DeepBrain AI Studios

The provider explicitly states in Annex A that 'Input data may be shared with those providers and transmitted to countries outside your region (e.g., the U.S.)' for third-party AI services including OpenAI, Runway, Stability AI, and Kling AI. This indicates user content is shared with external AI providers who may use it for training purposes, creating significant shadow AI risk.

“Input data may be shared with those providers and transmitted to countries outside your region (e.g., the U.S.). Users are advised not to input sensitive personal data.”

The license granted is extremely broad. Section 2 grants a 'non-transferable, non-exclusive, revocable, limited license' but Section 13 reserves the right to 'sell, license, and/or display any advertising, attribution, links, promotional and/or distribution rights in connection with your use.' The company retains extensive rights to user content for commercial purposes.

“The Company reserves the right, directly or in partnership with a third-party person or entities, to sell, license, and/or display any advertising, attribution, links, promotional and/or distribution rights in connection with your use of the Sites or Services.”

Extensive third-party sharing occurs. Section 6 states personal information is shared with YouTube API, and Section 7 lists delegation to Stripe, AWS, and HubSpot. Annex A explicitly states input data is shared with OpenAI, Runway, Stability AI, and Kling AI. The policy allows sharing 'when required by applicable laws' with vague boundaries.

“DeepBrain AI, through license agreements with the licensors of the applications listed below, may access third-party applications as part of its services. In such cases, personal information related to the applications may be shared with the licensors and accessed under the terms of the license agreement and privacy policy.”

Data retention periods are lengthy and unclear. Subscription data is retained for 5 years. Dream Avatar photos/voice are deleted upon termination, but the policy states data may be moved to 'separate database (DB) or stored in a different location' if required by law, with no clear deletion guarantee. Users cannot easily request deletion of all data.

“Subscription enrollment Email address (ID), purchase history, payment information Retained for 5 years. However, if any of the following applies, retention will continue until the relevant period ends: Until the retention period defined by applicable laws concerning records of transactions.”

Ownership is partially favorable for paid users but problematic for free users. Annex A Section 4 states 'Paid subscribers hold full ownership, including intellectual property rights, to their generated Outputs. Free users may only use the generated Output for personal and non-commercial purposes.' However, Section 5 of main ToU states company owns all Licensed Software and components, creating ambiguity about user-generated content ownership.

“Paid subscribers hold full ownership, including intellectual property rights, to their generated Outputs. Free users may only use the generated Output for personal and non-commercial purposes unless otherwise authorized.”

No mention of SOC2, GDPR, HIPAA, or ISO certifications in the provided legal text. The Privacy Policy mentions compliance with various U.S. state privacy laws (CCPA, CPA, VCDPA, UCPA, CTDPA) and references to overseas data transfer, but no formal security certifications are disclosed. This is a significant gap for enterprise use.

“DeepBrain AI takes the following measures to ensure the security of personal information: Administrative Measures: Establishment and implementation of an internal management plan. Operation of a dedicated team. Regular staff training. Signing confidentiality agreements”