Augmenta

The privacy policy never addresses ownership of user-submitted prompts, project files, or building models — it only speaks to 'personal information.' Absent a Terms of Service or MSA, there is no stated ownership grant either way, leaving input ownership unresolved.

The policy references 'generated output' only as a category of usage data it collects, not as content the user owns. There is no statement assigning ownership of AI-generated models or designs to the user, which is a significant gap for a design-automation tool.

The policy states collected usage data — including generated output and screen recordings — is used to 'update and improve the Platform,' language that plausibly encompasses model/product improvement. It never explicitly says whether user inputs train AI models, nor does it offer an opt-out from this use, so the risk is ambiguous rather than clearly disclosed.

The policy describes only a general 'no longer than necessary' retention standard with no concrete schedules, deletion SLAs, or self-service deletion mechanism. Users may withdraw consent and request access/correction in writing, but no defined timeline for deletion is given.

Augmenta states it does not sell or rent personal information and limits service-provider access to what is needed, but it also engages ad networks and advertising companies for interest-based advertising and may transfer data in a sale of business. Sharing is disclosed, but the advertising/tracking involvement and cross-border transfers add moderate risk beyond what the core design service strictly requires.

The policy provides real opt-out mechanisms for marketing email (unsubscribe) and interest-based advertising (DAAC), plus a general right to withdraw consent. However, there is no opt-out mechanism specific to platform usage-data collection or its use to 'improve the Platform,' limiting user control over the most sensitive processing.

The policy names no compliance frameworks or certifications whatsoever — no SOC 2, ISO 27001/27017/27018, GDPR, CCPA/CPRA, or NIST references appear. For a professional developer-infra/enterprise SaaS tool, the complete absence of any attested framework is a significant gap, and the policy's Canadian-privacy-law orientation leaves EU/US statutory posture unaddressed.

The documents are entirely silent on model transparency, explainability, or enterprise auditing capabilities. For an AI system generating construction-critical designs, the absence of any auditability commitment is a notable gap.

The policy asserts 'reasonable administrative, technical and physical measures' and need-to-know access restrictions but discloses no specifics — no encryption at rest/in transit, penetration testing, bug bounty, incident response, or breach history, and no security page or trust center is referenced. The generic language provides little assurance for professional users.

No enterprise agreement was retrievable, and the privacy policy makes no distinction between free/demo and paid tiers of data handling. It is oriented toward business users (work email, employer-provided accounts) but does not describe differentiated protections, so any enterprise-specific carve-outs cannot be confirmed.

The policy grants employees and service providers need-to-know access and collects screen recordings for support and improvement, implying staff may view user activity. There is no explicit statement reserving or limiting human review of platform inputs/outputs, leaving the scope of human access ambiguous.

The policy discloses that Augmenta may disclose personal information in response to legal process and to law enforcement or government authorities, including lawful access by U.S. and foreign courts. No active litigation is referenced, but the broad government-access language and cross-border exposure warrant attention for sensitive projects.

Augmenta collects business-contact PII (name, work email/phone, company, job title), IP addresses, device/browser data, usage patterns, and screen recordings; for job applicants it may collect criminal-record checks (SPI) with consent. The collection is disclosed with purpose, but screen recordings and criminal-background data are meaningful additions that elevate the profile above minimal.

The policy is very recent (Last Updated 18 August 2026, days before the analysis date) and does describe the Platform as software that automates building/construction design. However, despite the product being an AI-native spatial-AI tool (ACP 2.0), the policy never explicitly addresses AI/ML model training, third-party model providers, or generative-output data flows in any depth — only generic 'improve the Platform' language. Coverage of the shipped AI capabilities is therefore only partial.

Although three URLs were retrieved (including one labeled 'Terms of Service'), all three returned byte-for-byte identical copies of the same Privacy Policy. No genuine second document type (Terms, DPA, security page) was available, so no cross-document contradictions exist; the identical copies are fully consistent with each other. Effectively only one distinct document was analyzable.