Deepmag

Users clearly retain ownership of documents, files, and project data uploaded to the Service. The vendor takes only a limited license to process and store that content to provide the Service, and disclaims ownership of Customer Data.

AI-generated outputs are provided for the user's use but remain subject to the Terms, and the user is restricted from using outputs to train competing models. The documents do not clearly state that the user owns the outputs, leaving ownership ambiguous.

The Privacy Policy states Customer Data is not used to train public AI models unless explicitly permitted, which is favorable. However, the vendor reserves the right to process Customer Data to 'improve the Service' and to use aggregated/anonymized data, and does not clearly bar training of private/internal models, leaving some ambiguity.

Users can request deletion of their account and data, and uploaded originals may be deleted after processing. However, retention language is vague ('reasonable timeframe', 'depending on system requirements'), processed representations may be retained indefinitely to support functionality, and no concrete retention schedule or deletion SLA is provided.

The vendor states it does not sell personal information and shares data only with service providers (cloud, hosting, analytics, AI providers) under contractual obligations, plus with third-party integrations the user connects. Sharing with AI providers and integrations is integral to the service, but subprocessors are largely unnamed in the privacy policy (the Terms name OpenAI, Google Cloud, Procore), and data-handling by integrations is governed by their own policies.

Users can revoke third-party integration permissions and modify cookie preferences, and CCPA/GDPR rights (access, deletion) are described. However, there is no explicit opt-out mechanism for the vendor's use of data to 'improve the Service' or for aggregated/anonymized use, and training use is controlled by whether the customer permits it rather than an explicit opt-out toggle.

The documents reference CCPA/CPRA and GDPR rights and describe the processor/controller relationship, but claim no third-party security or AI-governance certifications whatsoever — no SOC 2, ISO 27001, ISO 27018, ISO 42001, or NIST attestations. For an enterprise SaaS handling business documents, the absence of any named certification or audit evidence is a significant gap.

The product surfaces findings linked to source sheets, but the policy documents do not describe any model transparency, explainability, or enterprise audit-logging capabilities. Logging and monitoring are mentioned only as security measures, not as auditable transparency features for customers.

The vendor discloses commercially reasonable safeguards including TLS/HTTPS encryption in transit, encrypted storage 'where appropriate', role-based access controls, and logging/monitoring, and recommends 2FA. However, there is no mention of penetration testing, bug bounty, formal incident response, a trust center, or any breach history, and no security certification is claimed.

The documents mention a free tier (per product surface) and enterprise customers, and note enterprise customers may request project-data deletion through support and that Deep Mag acts as processor for enterprise customers. No detailed material differences in data handling between free and paid tiers are specified in the supplied policies.

The policies do not explicitly state whether staff may read user prompts, documents, or outputs. Processing is described as algorithmic/AI-based, but the documents are silent on human access to uploaded content, which is itself a gap.

The Privacy Policy discloses that data may be disclosed to comply with legal obligations and lawful requests from authorities, and the Terms require binding arbitration and provide broad indemnification obligations. No specific litigation or government-request history is disclosed.

The vendor collects a defined set of PII (name, email, credentials, IP address, device/session identifiers, authentication tokens, usage metrics) plus uploaded business documents that may contain project data. Collection is disclosed with stated purposes; no SPI categories (health, biometric, government ID, financial) are indicated as collected, though payment processing is implied by subscriptions.

Both policies are effective January 9, 2026 — well within 12 months of the analysis date — and demonstrably cover the AI/ML processing, embeddings, third-party AI providers (OpenAI, Google Cloud), and integrations (Procore, Autodesk) visible in the product surface. The policy language aligns closely with the AI-first construction-review product being shipped.

Two documents (Terms of Service and Privacy Policy) were supplied and are broadly consistent on ownership, data processing, retention deference to the Privacy Policy, and third-party integrations. No material contradictions were found; a minor discrepancy exists in the stated 'Last Updated' (January 8, 2026) versus 'Effective Date' (January 9, 2026) within each document, but that is internal, not cross-document.