Tendem AI

Toloka trains on user content by default but provides an opt-out mechanism. Section 2.2(ii) explicitly states they use User Content and Output to 'train and improve Toloka's internal models.' However, Section 2.8 allows users to opt-out via account settings, making this moderate rather than high risk.

“use User Content and output to train and improve Toloka's internal models; and (iii) to generate, compile, and create de‑identified and/or aggregated data... You can control whether your User Content is used to train and improve Toloka's internal models by visiting your Account settings”

The license granted to Toloka is extremely broad. Section 2.2 grants a 'royalty-free, fully paid-up, worldwide, sublicensable, transferable' license for multiple purposes including training, improvement, and creating derivatives. The sublicensable and transferable nature to affiliates and in M&A transactions significantly expands the scope.

“You grant Toloka a royalty-free, fully paid-up, worldwide, sublicensable, transferable to its affiliates and in connection with a reorganization, merger, or sale), non-exclusive license to: (i) use, host, store, reproduce, display, perform, transmit, and process User Content and Output”

Data is shared broadly with third parties. Section 4 of Privacy Notice lists sharing with: affiliate entities, third-party vendors (CRM, billing systems), public authorities, and in M&A transactions. Section 1.4 of Terms allows subcontracting to 'affiliates and other third parties' including Experts. This is high risk for shadow AI.

“Toloka may engage, in its sole discretion, its affiliates and other third parties, including Experts and may use third-party software, models, data sources...Affiliate entities which are a part of the same group of companies...Third party vendors providing services to us...Various public authorities, if and exclusively when this is strictly necessary”

Data retention periods vary by purpose. Payment data is retained 7 years for compliance, analytics data 36 months, and support data retained during contract term. Users can request deletion under GDPR/privacy laws, but Toloka retains data for legal obligations and legitimate interests like fraud prevention, creating moderate risk.

“Payment Processing and Billing...7 years (as required for financial compliance)...Service Improvement and Analytics...36 months...Toloka will delete or anonymise your personal data so it no longer identifies you, unless Toloka is required to retain certain data or needs to use it for legally justifiable reasons”

IP ownership is clearly favorable to users. Section 2.1 explicitly states 'you own all right, title, and interest in and to User Content, and, upon full payment of applicable Fees, in Output.' Toloka only receives a license, not ownership. This is the safest dimension.

“As between the Parties, you own all right, title, and interest in and to User Content, and, upon full payment of applicable Fees, in Output. Except for the licenses expressly granted to Toloka in these Terms, no rights in User Content or Output are granted to Toloka.”

The Privacy Notice references compliance with GDPR, CCPA, HIPAA, and other regulations, and mentions security measures like encryption and vulnerability scans. However, no explicit mention of SOC2, ISO 27001, or other specific certifications. The document shows compliance awareness but lacks explicit third-party certification claims.

“We employ various technical and organizational safeguards to protect personal data against loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. These measures include: encrypting personal data in transit and at rest; conducting regular vulnerability scans”