Grok Bot

The Privacy Policy explicitly states that SpaceXSI uses publicly available data and User Content to train models. [Privacy] states 'We use information that is publicly available on the internet to train our models' and 'to develop and improve our Service and to conduct research' which includes model training. No opt-out is provided for non-ZDR users, and the DPA only protects Personal Data when using ZDR-Enabled API—regular users' data trains models by default.

“[Privacy] 'We use information that is publicly available on the internet to train our models and provide resulting Output' and 'To develop and improve our Service and to conduct research: For example to develop new product features, to train our models'”

The ToS grants Provider broad rights over User Content without clear limitations. [ToS] Section 1 permits use for 'internal business purposes' but the service definition and Privacy Policy usage for 'develop and improve our Service and to conduct research' indicates broad sublicensing potential. The license survives across connected services and persistent cloud environments, with no explicit termination of vendor rights upon account deletion.

“[ToS] 'Customer may permit its Users to access and use Grok Bot for Customer's internal business purposes' with no explicit restriction on Provider's license rights. [Privacy] allows use 'To develop and improve our Service and to conduct research' without limiting Provider's derivative rights.”

The Privacy Policy permits broad sharing with 'contracted service providers,' 'related companies,' and 'third-parties with which you interact' without requiring DPAs. [Privacy] lists sharing with 'service providers including providers of hosting, cloud, analytics, content delivery, support and safety monitoring' and states data goes 'To our related companies' and 'To third-parties with which you interact or share information.' The DPA Subprocessor List is referenced but sharing scope in Privacy Policy exceeds DPA protections for non-Personal Data.

“[Privacy] 'To our contracted service providers: To assist in providing the Service to you or performing business operations, we provide your personal information to service providers including providers of hosting, cloud, analytics, content delivery, support and safety monitoring' and 'To our related companies' and 'To third-parties with which you interact or share information.'”

Retention periods are vague outside of specific scenarios. [Privacy] states 'We retain your personal information where we have an ongoing legitimate business need to do so' without defining duration. Private Chat data deletes within 30 days, but default conversations have unclear retention. [DPA] Section 9 commits to delete upon termination 'except to the extent required by retain copies under applicable laws' but does not specify how long 'applicable laws' retention persists. ZDR-enabled data is immediately deleted, but non-ZDR users face ambiguous retention.

“[Privacy] 'We retain your personal information where we have an ongoing legitimate business need to do so' and 'when Private Chat is turned on, conversations will not appear in your conversation history and your conversations will be deleted from SpaceXSI systems within 30 days unless it is necessary that they be kept longer' but default retention is unspecified.”

IP ownership of Outputs is not explicitly addressed in any document. The ToS and Privacy Policy are silent on whether users retain ownership of generated content or whether Provider claims rights to Outputs. This absence of clarity on a critical dimension constitutes moderate concern—users cannot confirm they own what Grok generates, and Provider's broad research and improvement rights suggest potential claims to outputs.

“Not found in documents — scored conservatively. Neither ToS, Privacy Policy, nor DPA explicitly state who owns outputs generated by Grok Bot.”

Compliance certifications are mentioned only partially. [DPA Appendix 2] states 'SpaceXSI has adopted the NIST 800-171 Rev.3 framework as a baseline' and describes security measures but does not reference SOC 2, ISO 27001, or HIPAA certifications. No trust page, security certifications page, or published audit reports are mentioned. GDPR compliance is addressed through DPA SCCs but formal certification status is unclear.

“[DPA Appendix 2] 'SpaceXSI has adopted the NIST 800-171 Rev.3 framework as a baseline for our internal security standards' and '[DPA Section 5.2] 'we will provide access to documentation that adequately demonstrates our compliance with this DPA, including copies of certifications, audit reports, and/or other relevant documentation' but no specific certifications are named.”