Decagon

[Privacy] states data is used for 'Service improvement and analytics' and to 'develop new products and services,' but does not explicitly state whether user content trains AI models. The language is vague about whether employee/customer data feeds model training pipelines. No explicit opt-out for training is mentioned.

“[Privacy] 'Service improvement and analytics. We may use your personal information to analyze your usage of the Service, improve the Service, improve the rest of our business...and to develop new products and services.'”

[Privacy] does not address content licensing or IP rights over user-generated outputs. The absence of explicit language about license scope, sublicensing, or termination of rights creates moderate concern. No document provided clarifies whether the company claims rights to content created through the service.

“Not found in documents — scored conservatively”

[Privacy] shares data with 'Service providers,' 'Advertising partners,' and 'Partners' for interest-based advertising and marketing purposes. While some controls are mentioned (e.g., service providers help operate the service), the policy broadly shares information with advertising networks and marketing partners without explicit DPA requirements or a published sub-processor list.

“[Privacy] 'Advertising partners. Third-party advertising companies for the interest-based advertising purposes described above. Partners. Third parties with whom we partner, including parties with whom we co-sponsor events or promotions...whose products or services may be of interest to you.'”

[Privacy] does not specify clear data retention periods or automatic deletion timelines. The policy mentions creating 'aggregated, de-identified and/or anonymized data' that may be retained indefinitely, but provides no explicit retention schedule or prompt deletion guarantees for personal data.

“[Privacy] 'We may create aggregated, de-identified and/or anonymized data from your personal information...We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes.'”

[Privacy] does not address IP ownership of outputs generated through the service. The absence of explicit language stating that users/companies retain all rights to generated content, or conversely that the vendor claims rights, creates ambiguity and moderate concern.

“Not found in documents — scored conservatively”

[Privacy] mentions 'technical, organizational and physical safeguards' but provides no evidence of SOC 2, ISO 27001, GDPR compliance certification, HIPAA, or other formal compliance certifications. No security documentation, trust page, or DPA is referenced in the provided documents.

“[Privacy] 'We employ technical, organizational and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.'”