information security program, including administrative, physical, and technical security policies and procedures.' [Privacy] 'In line with the 2018 General Data Protection Regulation (GDPR) Clay offers Data Processing Agreements (DPAs) to users upon request.'”