Descript

Descript uses user data to train AI models but provides an opt-out mechanism. Projects are protected as confidential by default, but the company explicitly states it may use Projects and other data to 'train, improve, and develop its models and technologies' unless opted out. The opt-out exists but is not the default, creating moderate risk.

“[ToS] 'we and any vendors...may access and use your Input and Output...to train, improve, and develop its models and technologies (unless you have opted out of such use)' and [Privacy] 'You can opt out of having your Projects used to improve the Descript Service by disabling the Share Data with Descript setting'”

Descript claims a perpetual, irrevocable, worldwide, sublicensable license to user content for broad purposes including derivative works, analysis, and improvement of services. While the company states it does not claim ownership of user content, the license granted is extremely broad and survives termination, creating high risk for IP control.

“[ToS] 'You hereby grant to us a perpetual, irrevocable, nonexclusive, royalty-free, sublicensable, fully paid, worldwide license to create derivative works from, access, reproduce, distribute, process, publish, display, perform, adapt, modify, analyze, and otherwise use the User Content'”

Descript shares data with vendors, service providers, advertising partners, and analytics providers. While some controls exist (DPAs mentioned for service providers), the company shares identifiers and behavioral data with advertising networks and social platforms for targeted advertising. Sub-processor list is not explicitly published, creating moderate concern.

“[Privacy] 'We disclose personal information to vendors, consultants, and other service providers...including third-party payment processors, advertising partners, and vendors who assist us' and 'we may be selling or sharing identifiers, internet or other electronic network activity information, and inferences with our advertising partners'”

Descript states it retains data 'as long as necessary' for original purposes and 'legitimate business purposes' but provides no specific retention periods for most data types. Voiceprints are retained 'up to three years after you last accessed your account.' Backup and archived copies may be retained indefinitely. Language is vague regarding deletion timelines.

“[Privacy] 'We store personal data for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes' and 'We may also retain cached or archived copies of information about you for a certain period of time'”

Descript explicitly states that users own all right, title, and interest in generated outputs (Input and Output). The company claims no ownership rights in user content and confirms that as between user and Descript, the user owns outputs to the extent protectable under law.

“[ToS] 'as between you and Descript, you own all right, title, and interest in and to any Input and Output, to the extent protectable under applicable law' and 'We claim no ownership rights in your User Content'”

Descript does not explicitly mention SOC 2, ISO 27001, HIPAA, or other major compliance certifications in the provided documents. The company references GDPR compliance for EEA users and mentions 'reasonable measures' for security, but no formal certifications or trust page is documented. This represents moderate concern with incomplete compliance documentation.

“[Privacy] 'We take reasonable measures to help protect information about you from loss, theft, misuse, and unauthorized access' but no specific certifications mentioned. Not found in documents regarding SOC 2, ISO 27001, or HIPAA compliance.”