Paradox AI

Paradox explicitly permits use of deidentified client data for AI training and model improvement. While data is deidentified, the language is permissive rather than restrictive, and the deidentification process relies on Paradox's own determination without independent verification requirements.

“[ToS] Paradox may use Deidentified Client Data (i) to build, improve and enhance the quality or performance of the Paradox offerings, including the training of Paradox's natural language processing functionality”

Paradox claims an unlimited, irrevocable, perpetual, worldwide, sublicensable license to all feedback and suggestions provided by clients. This is an extremely broad license that extends beyond service delivery to include derivative works and improvements.

“[ToS] Paradox will have an unlimited, irrevocable, royalty-free, worldwide, perpetual, transferable and sublicensable right and license to use and/or incorporate into the Paradox offerings, any suggestions, recommendations, requests or feedback relating to the Paradox offerings”

Paradox shares client data with Suppliers and Sub-Processors under DPA requirements, with a published sub-processor list and 30-day notice for new processors. However, the definition of 'Suppliers' is broad and includes unspecified third parties supporting service delivery, with limited transparency on specific categories.

“[ToS] Paradox will make Client Data available to Suppliers as required to provide the Cloud Software and in accordance with the Agreement. [DPA] A current list of Paradox Subprocessors is available at https://www.paradox.ai/legal/subprocessors”

Upon termination, Paradox will delete client data after 30 days, during which time data is made available for export. The 30-day window creates moderate exposure, and the language does not clearly address backup retention or data held for legal compliance purposes.

“[ToS] Paradox will delete Client Data provided under that Order Form after thirty (30) days of the applicable expiration or termination, during which time Paradox will make available to Client the Client Data relevant to such Order Form in a .csv file”

Paradox explicitly states that client owns all client data and generated outputs. Paradox disclaims any rights to client data except as necessary to provide services. The ownership language is clear and enterprise-friendly.

“[ToS] As between Client and Paradox, Client owns all Client Data. Except as set out in the Agreement, Paradox will not acquire any rights in Client Data or any related Intellectual Property Rights”

Paradox explicitly commits to SOC 2 Type II compliance and ISO 27001 standards, with audit reports available upon request. The company also references compliance with CCPA, VCDPA, and other state privacy laws in the DPA.

“[ToS] Paradox has implemented and will maintain a commercially reasonable, risk-based, written, information security program that includes administrative, technical, and physical safeguards designed to protect the Cloud Software and Client Data against accidental, unauthorized, or unlawful access, disclosure, destruction, loss, or misappropriation, consistent with ISO 27001, SOC 2 Type II, or equivalent industry standards”