mabl

mabl claims it does not use Data for AI training by default, but the language is vague regarding 'service improvement' and 'develop, improve, evaluate and market' products. The distinction between Data and Aggregated Data creates ambiguity about what constitutes training material.

“[ToS] "to develop, improve, evaluate and market mabl's products and services" and [ToS] "Aggregated Data does not include your Confidential Information, Personal Data, nor information identifying any identifiable individual."”

mabl grants a broad, sublicenseable license to Data for service provision and product improvement, but the license is limited to the Term and terminates upon deletion request. However, Aggregated Data receives a perpetual, irrevocable, sublicenseable license, creating moderate concern.

“[ToS] "you hereby grant to mabl a worldwide, non-exclusive, fully paid-up, royalty-free, sub-licenseable and transferable license to use, reproduce, display, distribute, transmit and store Data... to develop, improve, evaluate and market mabl's products and services."”

mabl shares Data with service providers under DPA obligations and states it will not sell Personal Information without consent. However, the language regarding 'affiliates' and 'partners' is somewhat vague, and Aggregated Data can be shared broadly without restriction.

“[Privacy] "we may share your Personal Information with third parties including service providers... provided that such third parties are obligated to protect your Personal Information under the Principles... have entered into an applicable data processing agreement" and [Privacy] "Except as set forth herein or in a separate agreement between you and mabl, mabl will not rent, sell or share your Personal Information it collects to, or with, third parties without your consent."”

mabl states Data will be deleted upon written request within 30 days, but retains it indefinitely if no deletion request is made. Aggregated Data is retained perpetually. Backup retention and legal hold exceptions are mentioned but not clearly detailed.

“[ToS] "Upon expiration or termination of these TOS and receipt of your written notification within thirty (30) days of the date of such event... mabl shall promptly thereafter remove Data from the Service... unless Data is required to be retained pursuant to a court order."”

mabl explicitly states that users own all Data and intellectual property rights therein. The vendor claims no ownership of user-generated outputs, only a license to use Data for service delivery and improvement.

“[ToS] "As between you and mabl, subject to the rights granted to mabl under this Agreement, you own all worldwide right, title and interest, including all intellectual property and other proprietary rights, in and to Data."”

mabl mentions industry-standard security measures and SSL encryption but does not explicitly reference SOC 2, ISO 27001, GDPR compliance certifications, or HIPAA. GDPR compliance is discussed for EEA residents but formal certification is not claimed.

“[ToS] "mabl is committed to protecting the security of your Data and Personal Data in accordance with industry standards, and applicable law or regulations. We use a variety of administrative, physical and technical safeguards and procedures" and [Privacy] "mabl is committed and takes precautions including a variety of industry standard administrative, technical and physical measures."”