Metaview AI Recruiting Platform

Metaview explicitly permits machine learning on user data and aggregated/deidentified data for service improvement, model optimization, and analytics. However, the language distinguishes between 'User Content' (which the company processes under customer control) and 'Usage Data' and 'Aggregated Data' (which can be used for ML without restriction). The policy lacks a clear opt-out mechanism for training on aggregated data, creating moderate concern.

“[ToS] 'Nothing in these Terms prohibits Metaview from using such Machine Learning for testing, tuning, optimizing, validating, or otherwise enhancing the analytics, models, or algorithms underlying the Services.' Also: '[ToS] we may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services for its business purposes, including for machine learning and training.'”

Metaview grants itself a broad, worldwide, non-exclusive, royalty-free license to 'host, store, transfer, display, perform, reproduce, modify, export, process, transform, and distribute' user content 'in any media formats and through any media channels now known or hereafter developed.' While the customer retains ownership, the sublicensing rights and broad scope of permitted uses create moderate concern about content control.

“[ToS] 'You grant Metaview a worldwide, non-exclusive, royalty-free, fully paid right and license (with the right to sublicense) to host, store, transfer, display, perform, reproduce, modify, export, process, transform, and distribute your User Content, in whole or in part, in any media formats and through any media channels now known or hereafter developed.'”

The DPA lists specific sub-processors (AWS, Datadog, Hubspot, Rev, LogRocket, Twilio, Anthropic, OpenAI) with data processing agreements or SCCs in place. However, the ToS permits general sharing with 'affiliates' and 'partners' for service improvement, and Metaview reserves the right to add sub-processors with only 7 days' notice. The inclusion of AI vendors (Anthropic, OpenAI) for 'AI Functionalities' raises concerns about data flowing to third-party AI training systems.

“[DPA] Sub-processors include 'Anthropic (US) - AI Functionalities - DPA + Standard Contractual Clauses' and 'OpenAI (US) - AI Functionalities - DPA + Standard Contractual Clauses.' [ToS] 'Metaview shall inform the Customer at least 7 days in advance of any intended changes concerning the addition or replacement of any Sub-Processor.'”

The DPA states retention is 'for the duration of this Contract plus a reasonable period of time afterwards to allow for return or deletion of the Personal Data,' but 'reasonable period' is undefined. The ToS permits retention of 'Aggregated Data' indefinitely for business purposes. Deletion on request is mentioned but lacks specific timelines, creating moderate uncertainty about data lifecycle.

“[DPA Schedule 1] 'Duration of processing: For the duration of this Contract plus a reasonable period of time afterwards to allow for the return or deletion of the Personal Data.' [ToS] 'we may collect, create, process, transmit, store, use, and disclose aggregated and/or deidentified data derived from Data or use of the Services for its business purposes... All Aggregated Data will be in an aggregated and/or deidentified form only.'”

The ToS explicitly states that the customer retains all ownership rights to User Content and generated outputs. Metaview claims no ownership of the results of processing or the outputs generated by the service. This is an enterprise-friendly position with clear protections for company IP.

“[ToS] 'The Customer retains all ownership rights to the User Content processed using the Services.' Also: '[ToS] 'As between you and Metaview, you retain any copyright and other proprietary rights that you may hold in the User Content that you post to the Services.'”

The DPA references GDPR, UK GDPR, CCPA, and Data Protection Act 2018 compliance, and describes security measures (encryption, access controls, incident response). However, no explicit SOC 2 Type II, ISO 27001, or HIPAA certifications are mentioned. The security practices are documented in the DPA but formal third-party certifications are not claimed, creating moderate concern.

“[DPA] 'Both Parties shall comply with the Data Protection Laws with respect to the Processing of Personal Data' and detailed security measures including 'pseudonymisation and encryption of Personal Data' and 'regularly testing, assessing and evaluating the effectiveness of the security measures.' [ToS] 'The Site is not tailored to comply with industry-specific regulations (Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), etc.).'”