Nextbrowser

Policy states data is used to 'improve the functionality and performance of our Services' and mentions anonymized/aggregated data for 'research, analytics, and product improvement purposes.' However, no explicit statement about training AI models on user content. The ambiguity around 'product improvement' and lack of clarity on whether this includes model training creates moderate risk.

“We may also use anonymized or aggregated data for research, analytics, and product improvement purposes. This data does not identify individual users.”

Policy does not explicitly define the scope of license granted by users for their uploaded content, scripts, and task data. The absence of clear licensing terms regarding user-generated content creates moderate risk, though the policy does acknowledge users upload 'custom scripts or data.'

“User Input: Task names, configurations, workflows, or any custom scripts or data you upload to our platform”

Data is shared with multiple third-party categories including infrastructure providers (AWS, Cloudflare), analytics tools (Amplitude, Google Analytics), CRM systems, and acquiring parties in corporate transactions. While contractual obligations are mentioned, the breadth of sharing categories and vague 'if required by applicable law' language creates significant risk.

“We may share your data with the following categories of recipients, under strict contractual and confidentiality obligations: Infrastructure & Cloud Providers: (e.g., AWS, Cloudflare); Analytics & Monitoring Tools: (e.g., Amplitude, Google Analytics); Customer Support Platforms or CRM systems”

Policy allows retention 'for as long as (i) You maintain an active account, (ii) It is necessary to provide the Services, and (iii) It is required to comply with legal obligations.' After deletion, data may be retained 'in backups or archives for a limited period' without specifying duration. Users have right to erasure but it's 'subject to legal or legitimate business interests,' creating moderate risk.

“After your account is deleted or becomes inactive, we may retain data in backups or archives for a limited period, subject to legal or operational requirements.”

Policy is completely silent on intellectual property ownership of user-generated content, outputs, scripts, workflows, or task configurations uploaded to the platform. This absence creates significant risk as users have no clarity on whether they retain ownership of their work.

“User Input: Task names, configurations, workflows, or any custom scripts or data you upload to our platform”

Policy mentions 'Standard Contractual Clauses or other legal mechanisms' for international transfers and references 'applicable privacy regulations,' but provides no evidence of SOC2, GDPR, HIPAA, or ISO certifications. The absence of specific compliance certifications creates significant risk for enterprise use.

“We may process data outside your country of residence, subject to appropriate safeguards such as Standard Contractual Clauses or other legal mechanisms as required.”