Cinder appears to be a content moderation/trust & safety platform that operates primarily as a data processor rather than controller. While they have reasonable privacy practices and GDPR compliance claims, the lack of accessible terms of service and specific AI/model usage policies creates uncertainty about key areas like data ownership, training usage, and output rights. The privacy notice is transparent about basic data collection but silent on AI-specific concerns.

AI Transparency Facts

Input Data Ownership

Moderate Risk

No explicit statement about input data ownership found. Cinder identifies as primarily a data processor, suggesting customers retain ownership, but this is not clearly stated.

Confidence

20%

Output Data Ownership

Moderate Risk

No information about AI-generated outputs or who owns them. The privacy notice doesn't address content generation or output ownership at all.

Confidence

10%

Training Data Usage

Moderate Risk

No explicit mention of using customer data for model training or improvement. The notice only mentions analyzing data for Cinder's own operations without clarifying if this includes model training.

Confidence

15%

Data Retention & Deletion

Low Risk

Clear data retention policy with deletion rights. Service data retained for business relationship duration plus unspecified period. Users can request deletion through verified requests.

Confidence

80%

Third-Party Data Sharing

Low Risk

Limited third-party sharing only for service delivery. Explicitly states they do not sell personal information and only share with service providers facilitating their services.

Confidence

90%

Opt-Out Rights

Low Risk

Users have various opt-out rights including right to object, restrict processing, and request erasure under GDPR. Cookie preferences can be managed through banner.

Confidence

85%

Compliance & Certifications

Moderate Risk

Claims GDPR compliance with internal DPO and standard contractual clauses for data transfers. No mention of other certifications like SOC 2, ISO 27001, or industry-specific compliance.

Confidence

70%

Model Explainability & Auditability

Moderate Risk

No information about model transparency, explainability, or audit capabilities. The privacy notice doesn't address AI/ML aspects of their service.

Confidence

10%

Security Practices & Breach History

Moderate Risk

Limited security information provided. Data stored on cloud servers but no details on encryption, access controls, or security certifications. Claims zero government data requests.

Confidence

40%

Enterprise vs. Consumer Risk Delta

Moderate Risk

No information about different tiers or enterprise-specific protections. The service appears business-focused but doesn't distinguish between customer types in privacy practices.

Confidence

20%

Human Review of User Inputs

Moderate Risk

No explicit policy on human review of customer data. As a content moderation platform, human review may be inherent to the service but this isn't clarified.

Confidence

15%

Regulatory & Litigation Exposure

Low Risk

Will share data when legally required but claims zero government requests to date. Standard law enforcement cooperation language with appropriate limitations.

Confidence

85%

PII & SPI Data Inventory

Low Risk

Collects minimal PII limited to name and email address for website visitors and customers. May collect employer/industry details from third parties. No mention of collecting SPI.

Confidence

90%

You've read all 15 risk ratings for Cinder. Create a free account to see the exact policy wording behind each rating.