Gorgias

Gorgias explicitly states it will NOT use Customer Data to train third-party models, but reserves the right to use Customer Data, Feedback, Aggregate Data, Usage Data, and Output to build and improve its own internal ML/AI models. This is a moderate concern because while third-party training is prohibited, Gorgias's own model training is permitted without explicit opt-out.

“[ToS] "Gorgias will not use Customer Data to improve or train any third-party provider's models... Gorgias may, without providing any compensation to Customer or to any third party, use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output, solely to build and improve our internal machine learning and other artificial intelligence models"”

Gorgias claims a broad, perpetual, irrevocable, worldwide, transferable, and sublicensable license to Customer Data for multiple purposes including service improvement, data analysis, and other business purposes. The license survives termination and includes derivative works, which is highly unfavorable to the customer.

“[ToS] "Customer hereby grants to Gorgias a worldwide, irrevocable, transferable, sub-licensable (through multiple layers), assignable, non-exclusive, fully paid-up, royalty-free--and, with respect to clause (b) hereof only, perpetual--right to use, reproduce, copy, store, manipulate, modify, distribute, publish, list information regarding, make derivative works of and publicly perform and display the Customer Data (a) during the Term... and (b) during the Term and thereafter, (i) to maintain, provide, and improve our products and services"”

Gorgias shares data with service providers and third-party service providers under DPA obligations, and maintains a published subprocessor list. However, the DPA allows sharing with 'Affiliates' and the Privacy Policy mentions sharing with 'data brokers' and 'entities with whom we partner,' which creates moderate concern about scope of third-party access.

“[DPA] "Gorgias will maintain a list of its Subprocessors at the following URL: https://www.gorgias.com/legal/list-of-data-subprocessors... Gorgias will contractually impose substantially similar data protection obligations on its Subprocessors"; [Privacy] "We receive information about You from other third parties, such as service providers... data brokers, and social media networks"”

The DPA specifies that Personal Data must be deleted within 90 days of termination, which is reasonable. However, Usage Data and Aggregate Data are retained indefinitely without clear limits, and the ToS allows Gorgias to retain Customer Data for 45 days post-termination for customer retrieval only, creating moderate concern about non-personal data retention.

“[DPA] "Gorgias shall, promptly and in any event within 90 days of expiration or termination of the Agreement... delete and procure the deletion of all other copies of Personal Data"; [ToS] "If requested by Customer, Gorgias will make the Customer Data available to Customer... for 45 days after the effective date of termination"”

While Customer retains ownership of Customer Data, Gorgias claims ownership of all Usage Data and Aggregate Data, and reserves the right to limit or prohibit Customer's use of Output at its sole discretion. Gorgias also claims a perpetual license to Feedback for any purpose including commercial exploitation.

“[ToS] "Gorgias owns and controls all Usage Data and Aggregate Data... we may, by notice to Customer at any time, limit Customer's use of the Output or require Customer to cease using the Output (and delete any copies of the Output) if we form the view, in our sole and absolute discretion, that Customer's use of the Output may infringe the rights of any third party"; [ToS] "Gorgias and its Affiliates a fully paid-up, royalty-free, worldwide, transferable, sub-licensable (through multiple layers), assignable, irrevocable, and perpetual license to implement, modify, commercially exploit, incorporate into the Services, and otherwise use (including on a non-confidential basis) any such Feedback"”

The DPA references SOC 2 Type II compliance and mentions GDPR, CCPA, UK GDPR, and Swiss data protection law compliance. However, no explicit certifications are claimed in the documents provided, and compliance is stated as conditional ('to the extent permitted by law'). A security/trust page is referenced but not provided.

“[DPA] "If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, or similar audit report performed by a qualified third party auditor within twelve (12) months of Customer's audit request and Gorgias has confirmed there have been no known material changes in the controls audited since the date of such report, Customer agrees to accept such report in lieu of requesting an audit"; [DPA] "Gorgias shall comply with Applicable Privacy Law in the Processing of Personal Data"”