Copy.ai

[Privacy] states Copy.ai uses Personal Data to 'improve, upgrade or enhance our Services' and 'develop new products and Services,' but does not explicitly state whether user content or prompts are used to train AI models. The language is vague about model training specifically. No explicit opt-out for training is mentioned, and free vs. paid tier distinctions are absent.

“[Privacy] 'To improve, upgrade or enhance our Services; To develop new products and Services' — vague service improvement language without explicit training disclosure.”

[ToS] Section 7(b) grants Copy.ai 'a non-exclusive, transferable, perpetual, irrevocable, worldwide, royalty-free, fully paid-up license, with the right to sublicense' to use User Content for 'providing, operating, securing, and improving their services.' This is a broad, perpetual, sublicensable license that survives termination and extends beyond strict service delivery.

“[ToS] 'perpetual, irrevocable, worldwide, royalty-free, fully paid-up license, with the right to sublicense, to use, host, store, copy, communicate, modify, create derivative works based upon, distribute, publish, publicly display, and publicly perform your User Content'”

[Privacy] Section 4 discloses sharing with 'Service Providers,' 'Affiliates,' and 'Advertising Partners' for interest-based advertising. While some controls are mentioned (service providers under 'strict conditions'), the scope of advertising partner sharing is broad and vague. No comprehensive sub-processor list is published, though DPA compliance is mentioned for EEA residents.

“[Privacy] 'Advertising Partners. We share your Personal Data with third-party advertising partners... for purposes of delivering personalized advertisements to you when you visit digital properties within their networks.'”

[Privacy] Section 13 states 'We retain different types of Personal Data for different periods' but provides no specific retention timelines. It notes data is kept 'as long as you use the Services' and mentions deletion on request, but does not specify how long deletion takes or address backup retention. Language is vague ('reasonably necessary').

“[Privacy] 'We retain different types of Personal Data for different periods, depending on the purposes for processing such information... we will not retain the Personal Data related to you for any longer than reasonably necessary'”

[ToS] Section 7(e) explicitly grants the user 'a non-exclusive, worldwide, license, with the right to sublicense, to use, copy, modify, sell, create derivative works based upon, distribute, publicly display, and publicly perform Generated Content for your lawful business purposes.' Section 17(a) clarifies that 'OpenAI LLC, exclusively owns all right, title and interest in and to Generated Content. Copy.AI claims no ownership of Generated Content.'

“[ToS] 'Copy.AI hereby grants you a non-exclusive, worldwide, license... to use, copy, modify, sell, create derivative works based upon... Generated Content for your lawful business purposes' and 'Copy.AI claims no ownership of Generated Content.'”

[Privacy] Section 8 states Copy.ai 'complies with the principles of the EU-U.S. Data Privacy Framework' and has 'certified to the U.S. Department of Commerce' compliance with DPF Principles. However, no SOC 2, ISO 27001, HIPAA, or other standard security certifications are mentioned. Security practices are described as 'industry standard' but not formally certified.

“[Privacy] 'Copy.ai complies with the principles of the EU-U.S. Data Privacy Framework... and has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles' — DPF compliance claimed but no SOC 2 or ISO 27001 mentioned.”