Acti

The Terms explicitly state the user retains ownership of submitted inputs ('Your Content'), with ACTi granted only a limited license to use it to provide the Services. ACTi expressly disclaims ownership merely because content is submitted.

Users are permitted to use outputs for personal or business purposes, but the Terms do not grant clear ownership of outputs to the user — the right is framed as a conditional permission 'subject to' ACTi's rights in the underlying technology. This leaves output ownership ambiguous rather than vested in the user.

The Privacy Notice contains an unusually explicit no-training commitment covering conversational content, prompts, and uploaded documents, and extends it contractually to third-party AI providers. Any future change to train on identifiable content requires affirmative opt-in and would not apply retroactively.

The policy describes retention by data type: private-Being conversational content is not retained beyond real-time delivery, input content is kept for the service relationship and deleted/returned on termination, and analytics data is de-identified or deleted within 13 months. Deletion rights are offered but no concrete deletion SLA (response timeframe) is given beyond 'the time required by law,' and no security/audit-log retention schedule is specified.

The flagship Privacy Notice limits sharing to service providers under no-own-use contracts, the corporate group, and legal recipients, and states personal information is never sold or traded for marketing. However, the masterclass/registration sub-site policies disclose sharing with Meta, Hyros, and unnamed 'advertising and identity resolution partners,' which is broader than the flagship promise and creates a materially different posture depending on which page a user lands on.

The policies provide multiple concrete opt-out mechanisms: consent withdrawal at any time, GPC signal honoring, cookie controls, SMS STOP/email unsubscribe for marketing, and standard data-subject rights. A future opt-out link is promised should selling/sharing ever begin.

The vendor references ISO 27001, the NIST Cybersecurity Framework, the EU AI Act, and the NIST AI RMF as frameworks it 'follows' or 'works to align with,' but names no third-party attestation, audit report, or certificate — these are claims of alignment, not certifications. No SOC 2, ISO 27018, or ISO 42001 is claimed despite the enterprise/legal positioning, and GDPR/CCPA are addressed through practices rather than formal attestation.

The policy provides a human-in-the-loop commitment for consequential decisions and offers users the ability to request information about the logic involved, which addresses explainability at a conversational level. However, there is no mention of enterprise audit logs, model documentation access, or formal auditability tooling for business customers.

The policy discloses encryption at rest and in transit, access controls, network segmentation, least-privilege/zero-trust access, continuous monitoring, and separated data environments. No breach history is disclosed, and there is no reference to penetration testing, bug bounty, a trust center, or a formal security attestation; a referenced security docs page was inaccessible. Breach notification is promised 'as required by law.'

The Terms distinguish free and paid access but describe no material difference in data handling between the tiers — the same Privacy Notice governs both. The notable delta is between the flagship product pages (strong privacy posture) and the separate marketing/masterclass registration pages (Meta pixel, Hyros, identity-resolution partners), rather than between free and paid product use.

For private/client-facing Beings, conversations are not routinely reviewed by humans, and access is limited, purposeful, and logged. For marketing/sales Beings, recording and human review are clearly disclosed in advance, giving users notice of which mode they are in.

The policy addresses legal/safety disclosure of data where required by law and references litigation holds affecting deletion, but discloses no actual litigation, government requests, or law-enforcement cooperation history. The Terms impose New Jersey governing law and exclusive NJ jurisdiction, and shift broad indemnification obligations onto the user.

The vendor collects standard PII (name, email, phone, company/role, IP, approximate location, device and usage data) plus conversational content and uploaded documents that may contain anything users submit. Rather than prohibiting SPI, the policy only discourages submitting PHI and sensitive identifiers while acknowledging users may provide them — a concern given marketing into legal, medical, and finance verticals with persistent memory.

The governing documents are recent (Terms last updated August 13, 2026; Athena Terms August 25, 2026; the Privacy Notice variant August 27, 2026), well within 12 months of the October 2026 analysis date. They demonstrably cover the AI capabilities the product ships — conversational voice/text Beings, persistent contextual memory, third-party AI providers, and model-training practices — matching the product surface.

Eight documents were supplied across multiple sub-domains. They conflict materially on third-party sharing: the flagship Privacy Notice states sharing is limited and never for marketing, while the masterclass registration policies disclose Meta pixels, Hyros, and 'advertising and identity resolution partners.' Two documents are expressly labeled unfinished drafts, and retention periods differ (flagship 'service relationship'/13-month analytics vs. masterclass 'two years').