Phocas

The documents do not explicitly address whether Phocas uses customer data to train AI models. The Privacy Policy mentions using data for 'service improvement' and 'data analytics to improve our Site, products/services' but does not specifically state whether this includes AI model training or whether customer can opt out. Absence of explicit protection warrants a moderate concern score.

“Not found in documents — scored conservatively”

The documents do not explicitly define the scope of license granted by customers over their content or outputs. The Acceptable Use Policy references 'Intellectual Property Rights contained in the Agreement' but the actual EULA is not provided. Without explicit terms limiting the license to service delivery or confirming no sublicensing, this dimension cannot be fully assessed and defaults to moderate concern.

“[AUP] 'in any manner which does not comply with the provisions relating to Intellectual Property Rights contained in the Agreement'”

The Privacy Policy states data is shared with service providers, analytics providers, and advertising networks, but protections are vague. While it mentions 'We do not allow our third-party service providers to use your personal data for their own purposes,' it also discloses sharing with Google Analytics, HubSpot, AWS, and advertising networks (Google Ads, Facebook Ads, LinkedIn Ads) without explicit DPA requirements listed. Sub-processor list is not published.

“[Privacy] 'Service providers acting as processors, some of whom are based in the UK, the United States and Australia...These third parties include (but are not limited to) Hubspot, Inc and AWS Services' and 'advertising networks such as Google Ads...Facebook Ads...Linkedin Ads'”

The Privacy Policy states 'We will only retain your personal data for as long as necessary' and mentions a 7-year retention for tax purposes, but does not provide specific retention periods for different data types or clear timelines for deletion on request. The statement 'Details of retention periods for different aspects of your personal data can be requested from us' indicates retention schedules are not transparently published.

“[Privacy] 'We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for...By law, we have to keep basic information about our customers...for seven years after they cease being customers for tax purposes'”

The documents do not explicitly state who owns outputs generated by the Phocas software or whether the vendor claims any rights to user-generated content. The Acceptable Use Policy references IP rights but defers to the EULA which is not provided. Without explicit confirmation that users retain all IP ownership of outputs, this dimension cannot be fully assessed.

“Not found in documents — scored conservatively”

The Privacy Policy mentions GDPR compliance (references to ICO, Standard Contractual Clauses, data subject rights) and states 'We have put in place appropriate security measures' but does not cite SOC 2 Type II, ISO 27001, HIPAA, or other formal certifications. No dedicated security or trust page is referenced in the provided documents.

“[Privacy] 'Whenever we transfer your personal data to countries outside the EEA that lack an adequacy decision, we ensure a similar degree of protection is afforded to it as in Europe by ensuring adequate safeguards are in place, including entering Standard Contractual Clauses 2010/87/EU'”