Uplifted AI Agent

The Privacy Policy states that Anthropic is 'contractually prohibited from using your data to train its models without your consent' (Section 11.3), which provides some protection. However, the ToS does not explicitly address whether Uplifted itself trains on user content, and the Privacy Policy's language about 'Output' (non-customer-identifying data used to improve the Platform) is vague regarding training. The absence of explicit opt-out language and clear default protections for all tiers creates moderate concern.

“[Privacy] 'Anthropic processes this data solely to provide the requested service and is contractually prohibited from using your data to train its models without your consent.'”

The ToS grants Company broad rights to 'Output' (non-customer-identifying data, metadata, analytics) for service improvement and derivative works (Section 6: Ownership). While the ToS states 'The Content shall be owned by the End User,' it also grants Company the right to 'access, use, and process any Content for the purposes of provision, and improvement, of the Platform.' This creates ambiguity about the scope of Company's license to user-generated content and whether it survives termination.

“[ToS] 'Company may access, use, and process any Content for the purposes of provision, and improvement, of the Platform or Services' and Company owns 'any non-Customer-identifying information, data, reporting...analytics...which may be used by Company...to improve the Platform.'”

The Privacy Policy discloses sharing with Anthropic (Section 11.3) and connected third-party tools (Section 11.5) under their own privacy policies, but does not provide a comprehensive sub-processor list or explicit DPA requirements for all third parties. The ToS mentions sharing with 'affiliates' and 'partners' (Section 3.2-3.4) for business transfers and regulatory compliance, but lacks detail on routine operational sharing. The statement 'A current list of AI sub-processors is available upon request' suggests the list is not proactively published.

“[Privacy] 'A current list of AI sub-processors is available upon request at privacy@uplifted.ai' and 'Each connected tool operates under its own privacy policy and terms of service. Uplifted is not responsible for the data practices of connected third-party tools.'”

The Privacy Policy states data is retained 'until we delete the record and we proactively delete it or you send a valid deletion request' but allows retention 'for longer periods of time' for legal, regulatory, or litigation purposes (Section 2.1). The ToS does not specify automatic deletion timelines upon account termination. While deletion on request is mentioned, the vague 'longer periods' language and lack of explicit purge timelines create moderate concern about data exposure duration.

“[Privacy] 'Your Personal Data will be stored until we delete the record and we proactively delete it or you send a valid deletion request, please note that in some circumstances we may store your Personal Data for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.'”

The ToS states 'The Content shall be owned by the End User' (Section 6: Content), which appears to protect user IP. However, Company claims ownership of 'Output' (aggregated analytics, metadata, improvements) and retains broad rights to use Content 'for the purposes of provision, and improvement, of the Platform.' The distinction between 'Content' (owned by End User) and 'Output' (owned by Company) is somewhat ambiguous, and Company's right to create derivative works from Output creates moderate concern about IP boundaries.

“[ToS] 'The Content shall be owned by the End User, Customer hereby acknowledges that according to the license granted by the End User, Company may access, use, and process any Content for the purposes of provision, and improvement, of the Platform or Services.'”

The documents do not mention SOC 2, ISO 27001, HIPAA, or any formal compliance certifications. The Privacy Policy references GDPR compliance and states 'we have implemented appropriate technical, organizational and security measures' (Section 2.1), but provides no evidence of third-party audits or published security certifications. The absence of any compliance documentation or trust page represents high risk for enterprise use.

“Not found in documents — scored conservatively. [Privacy] 'We have implemented appropriate technical, organizational and security measures designed to protect your Personal Data' provides no certification evidence.”