Hypotenuse AI

The ToS states the company may use data to 'improve and enhance the Services' and collect/analyze information 'relating to the provision, use and performance' of services, but language is vague about whether user-generated content trains the AI model itself. No explicit opt-out mechanism for training is mentioned, and free vs. paid tier treatment is unclear.

“[ToS] 'we shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services...to improve and enhance the Services and for other development, diagnostic and corrective purposes'”

Users retain ownership of content they submit, but grant Hypotenuse a broad license to 'use, modify, publicly perform, publicly display, reproduce, and distribute such Content on and through Service' and make it available to other users. The license scope is moderately broad but limited to service delivery; however, the ability to make content available to other users and modify it creates ambiguity.

“[ToS] 'you grant us the right and license to use, modify, publicly perform, publicly display, reproduce, and distribute such Content on and through Service. You agree that this license includes the right for us to make your Content available to other users'”

Privacy Policy mentions sharing with 'subsidiaries and affiliates' and 'contractors, service providers, and other third parties' but lacks a published sub-processor list. Analytics services (Google Analytics, Mixpanel, Amplitude) and remarketing vendors (Google Ads) are named, but data sharing terms with these parties are not fully detailed in the provided documents.

“[Privacy] 'to our subsidiaries and affiliates; (ii) to contractors, service providers, and other third parties we use to support our business; (iii) with your consent in any other cases'”

Privacy Policy states data is retained 'only for as long as is necessary' and 'Usage Data is generally retained for a shorter period,' but no specific retention periods (e.g., 30 days, 90 days) are defined. Deletion on request is implied but not explicitly guaranteed with a timeline.

“[Privacy] 'We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. Usage Data is generally retained for a shorter period'”

ToS explicitly states users 'retain any and all of your rights to any Content you submit, generate, post or display on or through Service.' The company claims no ownership of generated outputs, only a license to use content within the service.

“[ToS] 'You retain any and all of your rights to any Content you submit, generate, post or display on or through Service'”

Privacy Policy references GDPR compliance and CalOPPA compliance, and mentions PCI-DSS for payment processing, but no SOC 2, ISO 27001, HIPAA, or other formal security certifications are explicitly stated. No dedicated security or trust page is referenced in the provided documents.

“[Privacy] 'If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights, covered by GDPR' and 'These payment processors adhere to the standards set by PCI-DSS'”