Sleuth

The documents do not explicitly state whether user data or customer data is used to train AI models. The ToS mentions Company may 'collect and analyze deidentified and/or aggregated data' for 'improvement' of Services, but this language is vague regarding AI training specifically. No clear opt-out or explicit prohibition on training is provided.

“[ToS] 'Company shall have the right collect and analyze deidentified and/or aggregated data...to improve and enhance the Services and for other development, diagnostic and corrective purposes'”

The ToS explicitly limits the license scope to providing the Services during the Term. Section 4.1 states Company receives only a 'nonexclusive license to use Customer Data to provide the Services during the Term' and that 'Customer shall own all right, title and interest in and to the Customer Data.' The license is clearly restricted and terminates with the agreement.

“[ToS] 'Customer shall own all right, title and interest in and to the Customer Data. Customer hereby grants to Company a nonexclusive license to use Customer Data to provide the Services during the Term'”

The Privacy Policy explicitly states 'we currently do not share or disclose your Personal Information to third parties for the third parties' direct marketing purposes.' The Trust Center lists specific integration access levels with clear restrictions (read-only, write for webhooks only, etc.), and the ToS Section 3.4 restricts disclosure to third parties only when 'required to have such information in order to perform the Services.' No broad sharing with advertising networks or data brokers is mentioned.

“[Privacy] 'We currently do not share or disclose your Personal Information to third parties for the third parties' direct marketing purposes' and [ToS] 'The Receiving Party shall not disclose any Confidential Information of the Disclosing Party to third parties...who are not required to have such information'”

The Privacy Policy states 'We allow our customers to delete their data from our systems' and California residents can request deletion within 45 days (up to 90 days), but no explicit default retention period or automatic deletion timeline is stated. The documents do not clearly specify how long data is retained before deletion or what happens to backups after account termination.

“[Privacy] 'We allow our customers to delete their data from our systems' and 'we will respond to your request within 45 days of receipt. If we require more time (up to 90 days), we will inform you'”

Section 4.1 of the ToS is explicit: 'Customer shall own all right, title and interest in and to the Customer Data.' The Company retains rights only to the Services and Software themselves, not to customer-provided data or outputs. No vendor license to outputs is claimed.

“[ToS] 'Customer shall own all right, title and interest in and to the Customer Data...Company shall own and retain all right, title and interest in and to the Services and Software'”

The Trust Center explicitly states 'We are SOC® 2 Type 2 compliant, certified by an independent third-party auditor' and 'GDPR compliant.' The Trust Center also documents security practices including encryption, SSO, 2FA, RBAC, and continuous bug bounty program via BugCrowd. These are enterprise-grade certifications with published security documentation.

“[Trust] 'We are SOC® 2 Type 2 compliant, certified by an independent third-party auditor...GDPR compliant' and 'Tested via third-party bug-bounty program'”