Cluely AI

Free and Pro tier users explicitly grant permission for AI training, but Enterprise tier explicitly prohibits training. Language is clear but creates a two-tier system where free/paid users' data feeds training pipeline while enterprise users are protected.

“[ToS] For Enterprise Tier Services, Cluely shall not use any Customer Data to train any Cluely or third-party artificial intelligence or machine learning model. For Free Services and Pro Tier Services, Customer expressly grants Cluely permission to use Customer Data to train Cluely's artificial intelligence and machine learning models.”

License is limited to service provision but broad enough for improvement purposes. Free/Pro tiers grant broad rights to use data for training and service improvement, while Enterprise tier has more restricted license. Language permits sublicensing to 'authorized sub-processors.'

“[ToS] Customer grants Cluely a nonexclusive, worldwide, royalty-free right to reproduce, display, adapt, modify, transmit, distribute and otherwise use the Customer Data (a) to maintain, provide, and improve the Services under this Agreement; (b) to prevent or address technical or security issues.”

Subprocessor list is published in DPA (AWS, Deepgram, OpenAI, Anthropic, Stripe, etc.), and DPA requires subprocessors to be bound by equivalent protections. However, ToS permits sharing with 'authorized sub-processors' with limited transparency for free/pro tiers.

“[DPA] Service Provider is authorized to engage the following Subprocessors: Deepgram, Inc., AssemblyAI, Inc., OpenAI L.P., Anthropic PBC. [ToS] Cluely may use third-party subcontractors who are subject to contractual obligations no less protective than those of this Agreement.”

DPA specifies 30-day deletion post-termination with exceptions for legal requirements and backups. However, ToS states Cluely 'reserves the right to permanently delete' data and backups may be retained indefinitely for 'disaster recovery.' Retention periods for active use are vague.

“[DPA] Service Provider shall delete Company Personal Data within 30 days of the cessation of Services, except for data required by law. [ToS] Cluely reserves the right to permanently delete any Customer Data following termination. Any data deleted may remain in immutable electronic backups maintained by Cluely.”

Customer retains ownership of Customer Data, but Cluely claims broad rights to use data for service improvement and derivative works. DPA specifies deliverables ownership for paid pilots, but standard outputs remain ambiguous.

“[ToS] Except for the limited rights expressly granted to Cluely hereunder, Customer retains all rights, title and interest in and to all Customer Data. [DPA] For paid pilot programs, all Deliverables created specifically for Company shall be owned by Company upon full payment.”

DPA states Cluely is 'pursuing SOC 2 Type II and ISO 27001 certifications' but these are not yet obtained. GDPR compliance is addressed via standard contractual clauses in DPA. No mention of HIPAA or other specific certifications.

“[DPA] Service Provider is pursuing SOC 2 Type II and ISO 27001 certifications. [DPA] For transfers from the EU/EEA, the Parties shall rely on EU approved standard contractual clauses as set forth in Schedule A.”