Tapistro

[ToS] states Company may 'collect, analyze and otherwise exploit data and other information relating to the provision, use and performance' and use it to 'improve and enhance the Services,' but does not explicitly state whether Customer Data or user inputs are used to train AI models. Language is vague on training specifically; no explicit opt-out mechanism provided.

“[ToS] 'Company shall have the right to collect, analyze and otherwise exploit data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, Customer Data and data derived therefrom)'”

[ToS] explicitly states 'Customer shall own all right, title and interest in and to any data, information or other materials that are submitted by the Customer to the Services or otherwise made available to the Company in the provision of the Services, including, without limitation, the Input and Output.' This clearly grants ownership to the customer with no sublicensing rights claimed by the vendor.

“[ToS] 'Customer shall own all right, title and interest in and to any data, information or other materials that are submitted by the Customer to the Services...including, without limitation, the Input and Output.'”

[Privacy] mentions sharing with 'Service providers,' 'Advertising partners,' and 'Professional advisors' but lacks detail on specific sub-processors, DPA requirements, or restrictions on how these parties use data. [ToS] states Company may disclose data 'solely in aggregate or other de-identified form' but does not comprehensively address third-party sharing of personal data or Customer Data.

“[Privacy] 'We may share your personal information with: Service providers...Advertising partners...Professional advisors' and [ToS] 'disclose such data solely in aggregate or other de-identified form in connection with its business'”

[ToS] states 'Upon any termination, Company may make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Customer Data.' This creates ambiguity: deletion is optional after 30 days, and no clear retention period is specified during the active term.

“[ToS] 'Upon any termination, Company may make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Customer Data.'”

[ToS] explicitly grants full IP ownership to Customer: 'Customer shall own all right, title and interest in and to any data, information or other materials that are submitted by the Customer to the Services...including, without limitation, the Input and Output.' Company retains rights only to the Service itself and improvements thereto, not to customer-generated outputs.

“[ToS] 'Customer shall own all right, title and interest in and to any data, information or other materials that are submitted by the Customer to the Services...including, without limitation, the Input and Output.'”

Neither [ToS] nor [Privacy] mentions SOC 2, ISO 27001, HIPAA, or formal GDPR compliance certifications. [ToS] references GDPR in the context of data controller/processor roles but provides no evidence of formal compliance certification or published security documentation. No trust page, security whitepaper, or DPA is referenced.

“Not found in documents — scored conservatively. [ToS] mentions 'GDPR' and data processor role but no certifications stated. [Privacy] states 'We employ a number of technical, organizational and physical safeguards' without specifying standards or certifications.”