Keatext

Privacy Policy states AI Products use third-party providers (AWS, Amazon Bedrock) and data is 'shared with and processed by these AI Service Providers,' but lacks explicit clarity on whether customer data trains their models. No opt-out mechanism is mentioned, though the policy is vague on training purposes.

“[Privacy] 'Your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products.' No explicit statement on model training or opt-out.”

ToS grants Keatext a 'limited, non-exclusive, royalty-free, worldwide license' to use Customer Data 'only as may be necessary' to provide Services. However, the license scope is somewhat broad ('worldwide') and the ToS separately states Keatext owns Deliverables (structured database compilation) without clear restrictions on sublicensing or post-termination use.

“[ToS] 'Customer hereby grants Keatext a limited, non-exclusive, royalty-free, worldwide license to use the Customer Data...only as may be necessary for Keatext to provide the Services.' License terminates with service but Deliverables ownership is ambiguous.”

Privacy Policy lists broad categories of third-party sharing (Cloud Computing, Data Analytics, AI Platforms, Ad Networks) with stated contractual protections. However, 'Ad Networks' and 'AI Platforms' are vague categories, and the policy confirms sharing with 'service providers' under contract but does not publish a detailed sub-processor list or explicitly restrict marketing/analytics sharing of user content.

“[Privacy] 'We may share your data with third-party vendors...Cloud Computing Services, Data Analytics Services...Ad Networks, AI Platforms.' Contracts required but sub-processor list not published; Ad Networks involvement raises concerns.”

Privacy Policy states data retained 'as long as necessary' with a general limit of 'three (3) months past termination of the user's account,' but ToS allows 30-day retrieval window after which 'Keatext shall have no obligation to maintain...and may thereafter...delete all Customer Data.' Retention periods are vague and backup/archive retention is not clearly addressed.

“[Privacy] 'No purpose in this notice will require us keeping your personal information for longer than three (3) months past the termination of the user's account.' [ToS] 'After such 30-day period, Keatext shall have no obligation to maintain or provide any Customer Data.'”

ToS explicitly states 'Customer exclusively owns all right, title and interest in and to all Customer Data' and grants only a limited license to use Deliverables 'solely in connection with Customer's authorized use of the Services.' Keatext owns the database compilation but not the underlying Customer Data, providing clear IP protection.

“[ToS] 'As between Keatext and Customer, Customer exclusively owns all right, title and interest in and to all Customer Data...Keatext shall also own, as a compilation, the database of Customer Data...without owning the Customer Data itself.'”

Privacy Policy mentions GDPR compliance, Standard Contractual Clauses, and data protection measures, but no SOC 2, ISO 27001, or HIPAA certifications are explicitly stated. ToS references 'reasonable administrative, physical and technical safeguards' but no formal compliance certifications or published security documentation is provided.

“[Privacy] 'We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses.' [ToS] 'Keatext will maintain reasonable administrative, physical and technical safeguards.' No SOC 2, ISO 27001, or HIPAA mentioned.”