Contenttrue

Users retain rights to content they submit, which is favorable. However, submitting content triggers a very broad license grant to the vendor (see Training Data / Third-Party Sharing), which materially undercuts the ownership retention.

The Terms address ownership of the vendor's own site content and functionality but are silent on who owns the AI-generated detection results/output delivered to the user. This ambiguity is a moderate risk for users relying on the output.

The Terms grant the vendor a worldwide license to use, reproduce, and modify submitted content, and the privacy policy does not exclude training use — while the marketing copy claims data is not used for training, no policy document supports this. The broad license combined with policy silence on any training carve-out creates high risk. The marketing 'not used as training data' claim is not reflected in the binding policy text.

The policy explicitly states that trial usage records have no automatic deletion deadline, and there is no described process, SLA, or user mechanism to request deletion anywhere in the documents. Indefinite retention with no deletion path is a significant risk.

Submitted text is sent to third-party AI processing providers, which is integral to the detection service and is disclosed. However, the third-party clause is broad and vague, no sub-processors are named, and users have no described control, so this exceeds minimal necessary disclosure.

The documents contain no opt-out mechanism for data collection, training use, or third-party sharing. There is no reference to data subject rights, consent withdrawal, or 'do not sell/share' controls. Complete silence on opt-out is high risk.

No compliance frameworks or certifications from the universal baseline (GDPR, CCPA, SOC 2, ISO, etc.) are mentioned anywhere in the supplied documents. For a consumer tool processing text and personal data, the total absence of any compliance reference is high risk.

The policy and terms provide no transparency into model behavior, no audit rights, and no explainability commitments. While marketing copy references detailed breakdowns, no binding policy addresses auditability, so the category is effectively unaddressed.

Security disclosure is limited to a single generic sentence with no specifics on encryption, access controls, penetration testing, incident response, or breach history. No trust center or security page is referenced in the policy. This vagueness is a significant risk.

The documents describe an anonymous trial and account-based use but no distinct enterprise or paid-tier data handling terms. A pricing page exists in marketing but no differentiated policy terms are supplied, so any tier differences are undisclosed.

The documents do not explicitly state whether staff may read user prompts or outputs, but the broad license to 'use, reproduce, modify' content and the customer-support/analysis purposes leave the possibility open without disclosure or limitation. Silence on human review is a moderate risk.

The documents make no reference to government data requests, law enforcement cooperation, or legal disputes. This silence means users have no visibility into how the vendor would respond to such requests, a moderate risk.

The vendor collects name, email, contact details, usage data, IP address, device information, and browser/device fingerprints. Critically, the core function ingests arbitrary user-submitted text, which could contain SPI, yet there is no disclosure of controls over sensitive content in inputs. Significant PII collection plus uncontrolled text ingestion warrants YELLOW.

The Privacy Policy is dated 2026/09/09 and the Terms 2025/03/10, both recent relative to the 2026-09-19 analysis date. The privacy policy notably addresses AI processing providers and trial fingerprinting, showing partial coverage of the AI-first product. However, it never mentions model training, the named third-party model providers the product profiles, or explainability, so coverage of the shipped AI capabilities is only partial.

Three documents were supplied (a Privacy Policy and two identical-language Terms of Service at different URLs). The two Terms documents are verbatim duplicates, and no contradictions were found between the Privacy Policy and the Terms on licensing, retention, or sharing. No conflicting claims were identified.