Meticulous

[Privacy] explicitly states Meticulous has the right to use collected data to improve its internal software and test software. The policy confirms data is used for Meticulous's own purposes beyond service delivery, with no opt-out mechanism or distinction between free and paid tiers.

“[Privacy] 'Meticulous has the right to store all data collected by the Meticulous snippet...you agree to Meticulous having the right to use this data to test your software and for Meticulous to use this data to improve Meticulous's internal software.'”

[ToS] grants a broad license to Meticulous over user feedback and correspondence. The policy states all email and correspondence becomes Meticulous's 'sole and exclusive property' and feedback can be used without restriction or compensation, with no limitations on sublicensing or derivative works.

“[ToS] 'You acknowledge that all email and other correspondence that you submit to us shall become our sole and exclusive property' and 'we are free to use the Feedback without any additional compensation to you, and/or to disclose the Feedback on a non-confidential basis.'”

[Privacy] lists multiple third-party processors (Heap Analytics, Google Analytics, Stripe, Intercom, Uploadcare, Segment) with data sharing, but does not provide a comprehensive sub-processor list or explicit DPA requirements. Data flows to US-based services without clear contractual safeguards mentioned.

“[Privacy] 'The Data may be accessible to certain types of persons in charge...or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.'”

[Privacy] provides vague retention guidance tied to purpose ('as long as required by the purpose they have been collected for') but lacks specific timeframes. The policy allows indefinite retention where consent is given or legal obligations exist, with no automatic deletion on account termination explicitly stated.

“[Privacy] 'Personal Data shall be processed and stored for as long as required by the purpose they have been collected for...The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing.'”

[ToS] states users retain IP rights to their content ('nothing herein grants Owner any right, title or interest in any intellectual property rights of User'), but the broad feedback clause and data usage rights for service improvement create ambiguity about generated outputs and derivative works.

“[ToS] 'Except as expressly set forth herein, nothing herein grants Owner any right, title or interest in any intellectual property rights of User' but also 'we are free to use the Feedback without any additional compensation to you.'”

No compliance certifications (SOC 2, ISO 27001, GDPR, HIPAA) are mentioned in either the ToS or Privacy Policy. No security documentation, trust page, or formal DPA is referenced in the provided documents.

“Not found in documents — scored conservatively”