Krea

Users retain ownership of their input data (User Submissions), but must grant Krea broad perpetual licenses. The policy clearly states users own their submissions but grants extensive usage rights to the platform.

Output ownership appears to follow input ownership patterns but is not explicitly addressed. Users receive licenses to generated content but Krea retains broad usage rights through the User Submission framework.

The policy does not explicitly prohibit using user inputs for model training. The broad license grants and stated business purposes of 'improving services' suggest user data could be used for training without clear opt-out mechanisms.

General retention policy is provided but lacks specific schedules or SLAs. Data is retained as long as necessary for services and business purposes, with some examples given but no clear deletion timelines or guarantees.

Data is shared with service providers, analytics partners, and payment processors with clear disclosure. The sharing appears limited to operational purposes rather than commercial data sales, though analytics sharing is extensive.

Strong opt-out rights are provided under multiple state privacy laws including California, Colorado, Connecticut, Utah, and Virginia. Users can opt out of data sales, targeted advertising, and certain processing activities.

Comprehensive compliance coverage with explicit mention of GDPR, CCPA, CPRA, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Virginia Consumer Data Protection Act. Strong regulatory framework adherence.

No transparency provided into model behavior, decision-making processes, or enterprise auditing capabilities. The policy focuses on legal compliance but lacks technical transparency for AI operations.

Basic security practices mentioned but lacks specific technical controls or certifications. No breach history disclosed, but security measures are described in general terms without detailed implementation.

Some differentiation exists between subscription tiers, particularly around content privacy settings, but no separate enterprise-grade data handling or security provisions are explicitly outlined.

The platform reserves broad rights to access and review user content for service provision and compliance purposes. No explicit restrictions on human access to user prompts or generated content are provided.

Standard legal cooperation language present with provisions for government data requests and law enforcement cooperation. DMCA compliance procedures are detailed, indicating readiness for copyright disputes.

Extensive PII and SPI collection including sensitive categories like biometric data (sensory data), financial information, social identifiers, and geolocation data. The broad data collection scope presents significant privacy risks.