Pigment

The Privacy Policy mentions processing personal data 'for the purpose of improving our products and services' and specifically references 'develop and improve our Pigment AI Features' when customers provide data under contractual terms. However, the policy explicitly states it 'does not apply to the use of Pigment's SaaS products and services that are provided to our customers under specific contractual terms,' deferring to separate agreements. No explicit statement prohibits AI training on user data, nor is there a clear opt-out mechanism described in this document.

“[Privacy] 'This Policy does not apply to the use of Pigment's SaaS products and services that are provided to our customers under specific contractual terms' and 'when we process personal data to provide, develop and improve our Pigment AI Features.'”

The Privacy Policy does not address content licensing or intellectual property rights over user-generated content or outputs. It only covers personal data processing and retention. The policy defers SaaS product terms to 'specific contractual terms,' meaning the actual license scope would be defined elsewhere. Without explicit language in this document, a moderate concern score is appropriate.

“Not found in documents — scored conservatively”

The policy states personal data 'may be shared with our service providers (in particular, for IT services)' and that 'all personal data transfers are secured contractually.' However, it also mentions 'Third-party information about you and information collected from open and public databases: we work with partners and providers' without fully specifying which partners or what data categories are shared. The language is somewhat vague regarding the full scope of third-party access.

“[Privacy] 'Your personal data may be shared with our service providers (in particular, for IT services)... all personal data transfers are secured contractually' and 'we work with partners and providers to help us operate our services.'”

The Privacy Policy explicitly states a clear retention period: 'We will keep your personal data for 3 years after your last contact with us or, if there is a contract in place between us, after the end of our contractual relationship.' This provides a specific, defined retention timeline with automatic deletion after the stated period, which is enterprise-friendly.

“[Privacy] 'We will keep your personal data for 3 years after your last contact with us or, if there is a contract in place between us, after the end of our contractual relationship.'”

The Privacy Policy does not address IP ownership of outputs or content generated through the Pigment platform. It only covers personal data protection and processing. Since the policy explicitly defers SaaS product terms to 'specific contractual terms,' IP ownership would be defined in those separate agreements, not here. Absence of clarity in this document warrants a moderate concern score.

“Not found in documents — scored conservatively”

The Privacy Policy mentions GDPR compliance, French data protection law compliance, and describes security measures including 'Website SSL,' '24/7 systems monitoring,' and regular security scans. However, no formal compliance certifications (SOC 2 Type II, ISO 27001, HIPAA) are explicitly mentioned. The security practices are described but not formally certified or audited.

“[Privacy] 'Pigment has implemented a number of measures to protect your privacy and personal data and to meet the requirements of the GDPR' and 'Website SSL... 24/7 systems monitoring... regularly scanned for security breaches.'”