DataRobot

DataRobot states it will use Customer Data to 'improve and enhance the Services' and for 'development, diagnostic and corrective purposes,' but does not explicitly state whether this includes AI model training. The Privacy Policy mentions using 'anonymized' data for product development, but the scope and default status of training on user data remains vague. No explicit opt-out mechanism is documented for training purposes.

“[AI Platform Agreement] 'DataRobot shall have a non-exclusive license to use the Customer Data to improve and enhance the Services and for other development, diagnostic and corrective purposes.' [Privacy Policy] 'We may remove personal identifiers from data...and use this data to understand feature adoption...When using collected data for product development, we will always remove all personal data and Customer Data.'”

The AI Platform Agreement explicitly grants DataRobot a perpetual, royalty-free, worldwide license to use Customer Data and grants DataRobot ownership of all Predictive Models created by customers. The license is broad and includes rights to use data for improvement and development purposes. The ToS also grants DataRobot perpetual, irrevocable, sublicensable rights to User Submissions for any purpose including marketing and derivative works.

“[AI Platform Agreement] 'Customer hereby grants DataRobot a non-exclusive license to use the Customer Data to improve and enhance the Services and for other development, diagnostic and corrective purposes...DataRobot shall own all rights, title and interest in the Predictive Models.' [ToS] 'you expressly grant DataRobot a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up worldwide, fully sub-licensable right to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, transmit, perform and display such content...in perpetuity throughout the universe.'”

DataRobot publishes a subprocessor list and states third parties are 'contractually obligated to maintain confidentiality,' but the Privacy Policy indicates data may be shared with 'affiliates,' 'business partners,' and 'service providers' with broad language. The subprocessor list shows sharing with AWS, Google, Microsoft, Salesforce, and others, but the Privacy Policy's language about sharing with 'business partners' for 'product integrations' and 'event partners' lacks specificity about consent and data protection mechanisms.

“[Privacy Policy] 'We may share your personal data with our business partners with whom we develop product integrations for our users...These entities may have access to your personal data to the extent needed to perform their services. All such third parties are contractually obligated to maintain the confidentiality and security of your personal data.' [Subprocessors] Lists AWS, Google LLC, Microsoft Corporation, Salesforce, Inc., Box, Inc., and others as subprocessors.”

The Privacy Policy states data will be retained 'as needed to fulfill the purposes for which it was collected' and mentions deletion of Customer Data following account termination, but uses vague language ('as needed,' 'reasonable timeframe'). The AI Platform Agreement states DataRobot 'reserves the right in its sole discretion to delete the Customer's account and/or data upon the conclusion of the term,' but does not specify automatic deletion timelines or backup retention periods.

“[Privacy Policy] 'We will retain your personal data as needed to fulfill the purposes for which it was collected...Following termination or deactivation of your account, we will delete your Customer Data, and anonymize your User Metrics, but may retain your contact information, user profile, and other personal data in our records.' [AI Platform Agreement] 'DataRobot reserves the right in its sole discretion to delete the Customer's account and/or data upon the conclusion of the term.'”

The AI Platform Agreement explicitly states that DataRobot owns all rights, title, and interest in Predictive Models created by customers, and customers may only use them for 'internal corporate use' during the term. Customers have 'no right to use or retain any Predictive Models for any other purpose or after the Term of the Service.' This is a clear assertion of vendor ownership over customer-generated outputs.

“[AI Platform Agreement] 'Customer may use predictive models created by Customer through its use of the Service ("Predictive Models") solely for internal corporate use (if applicable), (ii) DataRobot shall own all rights, title and interest in the Predictive Models, and (iii) Customer shall have no right to use or retain and any Predictive Models for any other purpose or after the Term of the Service.'”

The Privacy Policy mentions GDPR, UK GDPR, and CCPA compliance and references Standard Contractual Clauses, but does not explicitly state SOC 2 Type II, ISO 27001, or HIPAA certifications. The Subprocessors page states 'Keeping your data safe and private is our top priority' but provides no formal security certifications or trust documentation. The Privacy Policy references 'industry standards and best practices' but lacks specific compliance certifications.

“[Privacy Policy] 'We have put appropriate safeguards in place to ensure that your personal data receives an adequate level of security...This includes entering into agreements with written assurances from our services providers, including, as required, standard contractual clauses for the transfer of personal data as approved by the European Commission.' [Subprocessors] 'Keeping your data safe and private is our top priority.' No explicit mention of SOC 2, ISO 27001, or HIPAA.”