Glyph

The Terms address ownership of the Glyph software itself but never explicitly state who owns user-submitted data, prompts, or customer conversations. Confidentiality provisions imply user-disclosed material remains the discloser's, but there is no clear grant or reservation of ownership over input data. This silence is a risk for professional users handling proprietary content.

Neither document addresses ownership of AI-generated replies or chatbot outputs. The Terms reserve broad IP rights to RTWeb SAS, including 'other software and other intellectual works' created while providing the Features, but do not clarify whether generated responses belong to the user. This ambiguity is a concern given the product markets 'AI Replies.'

The Privacy Policy states personal data may be used for 'product development with the aim of improving our products and services,' which could encompass model training, but no explicit reference to AI/ML training is made. For a product that advertises AI Replies, the complete silence on whether user inputs train models is a material gap and a risk signal.

The policy commits to retaining data only 'as long as necessary,' but then carves out that chat-user IP addresses are 'kept indefinitely' once a chat session starts, justified partly by legal logging requirements and partly by the vendor's own anti-spam needs. There is no deletion SLA, no self-service deletion mechanism described, and indefinite retention beyond the legal minimum is explicitly claimed.

The policy discloses sharing with external partners (IT, marketing, analytics) under contractual data-protection agreements, and with public authorities in criminal or legal contexts. There is no indication of selling data to advertisers or brokers. Sharing appears limited to service delivery, but user control over which partners receive data is not described, and integrations (e.g., Hubspot) imply onward flows not fully detailed.

Users can unsubscribe from marketing communications, and the GDPR section references a right to modify, delete, and consent to data collection. However, there is no described opt-out mechanism for the indefinitely retained chat-user IP addresses or for use of data in product development. Opt-out rights are partial and largely limited to marketing.

The Privacy Policy claims GDPR compliance and EU-only data residency but names no third-party attestation, audit report, or certification. No SOC 2, ISO 27001, ISO 27018, or any other baseline framework is mentioned. GDPR is asserted (claimed, not certified); all other relevant frameworks are absent, so users cannot verify security or privacy posture against independent standards.

Neither document provides any transparency into model behavior, decision logic, or enterprise auditing capabilities. Despite marketing 'AI Replies' and a 'Chatbot,' the policies say nothing about how automated responses are generated or whether businesses can audit them. This is a complete silence on a topic material to the product.

The Privacy Policy makes generic assurances of 'appropriate technical and security measures' and 'reasonable security safeguards' but discloses no specifics — no encryption at rest/in transit, no penetration testing, no bug bounty, no incident-response process, and no trust center. Worse, the Terms explicitly warn that transmitted data may not be secure and the software may be defective or vulnerable. No breach history is disclosed.

A free plan/trial and paid monthly/annual subscriptions are referenced, but the documents describe no differences in data handling between tiers. No enterprise DPA or elevated protections are offered in the supplied text. The absence of any tier-based data-handling distinction means free and paid users appear to receive the same baseline terms.

No explicit statement grants staff the right to read user prompts or chat content. However, the policy allows external partners to 'gain access to personal data' for analytics and other tasks, and processing for 'statistical purposes' and product development is asserted. Whether humans review individual conversations is not addressed, leaving the question ambiguous.

The documents disclose that data may be shared with public authorities for criminal investigations or when legally required, and that IP addresses are logged for a legal minimum of one year to satisfy legal requests. Governing law is France with disputes before the Commercial Court of Paris. No active litigation is disclosed, but the law-enforcement cooperation posture is explicit.

The policy lists PII collected including name, image, personal ID number, contact details, behaviour, and IP address. Chat-visitor data is described as collected anonymously, but IP addresses are retained indefinitely once a chat begins. No sensitive personal information categories are explicitly enumerated, but the open-ended nature of a customer-service chat (where end-users may type anything) and the indefinite IP retention warrant a moderate rating.

Both policies are recent (Terms updated May 9, 2024; Privacy Policy updated February 26, 2024, roughly 16–19 months before the analysis date). However, the product surface markets Glyph as 'live chat powered by AI' with 'AI Replies,' yet neither policy mentions AI, machine learning, model training, or any third-party model provider at all. An AI-first product whose governing documents never mention AI processing is a material coverage failure.

Two documents were supplied (Terms of Use and Privacy Policy), enabling a cross-check. No direct contradiction on licence, jurisdiction, or deletion was found, but a notable tension exists: the Privacy Policy promises 'a high level of protection' and 'high level of security,' while the Terms warn data 'may not be secure' and the software 'may prove to be defective or vulnerable.' This is a reconcilable but real tension in the security posture presented to users.