Phrase AI

Phrase explicitly states it will train ML models on customer content by default, with only limited opt-out for text-based generative outputs requiring 'prior approval.' Non-text models and internal research use customer data without explicit consent requirements.

“[ToS] 'The Phrase Group may use the Customer Content to train its machine learning models and algorithms ("ML Models") in order to enhance and optimise its solutions and offerings.' Section 3.3-3.5 permits training unless customer objects to text-based outputs specifically.”

Customer grants Phrase a broad, non-exclusive license to use customer content for service provision, enhancement, trend analysis, and ML model training. The license survives termination per Section 5.6, and feedback grants Phrase a perpetual, irrevocable, worldwide, exclusive license.

“[ToS] Section 3.2: 'Customer grants Phrase a non-exclusive, non-transferable, and non-sublicensable (other than to the other members of the Phrase Group and its suppliers) licence to use the Customer Content for the purposes of providing the Phrase Solution to Customer and to maintain and enhance its products and service offerings, including for the purposes of trend analysis.'”

Phrase shares customer data with Phrase Group affiliates and suppliers under confidentiality obligations. Sub-processors are listed and require DPAs, but customer data may be transferred outside preferred location to third-party suppliers without explicit per-transfer consent.

“[DPA] Section 6.1.3: 'Phrase may transfer Customer Personal Data to these sub-processors' and Section 8.1: 'provision and maintenance of a Phrase Solution...may require processing of Customer Personal Data by sub-processors in countries outside the European Economic Area, namely in the USA, UK and Japan.'”

Phrase retains customer content for 60 days after deletion and may retain data longer if required by law or during renewal negotiations. Retention period is stated but backup/archival practices are vague, and customer is responsible for backup.

“[DPA] Section 3.3: 'Phrase will process Customer Personal Data for the purpose of providing and maintaining the Phrase Solution as long as the Customer Personal Data is uploaded to the Phrase Solution and for 60 days following Customer permanently deleting the Customer Personal Data from the Phrase Solution.'”

Customer retains full ownership of customer content and generated outputs. Phrase explicitly disclaims ownership of customer content and does not claim rights to outputs, only to the underlying service and feedback.

“[ToS] Section 4.2: 'As between Phrase and Customer, Customer is, and will at all times, remain the owner of the Customer Content. Customer's Intellectual Property Rights in the Customer Content will not be affected by use of a Phrase Solution.'”

Phrase references GDPR, UK GDPR, and CCPA compliance and mentions a security page with information security measures, but no specific SOC 2, ISO 27001, or HIPAA certifications are explicitly stated in the provided documents.

“[ToS] Section 13.2: 'Phrase will maintain appropriate administrative, technical, and procedural safeguards designed to protect the security, confidentiality and integrity of Phrase Solutions...A non-exhaustive list of Phrase's information security measures is available on the Phrase security page.'”