vLex Vincent AI

The ToS explicitly prohibits users from using the Services to train AI models (Section 4(c)(4)), but vLex itself reserves broad rights to use User Content for service improvement and derivative works. The Privacy Policy states data is used to 'improve our products and services and to create aggregated and de-identified information,' which is vague on whether this includes AI training. The ToS grants vLex an 'irrevocable, perpetual' license to 'modify' and 'distribute' User Content for improvement purposes, suggesting potential AI training use.

“[ToS] 'Using the Services or Content for training any AI models' is prohibited for users. [ToS] vLex grants itself 'irrevocable, perpetual, transferable, sublicensable...right and license to use, copy, store, modify, distribute and display Your User Content...to improve our products and services.'”

The ToS grants vLex an extremely broad, perpetual, irrevocable, sublicensable, worldwide license to User Content with no termination date. The license explicitly permits modification, distribution, and derivative works 'to improve our products and services' with no restrictions on commercial use or sublicensing depth. This is a high-risk, vendor-favorable term.

“[ToS] Section 8(c): 'You grant...to vLex an irrevocable, perpetual, transferable, sublicensable (through multiple tiers), fully paid, royalty-free, and worldwide right and license to use, copy, store, modify, distribute and display Your User Content...to improve our products and services.'”

The Privacy Policy explicitly lists extensive third-party sharing including advertising networks (Google), analytics (Mixpanel, KISS Metrics), payment processors, and collection agencies. Data is shared with 'affiliates' and 'partners' with minimal DPA requirements stated. The policy permits transfer outside the EEA and states data may be shared with 'any other country where VLEX facilities or its affiliates, subsidiaries or service providers are located' with only vague 'adequate level of protection' assurances.

“[Privacy] 'VLEX may disclose personal information to...Marketing and Public Relations Companies, including email sending companies and Analytical Services companies...Online Advertising Companies, such as Google, Inc. (USA)...Datacenters and Hosting Companies, such as Amazon Web Services, LLC (USA).' Data transfers outside EEA are permitted with minimal safeguards.”

The Privacy Policy states data is retained 'for a period never exceeding 10 years from the end of the contractual relationship' and 'as long as it is necessary' to comply with objectives or legal requirements. While a 10-year limit is stated, the vagueness of 'necessary' and the long retention period create moderate concern. Deletion on request is mentioned but no specific timeline is provided ('within a reasonable period').

“[Privacy] 'VLEX will keep the user's personal information as long as it is necessary...for a period never exceeding 10 years from the end of the contractual relationship.' Deletion requests will be addressed 'Within a reasonable period and once your identity is verified.'”

The ToS explicitly states 'You retain all Intellectual Property rights in the content You provide' (Section 8(a)), but immediately grants vLex a perpetual, irrevocable, sublicensable license to use, modify, and distribute that content. This creates a situation where while the company nominally retains IP ownership, vLex has effectively unrestricted rights to the outputs, preventing exclusive assertion of ownership.

“[ToS] Section 8(a): 'You retain all Intellectual Property rights in the content You provide...You grant...to vLex an irrevocable, perpetual, transferable, sublicensable...right and license to use, copy, store, modify, distribute and display Your User Content.'”

The Privacy Policy mentions GDPR compliance and references a Data Protection Officer (dpo@vlex.com), but no formal certifications (SOC 2, ISO 27001, HIPAA) are explicitly stated. The vLex Justis policy mentions registration with the UK Information Commissioner's Office but provides no evidence of SOC 2 Type II or other major security certifications. Basic security measures are described but formal compliance documentation is not referenced.

“[Privacy] 'vLex Justis complies with all applicable data protection legislation, including...the EU Regulation 2016/679 (General Data Protection Regulation)' and 'is registered as a data controller with the Information Commissioner's Office in the UK.' No SOC 2, ISO 27001, or HIPAA certifications mentioned.”