Sybill AI

Sybill retains rights to 'aggregated and anonymous data' derived from user service use, but the Privacy Policy does not explicitly state whether user content (calls, transcripts, customer data) is used to train AI models. The language is vague on model training specifically, though aggregated/anonymized data retention is mentioned.

“[ToS] 'Sybill retains all rights to aggregated and anonymous data derived from your use of the Service, with the understanding that such data will not be identifiable as belonging to or emanating from you' (Section 5.1)”

Sybill grants itself a broad license to 'access, read, store, use, reproduce, display, modify, and disclose Content' for service provision and enforcement purposes. The license is limited to service delivery but includes modification rights and survives a 'reasonable wind-down period' after termination, creating ambiguity about post-termination obligations.

“[ToS] 'you grant Sybill a limited, non-exclusive, non-transferable worldwide, royalty-free, license to access, read, store, use, reproduce, display, modify, and disclose Content, solely for the purposes of (i) providing the Service, (ii) performing and enforcing this Agreement' (Section 2)”

Privacy Policy mentions sharing with 'Service Providers' and 'Customer account administrators' but lacks detail on sub-processor lists or specific DPA requirements. The policy states Sybill uses 'authorized Service Providers' but does not publish a sub-processor list or provide granular controls over third-party access.

“[Privacy] 'We may share personal data with third parties for the following purposes: Legal authorities when legally required, Service Providers who process data on our behalf, Customer account administrators and users within the same organization' (Section 7)”

For Customer Data, retention follows customer instructions. For Sybill User Data, retention is 'as long as reasonably necessary' for relationship maintenance, legal compliance, or dispute protection—vague language without specific time limits. Upon account termination, Sybill offers 30 days to download calls but then 'may delete' content with no obligation.

“[ToS] 'Upon termination or expiration of this Agreement...Thereafter, Sybill will be under no obligation to maintain your recorded calls, or make them available to you and Sybill may delete any of your Content' (Section 7.4); [Privacy] 'We retain Sybill User Data...for as long as it is reasonably necessary' (Section 6)”

The ToS explicitly states that users own generated content and outputs. Sybill retains rights only to feedback, aggregated/anonymous data, and service improvements. Users are granted a limited license to use the Service but retain ownership of their Content and any reports generated.

“[ToS] 'you are hereby granted a limited, non-exclusive, non-transferable right to use the Service during the Term for its internal purposes only...All rights relating to the Service not expressly granted herein are reserved by Sybill' (Section 5.2); Content ownership remains with customer under Section 2”

Sybill claims EU-U.S. Data Privacy Framework (DPF) certification and states compliance with GDPR and CCPA. However, no SOC 2 Type II, ISO 27001, or HIPAA certifications are mentioned. The Privacy Policy references DPF compliance but does not provide a dedicated security or trust page with detailed certifications.

“[Privacy] 'Sybill.ai complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. Data Privacy Framework (DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles' (Section 14)”