Murf AI

Privacy Policy states data is used for 'Performing data analytics' and 'Customising our products and services' but does not explicitly state whether user content trains AI models. Voice cloning feature requires explicit consent for voice training, but general content training policy is ambiguous. No clear opt-out mechanism stated for non-voice data.

“[Privacy] 'Performing data analytics: We use the information about you to help us improve our products and services' and [ToS] 'you consent to our use and storage of the audio recordings and voices' for voice cloning only.”

ToS grants Murf a 'limited, non-exclusive, non-transferable, worldwide, royalty-free and sub-licensable license' to user content. License can be terminated by deleting content or closing account, but backup retention creates ambiguity. Sub-licensing rights are explicitly stated, which is moderately concerning for enterprise use.

“[ToS] 'you are granting to Murf a limited, non-exclusive, non-transferable, worldwide, royalty-free and sub-licensable license to use, process and transmit the Content' with exception for 'reasonable time it takes to remove Content from our backup systems.'”

Privacy Policy lists specific third-party vendors (Firebase, Google Cloud, Google Analytics, Mixpanel, etc.) and states they are 'obligated not to disclose or use it for other purposes.' However, sharing with 'affiliates' is mentioned without detailed restrictions, and data may be shared with government agencies. No published sub-processor list or DPA requirements explicitly stated.

“[Privacy] 'we only share your personal information with third parties that meet the data privacy conditions' including 'Marketing platforms, Communications platforms and contractors' and lists vendors, but also notes 'government third parties, including government agencies, regulatory bodies and law enforcement agencies as required.'”

Privacy Policy states data is retained 'as long as you keep your account open or as needed to provide you Services' and accounts are 'permanently delete[d]...within 30 days of account termination.' However, exceptions exist for legal compliance, fraud prevention, and dispute resolution, creating ambiguity about actual deletion timelines.

“[Privacy] 'We generally retain your personal information as long as you keep your account open' and 'We permanently delete account information...within 30 days of account termination, except as noted below' for legal obligations and fraud prevention.”

ToS explicitly states 'You own the content and information that you submit to the Services' and Murf only has a 'limited, non-exclusive' license for service delivery. Users can use outputs commercially and are not restricted from asserting exclusive ownership. This is enterprise-friendly.

“[ToS] 'You own the content and information that you submit to the Services' and 'You can use Murf created voices for commercial purposes' with no vendor claim to output ownership.”

Privacy Policy mentions EU-U.S. Data Privacy Framework (DPF) certification and compliance with GDPR principles, but does not explicitly state SOC 2, ISO 27001, or HIPAA certifications. DPF certification is noted but no detailed security documentation or trust page reference provided in available documents.

“[Privacy] 'Murf Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF)' and 'has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles' but no mention of SOC 2, ISO 27001, or HIPAA.”