Katalon

The Privacy Policy states that Katalon uses feedback on AI-generated responses (thumbs up/down) and analyzes interactions with AI outputs to improve AI performance, but does not explicitly state whether user content or data is used to train models. Language about 'improving AI performance' and 'research and development' is vague regarding training scope.

“[Privacy] 'Analyzing interactions with AI-generated outputs (like thumbs up/down feedback) to improve AI performance.' No explicit statement on whether user content trains models.”

The Cloud Service Terms grant Katalon a broad, non-exclusive license to use, copy, store, transmit, modify, and create derivative works of user data 'as needed' for service provision, improvement, and legal compliance. While limited to stated purposes, the license is perpetual and allows derivative works, creating moderate concern about scope.

“[ToS - Cloud Service Terms] 'You grant us a non-exclusive, worldwide license to use, copy, store, transmit, modify, create derivative works of, and display Your Data, but only as needed to (a) provide the Cloud Service to you, (b) improve your experience...'”

The Privacy Policy discloses sharing with service providers, partners, resellers, and third-party apps under various conditions. While service providers are subject to DPAs, sharing with 'partners and resellers' and third-party apps is permitted with less explicit safeguards. A sub-processor list is referenced but not provided in documents.

“[Privacy] 'We share information with partners and resellers who provide consulting, sales, support, and technical services...If you, your administrator, or other users install third-party apps within the Offerings, these apps may access your account and information.'”

The Privacy Policy states retention periods are 'reasonable' but lacks specific timelines. Account information is retained 'while active and for a reasonable period afterward.' Content may remain visible to other users after account deactivation. Backup retention is mentioned but not clearly defined.

“[Privacy] 'We retain your account information while your account is active and for a reasonable period afterward...If your account is deactivated, some of your information and content may remain visible to other users.'”

The Customer Terms explicitly state that the user retains all ownership rights to their data and outputs. The vendor claims only a limited license to use data for service provision and improvement, not ownership of generated outputs.

“[ToS - Cloud Service Terms] 'You retain all ownership rights to Your Data, including any modifications made while using the Offering. You grant us a non-exclusive, worldwide license to use, copy, store, transmit, modify...but only as needed to (a) provide the Cloud Service...'”

The documents reference a Data Processing Addendum, Security Measures page, and compliance with Privacy Laws including GDPR and CCPA. However, specific certifications (SOC 2, ISO 27001, HIPAA) are not explicitly mentioned in the provided documents. A security page is referenced but not included.

“[ToS] 'For more detailed information, please see our Security Measures' and '[Privacy] 'Katalon complies with the EU-U.S. Data Privacy Framework' but specific certifications not stated in provided documents.”