Read AI

Read AI uses user data to train and improve models, but with some protections. Google Workspace data is explicitly restricted from generalized AI training, but broader meeting data and audio/visual information may be used for model improvement within the service. The policy lacks clear opt-out mechanisms for non-Google data training.

“[Privacy] "We do not, and do not permit third party AI tools to, use user data collected via Google Workspace APIs to develop, improve, or train generalized/non-personalized AI and/or ML models." But [Privacy] "Provide, maintain, and improve (consistent with your account settings) our Services, including maintaining user accounts with us and using information to train and improve our models within our Services"”

The ToS grants Read AI a broad, perpetual, sublicensable license to user content for service improvement without clear termination limits. The license is worldwide, fully paid, and explicitly sublicensable through multiple tiers, with users waiving moral rights. This is highly unfavorable for enterprise IP protection.

“[ToS] "you grant Read AI a nonexclusive, royalty-free, worldwide, fully paid, and sublicensable (through multiple tiers) license to use, reproduce, and analyze your User Content only for purposes of creating, providing, and improving our Services" and "You hereby irrevocably waive any 'moral rights' or other rights with respect to attribution of authorship or integrity of materials"”

Read AI shares data with vendors, service providers, and AI tools, with some controls mentioned. However, the policy broadly permits sharing with 'vendors and service providers' and 'AI tools' without publishing a comprehensive sub-processor list. Marketing partners receive identifiers and inferences for targeted advertising. No explicit DPA requirement stated for all sub-processors.

“[Privacy] "We make available personal information available to our vendors, service providers, and consultants who perform services on our behalf, such as companies that assist us with web hosting, data storage, data analytics, payment processing, fraud prevention, customer service, AI tools, and marketing and advertising." [Privacy] "we share and sell the following categories of personal information to the following categories of third parties: Identifiers... Marketing and advertising partners"”

Read AI states audio/video data is retained for no longer than 2 years, which is a defined limit. However, other data retention periods are vague ('as long as necessary'), and the policy allows indefinite retention of aggregated/de-identified data. Deletion on request is mentioned but lacks specific timelines.

“[Privacy] "We store your audio and video information, including information derived therefrom, in accordance with our internal policies, but in no case for longer than 2 years." But [Privacy] "We store information we collect for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes" and [Privacy] "We may disclose aggregated or de-identified information that cannot reasonably be used to identify you."”

The ToS explicitly states that users retain ownership of their User Content. Read AI's license is limited to providing and improving the service, and does not claim ownership of outputs. This is enterprise-friendly.

“[ToS] "You retain ownership of your User Content and, except for the license you grant in Section 3(b), as between you and Read AI, you retain all other rights in and to your User Content."”

The Privacy Policy mentions Standard Contractual Clauses for GDPR compliance and references EU/UK/Swiss data protection frameworks, but no SOC 2, ISO 27001, HIPAA, or other formal certifications are explicitly stated. A trust page or security documentation is not referenced in the provided documents.

“[Privacy] "We provide adequate safeguards for the transfer of information in accordance with applicable law, such as by obtaining your consent, relying on the adequacy decisions from relevant regulatory bodies, or executing Standard Contractual Clauses." No mention of SOC 2, ISO 27001, or HIPAA certifications found in documents.”