InvGate

The provided documents do not explicitly address whether InvGate uses customer data for AI training purposes. The Privacy Policy explicitly states it covers website data only and refers to a separate 'Cloud Services Privacy Policy' for SaaS instance data, which was not provided. Without explicit language confirming or denying AI training on user data, this dimension scores as moderate concern per the critical rule that absence of protection is a risk.

“[Privacy] 'This policy does not cover the data our Customers upload in our SaaS instances. For that, you can see our Cloud Services Privacy Policy.'”

The provided documents do not contain explicit terms regarding the scope of content licenses or intellectual property rights granted by customers to InvGate. The Product Usage Guidelines focus on usage limits and excessive usage definitions, while the Privacy Policy addresses personal data handling but not content licensing. Without explicit language defining license scope, this scores as moderate concern.

“Not found in documents — scored conservatively”

[Privacy] states 'We don't disclose your personal information to third parties' except for legal requirements or fraud protection, but this applies only to website visitor data. The Privacy Policy explicitly excludes SaaS instance data from its scope, referring instead to a separate Cloud Services Privacy Policy not provided. Without visibility into how customer-uploaded data is shared, this scores as moderate concern.

“[Privacy] 'We don't disclose your personal information to third parties. The only mitigating circumstances in which your information would be shared is in any event where we are legally required to do so, or to assist fraud protection and minimize credit risk.'”

The Privacy Policy states data will be retained 'in the minimum volume in order to meet legal requirements' but provides no specific retention periods or deletion timelines. The policy is vague on how long data is retained and does not address automatic purge on account termination. The Cloud Services Privacy Policy (which would cover SaaS data retention) is not provided, creating uncertainty.

“[Privacy] 'We will continue retaining information about you in the minimum volume in order to meet legal requirements and to enforce this Privacy Policy.'”

The provided documents do not explicitly address IP ownership of outputs generated within InvGate services. The Product Usage Guidelines focus on usage limits, and the Privacy Policy addresses personal data handling but not intellectual property rights over generated content. Without explicit language clarifying ownership, this scores as moderate concern.

“Not found in documents — scored conservatively”

[Privacy] mentions GDPR compliance as of May 25, 2018, but provides no evidence of formal certifications such as SOC 2 Type II, ISO 27001, or HIPAA. No security documentation, trust page, or DPA is referenced in the provided documents. The Privacy Policy states compliance with 'highest standards' but offers no verifiable certifications or published security practices.

“[Privacy] 'As of May 25th 2018, we will also be complying with the General Data Protection Regulation (GDPR), which strengthens the rights that EU individuals have over their data.'”