Suno AI

Suno explicitly states it uses user content to train and improve AI models. The Privacy Policy states: 'To Develop and Improve our Products and Services. We use certain User Activity Information, Submissions, Interactive Chat Information, and other Content to improve our Services...including to train and enhance the models that power our Services.' The ToS further confirms: 'no other licenses, permissions, consents or authorizations must be obtained...arising out of or related to our use of your Submissions, including to create your Output or your Voice Model and/or to train, develop, fine-tune or otherwise improve the Service and any related artificial intelligence or machine learning models.' There is no opt-out mechanism mentioned, and this applies to all tiers including free users.

“[Privacy] 'We use certain User Activity Information, Submissions, Interactive Chat Information, and other Content...to train and enhance the models that power our Services' and [ToS] 'to train, develop, fine-tune or otherwise improve the Service and any related artificial intelligence or machine learning models'”

Suno claims a perpetual, irrevocable, worldwide, sublicensable license to all user content. The ToS explicitly states: 'you grant to Suno and our affiliates, successors, assigns, and designees a worldwide, non-exclusive, fully paid-up, sublicensable (directly and indirectly through multiple tiers), assignable, royalty-free, perpetual, irrevocable right and license to use, reproduce, store, modify, distribute, create derivative works based on, perform, display, communicate, transmit and otherwise make available any and all Content.' This license survives account termination and includes sublicensing to other users and third parties. The license is not limited to service provision.

“[ToS] 'you grant to Suno and our affiliates, successors, assigns, and designees a worldwide, non-exclusive, fully paid-up, sublicensable (directly and indirectly through multiple tiers), assignable, royalty-free, perpetual, irrevocable right and license to use, reproduce, store, modify, distribute, create derivative works based on...any and all Content'”

Suno shares data with service providers under written contracts requiring protection, but the scope of 'service providers' is broadly defined to include 'artificial-intelligence or machine-learning services' and 'advertising, marketing and related analytics services.' The Privacy Policy states data may be shared 'with third parties that provide...artificial-intelligence or machine-learning services' and 'advertising, marketing and related analytics services.' While DPAs are mentioned for service providers, the list of sub-processors is not published. Data may also be shared in merger/acquisition scenarios. This creates moderate concern about the breadth of potential sharing.

“[Privacy] 'We work with third parties that provide...artificial-intelligence or machine-learning services that support certain features of the Services; advertising, marketing and related analytics services' and 'We share your information with these service providers only for our business purposes pursuant to written contracts'”

Retention periods are vague and context-dependent. The Privacy Policy states: 'We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Notice' without defining specific timeframes. For biometric data (voice models), retention is limited to 'no longer than three (3) years following your last interaction,' but other data types lack clear retention limits. The ToS mentions Suno 'reserves the right to terminate accounts (and all of their corresponding Submissions and Output) that are inactive for an extended period' but does not specify the period. Deletion on request is promised 'within a reasonable period of time' but exceptions are broad.

“[Privacy] 'We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Notice' and 'We will comply with your request within a reasonable period of time; however, in certain circumstances, we may not be able or required to delete all of your information'”

IP ownership depends on subscription tier, creating ambiguity. For Pro/Premier paid tiers, the ToS states: 'Suno hereby assigns to you all of its right, title and interest in and to any Output owned by Suno and generated from Submissions made by you.' However, for free and Basic tiers, users 'covenant and agree that you will only use Outputs...solely for your lawful, internal, personal and non-commercial purposes.' The ToS also notes: 'due to the nature of machine learning, Suno makes no representation or warranty to you that any copyright will vest in any Output.' This creates uncertainty about actual ownership and enforceability of IP rights, particularly for free tier users.

“[ToS] 'Subject to your compliance with these Terms of Service, if you are a user who has subscribed to the Pro or Premier paid tier...Suno hereby assigns to you all of its right, title and interest in and to any Output' but 'due to the nature of machine learning, Suno makes no representation or warranty to you that any copyright will vest in any Output'”

No specific compliance certifications (SOC 2, ISO 27001, HIPAA, or formal GDPR compliance) are mentioned in the provided documents. The Privacy Policy references GDPR rights for EEA residents and states data transfers comply with GDPR safeguards, but does not claim formal GDPR certification or SOC 2 Type II compliance. The Privacy Policy mentions 'commercially reasonable security measures and safeguards' but provides no third-party audit evidence or published security documentation. This absence of explicit certifications creates moderate concern.

“Not found in documents — scored conservatively. [Privacy] mentions 'commercially reasonable security measures and safeguards' and GDPR compliance but no formal certifications stated”