HyperWrite

HyperWrite allows training on user data by default but provides an opt-out mechanism for 'general systems' training. However, the opt-out is not the default position, and users who opt out still have their data used for service-specific ML training. The language is somewhat vague about what constitutes 'general systems' versus service-specific training.

“[ToS] "you shall have the right to opt-out of the 'general systems', and in the event of such opt-out, Otherside will only use such data to provide the Services to you, including to train machine learning algorithms specific to your use of the Services (and not for the benefit of the general systems)."”

The Feedback clause grants Otherside an extremely broad, perpetual, irrevocable, sublicensable license to any feedback or suggestions provided by users, including for marketing and promotional purposes. While this technically applies to 'Feedback' rather than all user content, the definition is broad and the license terms are highly unfavorable to the user.

“[ToS] "you hereby grant to Otherside, to the maximum extent permitted under applicable law, a worldwide, royalty-free, fully paid-up, non-exclusive, perpetual, irrevocable, transferable and fully sublicensable (through multiple tiers) license...for any purpose (including marketing or promotional purposes or testimonials)."”

HyperWrite shares data with service providers, affiliates, advertising partners, and payment processors. While some controls exist (e.g., DPA with Stripe), the Privacy Policy indicates broad sharing with 'advertising partners' for interest-based advertising and with 'affiliates' without explicit restrictions. Sub-processor lists are not published.

“[Privacy] "We may share your personal information with...Service providers...Advertising partners...Third-party advertising companies for the interest-based advertising purposes described above...Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy."”

The Privacy Policy does not specify clear data retention periods or automatic deletion timelines. While users can request deletion and update information, there is no explicit statement about how long data is retained, backup retention policies, or automatic purge on account termination.

“[Privacy] "If you have registered for a Service account with us, you may review and update certain account information by logging into the account." [No explicit retention period stated]”

The ToS does not explicitly address ownership of outputs generated by the AI tool. The Feedback clause grants broad rights to Otherside over feedback, but user-generated content and AI-generated outputs are not clearly addressed. This ambiguity creates moderate risk regarding IP ownership of generated content.

“[ToS] "User-generated content that you submit to the Service, such as messages that you author or documents that you attach to your messages." [Ownership of AI-generated outputs not explicitly addressed]”

Neither the ToS nor Privacy Policy mentions SOC 2, ISO 27001, HIPAA, GDPR compliance certifications, or a formal Data Processing Agreement. While basic security measures are mentioned, there is no evidence of enterprise-grade compliance certifications or published security documentation.

“[Privacy] "We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information." [No certifications mentioned]”