ControlHippo

The DPA permits ControlHippo to use Customer Content for analytics and machine learning purposes (Section 16.1), but this is limited to carrying out the purposes intended by the Customer. However, the Privacy Policy and ToS lack explicit prohibitions on training proprietary AI models on user data, creating ambiguity about whether aggregated or anonymized data feeds broader AI training pipelines.

“[DPA] "Customer acknowledges and grants to ControlHippo the right of usage of Customer Content to collect, use, copy, store, and transmit said Customer Content...including but not limited to carrying out analytics for machine learning."”

The ToS grants ControlHippo a royalty-free license to use Customer Content solely to provide, support, maintain and improve the Service(s), with explicit language that the company owns the Customer Content. However, the license includes broad rights to incorporate feedback and re-use techniques and know-how, and the DPA permits usage for analytics and machine learning, creating some ambiguity about the full scope of permitted uses.

“[ToS] "You own the rights to the Customer Content that You provide to Us...You grant to Us a royalty-free license and right to use the Customer Content solely to provide, support, maintain and improve the Service(s)."”

ControlHippo shares Customer Content with multiple sub-processors (listed in DPA Appendix 1) including analytics, email, and data management vendors. While the DPA requires sub-processors to have binding contracts with similar data protection obligations, the Privacy Policy permits sharing with affiliates, partners, and third parties for marketing purposes with customer permission, and anonymized usage data is shared with prospective investors and partners.

“[DPA Appendix 1] Sub-processors include "Metabase (Data Analytics), Mix Panel (Data Tracking and Analytics), HubSpot (Data Management)" and [Privacy] "We may share Your Personal Information with other companies in Our group...We may from time to time share such data with third parties such as prospective investors, affiliates, partners and advertisers."”

Both ToS and DPA specify that Customer Content is deleted within 2 years of account termination, with a retention period allowing export. However, the language is vague regarding what happens during the 2-year retention period, and the DPA notes that data may be retained longer if required by law without clear specifics on how long such retention could extend.

“[ToS/DPA] "Following the termination of Your Account either by Yourself or by Us, We shall delete all Customer Content in Our possession within two (2) years of the date of effective termination ('Retention Period')."”

The ToS explicitly states that the customer owns the rights to Customer Content and ControlHippo does not claim ownership. The license granted is limited to providing, supporting, maintaining and improving the Service(s), with no rights to sublicense or use outputs for other purposes.

“[ToS] "You own the rights to the Customer Content that You provide to Us. We do not claim ownership over such Customer Content."”

The DPA references GDPR, UK GDPR, and Swiss DPA compliance with Standard Contractual Clauses, and the Privacy Policy mentions GDPR compliance. However, no explicit mention of SOC 2 Type II, ISO 27001, or HIPAA certifications is provided. The DPA does outline technical and organizational security measures in Appendix 2, but formal third-party certifications are not documented.

“[DPA] "ControlHippo shall implement and maintain appropriate technical and organizational security measures...Such measures shall include the measures set out in Appendix 2" and [Privacy] "We use appropriate technical and organisational measures to protect the Personal Information that We collect and Process."”