Lightcast

[Privacy] states Lightcast collects and processes personal information for 'providing and improving our products and services' under legitimate interest, but does not explicitly state whether user data or content is used to train AI models. The phrase 'improving our products and services' is vague and could encompass model training. No explicit opt-out or prohibition on AI training is mentioned.

“[Privacy] 'We collect and process personal information directly from you or third parties for one of the following purposes: providing and improving our products and services, marketing, selling, or licensing our brand, products and services...'”

The provided documents do not explicitly address the scope of content licenses granted by users to Lightcast. The Privacy Policy discusses data collection and use but does not specify licensing terms, sublicensing rights, or whether licenses survive account termination. This absence of explicit protection warrants a moderate concern score.

“Not found in documents — scored conservatively”

[Privacy] states Lightcast shares personal information with 'third party service providers' who help deliver products and services, and requires them to maintain confidentiality. However, the policy also mentions sharing with 'other third parties' for legal compliance and other purposes, and references sharing 'business contact information' with clients to 'identify sales leads' and 'enrich customer relationship management records.' The scope of third-party sharing is somewhat broad and not fully restricted to essential infrastructure providers.

“[Privacy] 'We may share your personal information with third parties who help us in the delivery of our products and services to you... We may share your personal information to other third parties including: 1) As necessary to comply with our legal obligations...'”

[Privacy] states 'We will hold your personal data for as long as is necessary for the relevant purpose' and lists factors considered, but does not specify concrete retention periods, automatic deletion timelines, or what happens to data upon account termination. The language is vague ('as long as necessary') without clear operational timelines, creating moderate concern.

“[Privacy] 'We will hold your personal data for as long as is necessary for the relevant purpose. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity...'”

The provided documents do not explicitly address IP ownership of outputs generated by users through Lightcast services. Neither the Privacy Policy nor the Terms of Service excerpt provided contains language clarifying whether users retain ownership of generated content or whether Lightcast claims any rights. This absence of explicit protection is scored as moderate concern.

“Not found in documents — scored conservatively”

[ToS] footer displays logos and links indicating ISO 27001, GDPR, Privacy Shield, CCPA, and TX-RAMP compliance certifications, with a link to a Vanta trust page (app.vanta.com/lightcast.io/trust/...). This demonstrates published security certifications and compliance documentation meeting enterprise standards.

“[ToS] Footer displays ISO, GDPR, Privacy Shield, CCPA, and TX-RAMP certification badges linked to https://app.vanta.com/lightcast.io/trust/pkoilii8gbsmidtqljnary”