Superhuman

The ToS permits Superhuman to use User Content for service improvement and developing new features, including training suggestion engines based on user acceptance/rejection of suggestions. However, the DPA explicitly states Superhuman will not process Customer Personal Data for purposes outside the direct business relationship, and the license is limited to specific service purposes. The language is somewhat vague on whether this extends to training foundation models, though Section 4.3 restricts using AI features to develop competing LLMs.

“[ToS] "your acceptance or rejection of our grammatical suggestions may help train our suggestion engine"; [DPA] "Superhuman will not Process Customer Personal Data outside of the direct business relationship between Customer and Superhuman"”

The ToS grants Superhuman a broad, worldwide, non-exclusive, royalty-free license to User Content for multiple purposes including improving services, developing new products, and creating derivative works. However, the license is limited to specified purposes (operating, improving, protecting, customizing services) and permits sublicensing only to service providers assisting with those purposes. The license duration is tied to IP law protection, which is indefinite but not explicitly perpetual.

“[ToS] "worldwide, non-exclusive, royalty-free license to your User Content...for the limited purposes of: (i) Operating, providing, improving, troubleshooting...Services...The above license lasts as long as intellectual property laws protect your User Content"”

The DPA restricts sharing to Sub-processors under strict data protection agreements and prohibits selling or sharing Customer Personal Data. However, the ToS permits sharing User Content with third-party integrations through the Superhuman Marketplace, and the DPA allows Sub-processors with only the same level of protection as the Addendum. A Sub-processor list is published but requires opt-in for notifications of new Sub-processors.

“[DPA] "Superhuman may engage Sub-processors to Process Customer Personal Data...A current list of Superhuman's Sub-processors is available at https://superhuman.com/legal/subprocessors"; [ToS] "you permit us to transmit your User Content to the provider of the Third-Party Service as necessary"”

The DPA requires deletion of Customer Personal Data upon termination at Customer's written request, but allows retention if required by law or on backup systems (which are securely isolated). The ToS states User Content can be deleted via account deletion but notes that once deleted, content cannot be retrieved. Backup retention periods are not explicitly specified, creating some ambiguity about how long archived data persists.

“[DPA] "Upon termination or expiry of the Agreement, Superhuman will, at the written request of Customer...securely destroy all Customer Personal Data...save that this requirement shall not apply to the extent Superhuman is required by applicable law to retain some or all of the Customer Personal Data, or to Customer Personal Data it has archived on back up systems"”

The ToS explicitly states that the user owns all right, title, and interest in User Content (Section 7.1). Superhuman's license is limited to providing the service and does not grant Superhuman ownership of outputs. AI-generated outputs are explicitly classified as User Content owned by the user (Section 4.1).

“[ToS] "You own all right, title, and interest in and to User Content"; "When you use our generative AI features, your Inputs and the resulting Outputs are your User Content"”

The DPA references SOC 2 audits and ISO 27001 certification (via Google Cloud infrastructure for Superhuman Mail), and mentions Data Privacy Framework certification. However, specific compliance certifications (SOC 2 Type II, GDPR, HIPAA) are not explicitly claimed in the main documents. The DPA references security pages and trust documentation but does not provide comprehensive certification details in the provided excerpts.

“[DPA Exhibit B] "Superhuman conducts an annual SOC 2 audit process"; "Superhuman's infrastructure is covered by Google's ISO 27001 certification and SOC 2 attestations"; "Superhuman participates in and certifies compliance with the Data Privacy Framework"”