Rillet

The MSA states that Rillet does not permit Third-Party AI Providers to use Inputs/Outputs to train models 'beyond providing the Third-Party AI Technologies,' but Rillet itself retains a broad license to use Customer Content 'to test, evaluate, operate, develop, train, fine-tune, improve and create existing and new versions of the AI Features.' This creates ambiguity: Rillet's own training practices are permitted, though restricted to service improvement. No explicit opt-out mechanism is documented for Rillet's internal training.

“[MSA] 'Rillet does not permit any Third-Party AI Provider to use Inputs, Outputs, or Customer Content to train or improve its foundation or large language models beyond providing the Third-Party AI Technologies' AND 'process and use...the Customer Content as necessary for purposes of providing and improving the Platform and the Services (including without limitation to test, evaluate, operate, develop, train, fine-tune, improve and create existing and new versions of the AI Features)'”

The MSA grants Rillet a broad, non-exclusive, worldwide, royalty-free license to 'process and use (including as aggregated or combined with data Rillet has collected from other customers and partners) the Customer Content' for service improvement, training, and fine-tuning. The license extends to subcontractors and Third-Party AI Providers. This is perpetual during the Term and survives in aggregated/anonymized form. The scope far exceeds service delivery and permits derivative use.

“[MSA] 'Customer grants Rillet a non-exclusive, worldwide, royalty-free and fully paid license during the Term to: (a) process and use (including as aggregated or combined with data Rillet has collected from other customers and partners) the Customer Content as necessary for purposes of providing and improving the Platform and the Services (including without limitation to test, evaluate, operate, develop, train, fine-tune, improve and create existing and new versions of the AI Features)...The foregoing license also extends to Rillet's subcontractors or sub-processors, including without limitation Third-Party AI Providers.'”

The MSA and Privacy Policy indicate that Customer Content is shared with Third-Party AI Providers (OpenAI, Anthropic) to provide AI Features. The MSA restricts these providers from training on the data, but the Privacy Policy broadly permits sharing with 'service providers,' 'advertising partners,' 'partners,' and 'affiliates' without detailed sub-processor lists. A DPA is required for Personal Data, but the scope of non-Personal Data sharing to third parties remains vague.

“[MSA] 'Customer acknowledges and agrees that Rillet may submit Customer Content to Third-Party AI Technologies to provide Customer with the AI Features' AND [Privacy] 'We may share your personal information with...Service providers...Advertising partners...Partners...Affiliates' without explicit enumeration of all sub-processors.”

The Privacy Policy states retention is 'for as long as necessary to fulfil the purposes for which we collected it' and references 'legal, accounting, or reporting requirements' and 'compliance and protection' purposes, but provides no specific retention periods or automatic deletion timelines. The MSA requires return/destruction of Confidential Information within 5 business days of termination, but does not explicitly address Customer Content deletion timelines. Backup retention is mentioned but not clearly limited.

“[Privacy] 'We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements' AND [MSA] 'each Party shall...immediately return or, if requested by a Party, destroy all...Confidential Information...within five (5) business days' but 'the Receiving Party...may retain the Disclosing Party's Confidential Information retained in its standard archival or computer backup systems'”

The MSA explicitly states that 'The Customer Content, and Customer's Confidential Information, and all worldwide Intellectual Property Rights therein, are the exclusive property of Customer.' Rillet claims only a license to use the content for service delivery and improvement, not ownership. Outputs are deemed Customer Content, so the company retains IP rights over generated outputs.

“[MSA] 'The Customer Content, and Customer's Confidential Information, and all worldwide Intellectual Property Rights therein, are the exclusive property of Customer. All rights in and to the Customer Content and Customer's Confidential Information not expressly granted to Rillet in this Agreement are reserved by Customer.'”

The Privacy Policy mentions GDPR compliance and appoints EU/UK representatives, indicating GDPR awareness. The MSA references 'Applicable Privacy Laws' including GDPR and CCPA. However, no SOC 2 Type II, ISO 27001, HIPAA, or other formal security certifications are explicitly mentioned. A DPA is required but not provided in the documents. Security measures are described as 'reasonable' but not formally certified.

“[Privacy] 'Applicable Privacy Laws means...the General Data Protection Regulation (GDPR)...the California Consumer Privacy Act (CCPA)' AND [MSA] 'Rillet shall maintain reasonable data safeguards and procedures designed to prevent the unauthorized use or disclosure of Personal Data' but no formal certifications stated.”