Diffblue Cover

The Privacy Policy does not explicitly state whether user code or data submitted to Diffblue Cover is used to train AI models. While the policy mentions 'service improvement' and 'research and develop new products' as uses of customer support data, there is no clear statement about whether uploaded code or generated test cases are used for model training. The absence of an explicit opt-out or clear prohibition on training with user data creates moderate concern.

“[Privacy] 'research and develop new products and services, troubleshoot and remedy issues with our products and services' — but no explicit statement on AI training with user code”

The Privacy Policy does not address the scope of license granted by users over content (code, test cases) submitted to or generated by Diffblue Cover. The policy focuses on personal data rather than intellectual property or content licensing. Without explicit terms limiting the license to service delivery or prohibiting sublicensing, this dimension cannot be assessed as enterprise-friendly and defaults to moderate concern.

“Not found in documents — scored conservatively”

[Privacy] states 'We do not sell or rent personal data to third parties' but also mentions sharing with 'service providers and suppliers' and 'group companies' without detailed restrictions on what data types are shared with whom. The policy mentions third-party advertisers for cookies/tracking but does not clearly restrict sharing of user-submitted code or generated content with sub-processors. Sub-processor list is not published.

“[Privacy] 'We do not sell or rent personal data to third parties' but also 'share your personal data with service providers and suppliers who process personal data on our behalf' without detailed DPA requirements listed”

[Privacy] states retention is 'for as long as necessary for the purpose for which the personal data was collected, or for such longer period required by law' and mentions 'expiry of our backup archive retention period if later' but does not specify concrete timeframes for deletion of user-submitted code or generated test cases. The vague 'as long as necessary' language and mention of backup retention without clear purge timelines creates moderate concern.

“[Privacy] 'We retain personal data for as long as necessary for the purpose for which the personal data was collected...At the end of this period (or expiry of our backup archive retention period if later), we will either delete or anonymise the personal data'”

The Privacy Policy does not address IP ownership of outputs generated by Diffblue Cover (test cases, code analysis). The policy focuses on personal data rights rather than intellectual property ownership. Without explicit language stating that users/companies retain all rights to generated outputs, or conversely that Diffblue claims rights, this dimension cannot be assessed as clearly protective and defaults to moderate concern.

“Not found in documents — scored conservatively”

[Privacy] mentions 'generally accepted technical and organisational measures' and references GDPR compliance (standard contractual clauses, Privacy Shield), but does not explicitly state SOC 2 Type II, ISO 27001, HIPAA, or other formal certifications. The policy indicates GDPR compliance mechanisms are in place but formal certification status is unclear, warranting moderate concern.

“[Privacy] 'We have implemented generally accepted technical and organisational measures' and 'entering the European Union's standard contractual clauses or selecting organisations with the Privacy Shield certification' — but no explicit SOC 2, ISO 27001, or HIPAA mentioned”