Tropic

[ToS] Section 9.2 states Tropic may use Client Data to create 'Applicable Data' (de-identified/aggregated) for 'any business purpose, including without limitation to develop and improve Tropic products and services.' This indicates training on aggregated data is permitted, but the language is vague about whether raw user data feeds AI training directly. No explicit opt-out mechanism is documented.

“[ToS] 'Client hereby grants to Tropic a worldwide, non-exclusive, irrevocable, fully paid-up, royalty-free right and license to Process the Client Data for purposes of creating Applicable Data and to use and distribute such Applicable Data for any business purpose, including without limitation to develop and improve Tropic products and services'”

[ToS] Section 9.2 grants Tropic a 'worldwide, non-exclusive, irrevocable, fully paid-up, royalty-free right and license' to process Client Data for any business purpose. Section 9.5 on Feedback grants Tropic 'worldwide, non-exclusive, irrevocable, fully paid-up, royalty-free right and license to use and incorporate such Feedback into any Tropic product or service' with no restrictions. These are perpetual, irrevocable, and sublicensable licenses that survive termination.

“[ToS] 'Tropic and its successors and assigns may freely use, copy, disclose, sublicense, distribute, display and exploit any Feedback in connection with any of its products or services in any manner without any obligation, payment, royalty or restriction'”

[Subprocessors] Tropic lists 16 subprocessors including OpenAI, Google Cloud, AWS, and Datadog with access to customer data. [Privacy] Section on Disclosure states data may be shared with 'contractors, service providers and other third parties' and 'software vendors with your permission.' However, no explicit DPA requirements are stated for all subprocessors, and the subprocessor list lacks detail on data protection agreements. Sharing is broad but somewhat controlled.

“[Privacy] 'To Tropic personnel, contractors, service providers and other third parties we use to support the Tropic Platform and our business.' [Subprocessors] OpenAI listed for 'Document processing, Tropic copilot' with US location”

[Privacy] Section on Data Retention states Tropic retains data 'for as long as reasonably necessary to provide our products and services, to comply with our contractual obligations, as required by law, and in accordance with Tropic's data management policy.' This is vague ('reasonably necessary'). [Privacy] Account deletion removes personal information but 'copies of your User Contributions may remain viewable in cached and archived pages.' No specific retention periods or automatic purge timelines are documented.

“[Privacy] 'We retain Tropic Platform data, including personal information, for as long as reasonably necessary to provide our products and services, to comply with our contractual obligations, as required by law, and in accordance with Tropic's data management policy.'”

[ToS] Section 9.1 explicitly states 'Tropic owns and reserves all right, title and interest in and to the Platform, software and/or technology.' Section 9.2 grants Tropic rights to Client Data for creating derivative 'Applicable Data' which Tropic can use and distribute. Section 9.5 states Feedback becomes 'sole and exclusive property of Tropic.' Clients do not retain exclusive IP ownership over outputs or derivative works created with the platform.

“[ToS] 'Tropic owns and reserves all right, title and interest in and to the Platform, software and/or technology it provides to Client...any Tropic product or service incorporating such new features, functionality, or performance shall be the sole and exclusive property of Tropic.'”

No SOC 2, ISO 27001, GDPR compliance certification, or HIPAA compliance is mentioned in any document. [ToS] Section 4.4 explicitly states 'Tropic is not a Business Associate or subcontractor...and the Platform and Services are not HIPAA compliant.' [Privacy] mentions 'Google's Limited Use Policy' compliance but no formal security certifications or trust page is documented. No DPA is referenced as a standard document.

“[ToS] 'Client acknowledges that Tropic is not a Business Associate or subcontractor (as those terms are defined in the Health Insurance Portability and Accountability Act...and that the Platform and Services are not HIPAA compliant.'”