Krea

The policy is a general GDPR privacy notice and contains no statement about ownership of prompts, files, or any user-submitted content or inputs. Silence on this topic means a user has no contractual assurance about who owns submitted data. This is a gap that would normally be covered by a terms of service, which was inaccessible.

There is no mention of generated content or output ownership anywhere in the document. As a privacy policy it does not address intellectual property or output rights at all. This is unaddressed and leaves users without assurance.

The policy does not mention AI, machine learning, model training, or using user inputs to improve any models. It states data is processed for purposes arising from law, contract, or consent, but says nothing about training. The silence is notable but consistent with a non-AI IT-services policy.

The policy provides a default 24-month retention period where no legal or contractual period applies, and offers erasure rights with a general one-month response window extendable by two months. However, there are no security-specific retention schedules (e.g., SOC 2 audit logs) and no concrete deletion SLA beyond the statutory GDPR response window. Deletion is available but subject to numerous legal exceptions.

The policy discloses sharing with processors including MailChimp (The Rocket Science Group) and Google (G Suite), and references employees as recipients. It also states that, with consent, data may be provided to third parties for THEIR OWN marketing needs — a broader sharing that is at least consent-gated. Disclosure exists but third-party marketing transfers introduce moderate risk.

The policy provides clear GDPR-based opt-out mechanisms: consent can be withdrawn at any time via multiple channels, and there is an explicit right to object to processing including direct marketing. These rights are meaningfully described with contact channels. This is a positive feature of the policy.

The policy is framed around GDPR/Slovak data-protection law and names the Slovak supervisory authority, but it relies on the EU–US Privacy Shield framework, which was invalidated by the CJEU in 2020 — directly conflicting with the privacy law that applies. No SOC 2, ISO 27001/27018/27017, ISO 42001, NIST, or EU AI Act compliance is claimed or certified. The reliance on a defunct transfer mechanism is a serious compliance defect.

The policy addresses automated decision-making in the GDPR sense, stating the company does not currently use automated individual decision-making and profiling, and that any such decision must be manually inspectable. However, there is no mention of AI model transparency, enterprise auditing, or explainability of any generative system. Relevant only to the extent automated decisions are covered.

Security is described only in generic terms — 'standardized technical and other appropriate measures' — with no specifics on encryption at rest/in transit, access controls, penetration testing, bug bounty, or incident response. No trust center or security page is referenced, and no breach history is disclosed. The absence of concrete controls is a significant gap for professional use.

The policy makes no distinction between free and paid tiers, nor between consumer and enterprise data handling. No enterprise documents were available for comparison. The absence of any tier differentiation means users cannot determine whether paid plans receive stronger protections.

The policy states employees are recipients of personal data and that data may be processed by business partners, implying staff access to personal data for operational purposes. It does not specifically address human review of prompts or generated outputs. The disclosure of employee access is partial but not framed around input review.

The policy references the Slovak Office for Personal Data Protection and statutory/legal obligations as grounds for processing and for refusing deletion, but says nothing about government data requests, law enforcement cooperation, or litigation. There is a general nod to compliance with statutory obligations. The topic is largely unaddressed.

The policy enumerates an extensive range of PII it may process, including name, birth number/identity document numbers, IP addresses, online identifiers, localization data, bank account numbers, and behavioral data. It explicitly states it does not process special categories of sensitive data (racial/ethnic origin, political opinions, religious beliefs, genetic, biometric, health, sexual orientation). The breadth of PII is significant but SPI is expressly excluded and disclosure is relatively detailed.

The policy's stated effective date is May 25, 2018 — over eight years before the analysis date — and it still relies on the EU–US Privacy Shield, which was invalidated in 2020, making it demonstrably stale. The product surface describes web/mobile development, IT outsourcing, and a business system (Sortio), with no visible AI/ML capability, so there is limited AI coverage to measure against; even so, the extreme age of the policy independently justifies a RED rating. The document does not mention any AI/ML processing or third-party model providers.

Only one document (the privacy policy) was retrievable; the terms of service, DPA, and any security documentation were all inaccessible. A cross-document consistency check is therefore impossible, and no contradictions can be assessed. This is a limitation of the available evidence, not a finding of consistency.