Greptile

[ToS] Section 2.2 permits AI training on de-identified/anonymized customer data by default, but allows opt-out via account settings. The opt-out mechanism exists but is not the default position, and the company retains broad rights to use aggregated data for model improvement. This represents moderate concern—protection exists but requires affirmative action by customer.

“[ToS] "Company may (i) aggregate and anonymize Customer Data...and/or (ii) use such data to train and improve artificial intelligence algorithms and models...However, if Customer does not desire to permit Company to engage in AI training, Customer may manage preferences and settings related to AI Training and Learnings accordingly within Customer's account"”

[ToS] Section 1.5 states company owns all derivative works and modifications, and customers assign feedback/suggestions to company. However, Section 2.1 clarifies that Customer Data itself remains customer's proprietary. The license grant is limited to service delivery, but the broad assignment of feedback and derivative works creates ambiguity about what constitutes customer-owned output versus company-owned improvements.

“[ToS] "Customer hereby assigns and agrees to assign to Company any rights, title and interest in and to any feedback, suggestions, ideas, derivative works, modifications, enhancements, or improvements to the Platform or Services that Customer or its representatives provide or develop."”

[ToS] Section 2.4 permits use of third-party cloud providers (AWS, Azure) with subprocessor list available. [Privacy] permits sharing with service providers, affiliates, and business partners. However, specific DPA protections and sub-processor agreements are not detailed in provided documents. Sharing is limited to service delivery but lacks explicit DPA requirements for all sub-processors.

“[ToS] "Company may use nationally recognized third party cloud service providers, such as Amazon Web Services or Microsoft Azure, to store and process Customer Data in accordance with industry standards. A list of subprocessors is available at greptile.com/security/subprocessors."”

[ToS] Section 2.5 provides 30-day data transfer window post-termination and states company is not obligated to store data beyond 30 days, but may retain archival copies for archival purposes. This creates ambiguity about indefinite retention of 'archival' data and lacks explicit automatic purge timelines for active data during service.

“[ToS] "Company will transfer a copy of Customer Data in Company's possession or control to Customer within thirty (30) days following any termination or expiration...Company will delete any Customer Data in its control or possession thereafter, but may retain archival copies for archival purposes only"”

[ToS] Section 2.1 states Customer Data is proprietary to customer and company may use it only for performing services. However, Section 1.5 assigns all derivative works, modifications, and improvements to company. This creates ambiguity: customer owns input data but company owns outputs/improvements, which is moderately concerning for IP clarity.

“[ToS] "All Customer Data will be considered proprietary to Customer. Company may use Customer Data solely for performing the Services...Any derivative works, modifications, or enhancements relating to the Platform or any component thereof (whether created alone or jointly) will be solely and exclusively owned by Company."”

Documents reference a DPA available on request and mention 'Security Practices' and 'Subprocessors' pages, but no specific compliance certifications (SOC 2, ISO 27001, GDPR, HIPAA) are explicitly stated in the provided ToS or Privacy Policy. The existence of these pages suggests some compliance infrastructure, but certifications are not documented in the materials provided.

“[ToS] "Company agrees to provide the Services and other related obligations in accordance with this Agreement, including related Orders and the DPA. Data Processing Agreement - Available on request (contact security@greptile.com)"”