KlingAI

The policy confirms Kling AI stores and processes User Content (uploaded photographs, images, audio, videos, comments) but does not clearly state that the user retains ownership of their inputs — that would typically be addressed in the Terms of Service, which was inaccessible. It reserves broad rights to process, analyze, and pre-upload content. Silence on ownership in the available document is a moderate risk.

The Privacy Policy does not address ownership of AI-generated outputs; ownership and license terms for generated content would normally reside in the Terms of Service or Credits Policy, neither of which was accessible. The policy notes that public content is disclosed publicly, but this speaks to visibility, not ownership. Silence lowers confidence and creates moderate risk.

The policy does not explicitly state whether user inputs are used to train or improve AI models. It does claim a legitimate interest in 'product development and internal analytics' and states content will be analyzed for moderation and effects, but stops short of a clear training statement or a no-training commitment. This ambiguity on an AI-first platform is a meaningful risk for professional users.

The general policy uses open-ended 'as long as necessary' retention language without a global schedule, and reserves the right to delete data without notice or compensation. However, the South Korea section provides concrete statutory retention periods (e.g., 5 years for contract/payment records, 3 months for log data) and the CCPA section sets response timeframes. Account deletion is offered via app and email. The mix of vague global terms and specific regional schedules yields moderate risk.

The policy discloses sharing with affiliates, service providers (including for advertisement and marketing), business-transaction successors, and legal authorities, and states data is shared on a need-to-know basis. It states it does not sell personal data unless consent is obtained. The advertising/marketing service-provider sharing and broad affiliate sharing go beyond strict service necessity, warranting moderate risk despite reasonable disclosure.

The policy provides meaningful opt-out and consent-withdrawal mechanisms: users can withdraw consent, object to direct-marketing processing, exercise a CCPA sale opt-out, and change privacy/cookie settings. However, it explicitly states it does NOT honor 'Do Not Track' signals, and some rights are limited by contract and legal exceptions. The presence of real opt-out mechanisms tempered by the DNT refusal yields moderate risk.

As a consumer-general tool, the relevant baseline includes GDPR, CCPA/CPRA, and general security/AI frameworks; COPPA is conditionally relevant (minors excluded). The policy references CCPA, Singapore PDPA, Brazil LGPD, Korean PIPA, and Turkish data law rights, but names no security or AI certifications (no SOC 2, ISO 27001, ISO 42001) and provides no third-party attestations. The absence of any named certification and reliance on statutory-rights language alone results in high risk.

The policy is entirely silent on model transparency, explainability, or enterprise audit capabilities. There is no mention of automated-decision-making explanations beyond Turkey's statutory objection right. For an AI generative platform, this total silence on explainability and auditability is a high-risk gap.

The policy describes general security measures — encryption, access limitation, a dedicated information-security department, and breach notification — but names no specific standards (no penetration testing, bug bounty, or certification) and no trust center. It explicitly disclaims guarantees of security. No breach history is disclosed. Generic controls with explicit no-guarantee language yield moderate risk.

The policy references paid Services (payment, voucher, invoicing) but does not describe any differentiated data-handling protections between free and paid tiers. No enterprise agreement or DPA was accessible. The absence of any tier-based data protection distinction means paid/professional users receive no evident additional safeguards.

The policy explicitly reserves the right for staff to scan, analyze, and review User Content for safety and moderation, and states content-moderation teams operate globally. It also states Mexico users' data is processed by 'both human and automated means.' This clear reservation of human access to user inputs is a high-risk factor for confidential professional content.

The policy discloses cooperation with law enforcement, government, tax, and regulatory authorities and will disclose data pursuant to legal process. No specific litigation, disputes, or historical government requests are disclosed. Standard law-enforcement cooperation language with no transparency reporting yields moderate risk.

The platform collects extensive PII (email, username, age, IP, device IDs, location, browsing behavior, network data) and SPI (payment card details, government/tax ID information, portrait feature-point analysis, uploaded photographs and audio content, precise device telemetry). While the policy claims it does not perform facial recognition or store face data, the breadth of collection — including financial data and biometric-adjacent portrait feature points — combined with broad sharing and human review, constitutes high risk.

The Privacy Policy was last updated and effective 2026/04/21, less than four months before the analysis date, satisfying the recency test. It explicitly addresses AIGC features, portrait processing, and content analysis. However, no PRODUCT SURFACE was supplied to verify coverage of all shipped capabilities, so per the insufficient-evidence rule the rating is capped at YELLOW. The policy notably does not address model training on user inputs or name any third-party model providers.

Only a single document (the Privacy Policy) was retrievable; the Terms of Service, Terms of Paid Service, Credits Policy, and any DPA were inaccessible, so a cross-document consistency check is impossible. Per protocol, no contradictions are reported and confidence is set low. This is not itself a contradiction finding but a limitation of the available evidence.