GAIA

The Privacy Policy mentions using data for 'Analyzing usage patterns' and 'Conducting research and analytics to enhance our AI models and algorithms,' but does not explicitly state whether user content is used for training. The language is vague about whether this applies to free or paid tiers, and no clear opt-out mechanism is documented.

“[Privacy] 'Conducting research and analytics to enhance our AI models and algorithms; Monitoring and analyzing trends, usage, and activities in connection with the Service'”

Section 7 grants GAIA a 'worldwide, non-exclusive, royalty-free, sublicensable, and transferable license' to user content 'solely in connection with the Service and Company's business operations.' The sublicensing right and broad 'business operations' language create moderate concern, though the license is nominally limited in scope.

“[ToS] 'grant Company a worldwide, non-exclusive, royalty-free, sublicensable, and transferable license to use, reproduce, distribute, prepare derivative works of, display, and perform the User Content solely in connection with the Service and Company's business operations'”

The Privacy Policy states data is shared with 'trusted third-party service providers' for specific functions and explicitly states personal data is not sold. However, the list of service providers is vague ('Cloud hosting,' 'Analytics,' etc.), and no published sub-processor list or detailed DPA requirements are mentioned.

“[Privacy] 'We may share your information with trusted third-party service providers who assist us in operating our business, including: Cloud hosting and infrastructure providers; Payment processing companies; Customer support and communication platforms; Analytics and monitoring services'”

Section 7 provides specific retention periods for some data types (usage data up to 24 months, support communications up to 3 years), but states data may be retained 'longer periods when required by law or for legitimate business purposes' without clear limits. Google user data deletion is mentioned but vague on timing.

“[Privacy] 'Usage data: Typically retained for up to 24 months for analytics and improvement purposes... We may retain certain information for longer periods when required by law or for legitimate business purposes such as fraud prevention and security'”

Section 7 of the ToS explicitly states 'You retain all ownership rights in any content, data, or information you submit to the Service.' The license granted to GAIA is limited to service delivery and business operations, with no claim of ownership over outputs.

“[ToS] 'You retain all ownership rights in any content, data, or information you submit to the Service'”

The Privacy Policy references GDPR compliance and CCPA rights for specific jurisdictions, but does not mention SOC 2, ISO 27001, HIPAA, or other formal certifications. A security section exists describing measures (encryption, access controls), but no published trust page or formal compliance documentation is referenced.

“[Privacy] 'Encryption of data in transit and at rest using industry-standard protocols; Access controls and authentication mechanisms to limit access to personal information; Regular security assessments and monitoring of our systems'”