Higgsfield

The ToS explicitly states that user inputs and outputs 'may be used by the Company to train, develop, enhance, evolve and improve its (and its affiliates') AI models, algorithms and related technology' with no opt-out mechanism or distinction between free and paid tiers. Section 4.4 grants a 'non-exclusive, irrevocable, perpetual, worldwide, royalty-free' license for these purposes.

“[ToS] 'Inputs (as well as the remainder of Your Content) and Outputs may be used by the Company to train, develop, enhance, evolve and improve its (and its affiliates') AI models, algorithms and related technology...you hereby grant to the Company a non-exclusive, irrevocable, perpetual, worldwide, royalty-free, fully paid, transferable, sublicensable right and license'”

Section 4.3 grants Company a perpetual, irrevocable, worldwide, sublicensable license to use, reproduce, modify, adapt, prepare derivative works, and 'derive revenue or other remuneration from Your Content.' The license is transferable through multiple tiers of sublicensees with no termination upon account deletion.

“[ToS] 'you grant Company a non‑exclusive, transferable, perpetual, irrevocable, worldwide, fully‑paid, royalty‑free, sublicensable (through multiple tiers of sublicensees) right...to use, copy, reproduce, modify, adapt, prepare derivative works from...and derive revenue or other remuneration from Your Content'”

The ToS mentions sharing with 'affiliates' in Section 4.4 for AI training purposes and references Stripe as a third-party payment processor under Section 9.1, but does not provide a comprehensive list of sub-processors, explicit DPA requirements for all third parties, or clarity on whether data is shared with advertising/analytics partners beyond what is stated.

“[ToS] 'Inputs...and Outputs may be used by the Company to train, develop, enhance, evolve and improve its (and its affiliates') AI models' and 'Company uses Stripe, Inc. and its affiliates as its third‑party service provider for payment services'”

Section 3.2 states Company has 'no obligation to store any of Your Content' and Section 15.4 indicates Company 'may delete Your Content associated therewith from our live databases' upon termination, but no explicit retention periods, automatic purge timelines, or backup retention policies are documented.

“[ToS] 'Company has no obligation to store any of Your Content' and 'Upon termination of the Service...we may delete Your Content associated therewith from our live databases'”

Section 4.2 explicitly states 'Company does not claim ownership of Your Content' and Section 4.4 clarifies 'The Company does not claim ownership of any of your Inputs or Outputs, and nor does it restrict the use of Outputs for commercial use,' providing clear user/company ownership of generated outputs.

“[ToS] 'Company does not claim ownership of Your Content' and 'The Company does not claim ownership of any of your Inputs or Outputs, and nor does it restrict the use of Outputs for commercial use'”

No compliance certifications (SOC 2, GDPR, ISO 27001, HIPAA) are mentioned in the provided ToS. No security documentation, trust page, or DPA is referenced in the document. The absence of these standard enterprise security commitments represents high risk.

“Not found in documents — scored conservatively”