Artlist

The AI Services License states users retain all rights, title and interest in their Inputs. This is a user-favorable position, though users also grant Artlist a broad worldwide, irrevocable, royalty-free license to use those Inputs to operate and improve the service.

Artlist explicitly disclaims ownership of AI Output and assigns to the user whatever rights it may have, without restricting commercial use. Note that Output derived from Artlist's stock Assets is treated as an Asset and remains subject to the license restrictions rather than becoming user-owned Output.

The license prohibits USERS from using Artlist Assets to train AI models, but on whether ARTLIST trains on user Inputs the consumer documents are ambiguous: the grant permits using Inputs to 'improve the services,' which is not an explicit no-training commitment. The actual Privacy Policy, which would clarify this, was inaccessible.

The supplied consumer documents (contest terms, license, DMCA policy) contain no data retention schedule, no deletion SLA, and no mechanism for users to request deletion of their inputs or account data. The Privacy Policy that would normally cover this was inaccessible. Silence on retention and deletion is a material gap for professional users.

The consumer license is largely silent on sharing user data with third parties, though it does contemplate AI Services powered by third-party models (evidenced by the product surface listing Sora, Veo, Kling, ElevenLabs, etc.). Because the primary Privacy Policy was inaccessible, disclosure of sub-processors and data flows to those third-party model providers cannot be verified from the consumer text. The copyright policy does disclose that a claimant's contact details are shared with the artist.

The consumer documents supplied contain no explicit opt-out mechanism for data collection, model-training use, or third-party sharing. A 'do-not-sell' page URL exists in the inaccessible sources list but its content could not be read. Absent the Privacy Policy, opt-out rights cannot be confirmed, so this is rated cautiously rather than RED.

None of the supplied consumer documents claim or evidence any compliance certification or framework (no SOC 2, ISO 27001, GDPR/CCPA attestation, etc.). HIPAA is mentioned only to prohibit users from submitting protected health information, not as a compliance posture. Against the universal baseline and marketing/adtech frameworks, no relevant certifications are present in the consumer text.

The license discloses that AI Output may be non-unique, inaccurate, or error-prone and that users must review it, but provides no transparency into model behavior, no auditing capability, and no enterprise logging for the consumer tier. It acknowledges use of underlying models without naming specific ones in the policy text.

The supplied consumer documents disclose no security controls (no encryption at rest/in transit, access controls, penetration testing, bug bounty, or incident response commitments) and reference no trust center or security page. No breach history is discussed. This is a total silence on security in the accessible consumer text, in part because the Privacy Policy and any security page were inaccessible.

The consumer license distinguishes trial/watermarked users, Social, Pro, Team, and Max Business plans, but these differences are about usage rights and monetization scope, not data handling. It states Max Business/Enterprise agreements exist for companies over 50 employees. From the consumer documents alone, no material data-handling delta between free and paid consumer tiers is disclosed.

The consumer AI Services grant permits Artlist to use Inputs to operate and improve the service and to maintain security and integrity, which can involve access to inputs. The consumer documents do not explicitly commit to whether staff read prompts, though the enterprise terms are more explicit about review. This category is partially addressed at best in the consumer text.

The copyright policy describes a DMCA notice-and-counter-notice process and references cooperation with legal processes, and the contest terms impose sanctions-related eligibility limits. The consumer documents do not otherwise address government data requests or law enforcement cooperation in detail; that would typically appear in the inaccessible Privacy Policy.

The consumer license contemplates users uploading voice samples for voice cloning (potential biometric SPI) and collects contest/participant personal information, but it does not provide a full inventory of PII/SPI collected because the Privacy Policy is inaccessible. Voice samples and personal attributes are explicitly referenced as processed Inputs, which raises SPI considerations that are only partially disclosed in the accessible text.

The accessible license documents are recent (Pro/Business License effective February 15, 2026; Social License effective January 04, 2026; contest terms dated April 2026) and do address AI Services, AI Output, voice cloning, and third-party models generically. However, the product surface shows an AI-first platform routing to many named third-party models (Sora, Veo, Kling, ElevenLabs, Nano Banana, etc.) and MCP/Claude integration; the consumer license names none of these specific providers and the governing Privacy Policy was inaccessible, so coverage of the shipped product is only partial.

Multiple consumer documents were supplied (contest terms, Pro/Business License, Social License, copyright policy) and no material contradictions were found among them. The IP-ownership, forbidden-use, and licensing statements are consistent across the license variants. Note the primary Privacy Policy and Terms of Use were not retrievable, limiting the breadth of the cross-check.