Maket

Users retain ownership of the Customer Data (files, prompts, images, plans) they upload. However, ownership is subject to a broad license granted to Maket in Section 6, so ownership is nominal rather than exclusive in practice.

Users own the AI Outputs they generate, but only to the extent local law permits IP rights in AI output, and Maket expressly disclaims any guarantee that outputs are unique, original, or non-infringing. Maket also retains a perpetual license to anonymized/aggregated versions of outputs.

By default Maket may train, fine-tune, test, and validate its AI systems on Customer Data and AI Inputs. It commits only to 'commercially reasonable' efforts to anonymize and admits it cannot guarantee anonymization; opt-out from training is reserved to certain paid plans, so the standard consumer default is training-on.

The policy provides retention categories and a deletion pathway (account settings or contact) but uses vague timeframes ('within a reasonable timeframe', 'a limited period') rather than firm SLAs. Audit logs are retained up to one year; anonymized/aggregated data may be kept indefinitely.

Maket discloses sharing with service providers/sub-processors (cloud hosting, LLM providers, payment, analytics, support) and states it does not sell personal information. Some Customer Data is transmitted to third-party LLM providers, and the sub-processor list is only available on request rather than published, limiting user visibility.

Users can opt out of marketing and non-essential cookies, and can exercise deletion/objection rights depending on jurisdiction. However, opting out of AI training is not universally available — it is tied to subscribing to a plan with 'enhanced data controls', so free/standard users lack a clear training opt-out.

The Privacy Policy references GDPR/UK GDPR legal bases, Standard Contractual Clauses, and Canadian/Québec privacy regulators, and describes GDPR-style data subject rights. However, no security certifications (SOC 2, ISO 27001, ISO 27018, ISO 42001) are claimed or attested, and CCPA/CPRA and US state laws are not named. Compliance is asserted/aligned rather than third-party attested.

The documents provide no meaningful transparency into model behavior and no enterprise auditing mechanism. They state Maket uses third-party LLMs and describe training data sources at a high level, but offer no explainability, model documentation, or audit rights to users.

The Privacy Policy discloses concrete controls: TLS 1.2+ in transit, encrypted storage with key management, role-based least-privilege access, MFA, encrypted backups, real-time monitoring, and an incident-response/notification process. No breach history is disclosed, but there is also no independent attestation (no SOC 2/ISO/pen test/bug bounty) and no dedicated trust center referenced.

The Terms reference paid plans that may include 'enhanced data controls' or a training opt-out, implying a materially better data posture for paying tiers, but the actual differences are not spelled out in the supplied documents. Free plans appear to carry the default training-on posture with no published carve-out.

Maket reserves broad rights to access and process Customer Data for quality assurance, research, and security monitoring, and states internal staff may access data on a least-privilege basis. It also lists 'training, quality assurance or administration purposes' as a processing purpose, which implies possible human review, though no explicit human-review-of-prompts statement is made.

The documents describe cooperation with lawful government requests, fraud-related disclosures, and a class-action/jury-trial waiver with mandatory Québec jurisdiction. No pending litigation or law enforcement history is disclosed, but the legal-disclosure and dispute provisions favor the vendor.

Maket collects a range of PII: name, email, password, billing address, IP address, device identifiers, approximate location, usage data, and any personal data embedded in project inputs. It states it does not intend to collect sensitive information and asks users not to upload it, but acknowledges it will process SPI if voluntarily provided — placing responsibility on users while allowing SPI ingestion.

Both the Terms and Privacy Policy are dated June 15, 2026 (Version 2026-1), within 12 months of the analysis date, and they substantively address the AI capabilities the product surface shows: floorplan/3D generation, uploading existing plans, third-party LLM providers, and AI training. The policy demonstrably covers the shipped AI features.

Two document types (Terms and Privacy Policy) were supplied, plus a duplicate copy of the Terms at a second URL. The Terms and Privacy Policy align on training use, non-sale of data, retention, and deletion; no material contradictions were found between them. The training-anonymization language in both is consistent.