National Geographic AI

The supplied text contains no policy language addressing ownership of user-submitted data, prompts, or files. The documents are editorial articles, not terms governing an AI tool. Silence on this fundamental question is a high-risk signal for any professional user.

No provision addressing ownership of AI-generated output appears anywhere in the supplied text. The documents are news articles with no reference to generated content or its ownership.

There is no statement about whether user inputs may be used to train or improve any model. The supplied text does not describe any AI product or any model training practices at all.

No retention schedule, deletion mechanism, deletion SLA, or security-related retention obligation appears in the supplied text. The material is silent on all data-lifecycle questions.

The supplied text contains no operative sharing terms, but footer links reference interest-based advertising, Nielsen measurement, and a 'Do Not Sell or Share My Personal Information' control, implying an advertising/measurement ecosystem typical of a media site. Because the governing privacy policy itself was not provided as analyzable content, the actual scope of sharing cannot be determined, which is itself a risk.

The footers reference a 'Do Not Sell or Share My Personal Information' link and a US State Privacy Rights notice, suggesting some opt-out mechanism exists for advertising/sale of data. However, no opt-out terms are actually contained in the supplied text, so the scope and effectiveness cannot be assessed.

No compliance framework or certification (GDPR, CCPA/CPRA, SOC 2, ISO 27001, ISO 42001, NIST CSF, EU AI Act) is claimed or evidenced anywhere in the supplied text. Because the sector is unknown, only the universal baseline is assessed, and every baseline framework is absent. The complete absence of any compliance statement warrants a RED rating.

The supplied text provides no information about any model, its behavior, transparency, or enterprise auditability. No AI system is described at all.

No security controls (encryption, access controls, penetration testing, bug bounty, incident response) are disclosed, and no security page or trust center is referenced in the supplied text. The only security-adjacent element is reCAPTCHA on some pages, which does not constitute a disclosed security program. Silence on security is a significant risk.

The supplied consumer text contains no tiering information distinguishing free from paid data handling. The consumer material references a subscription/email-gated access model but says nothing about differential data treatment. No basis exists to evaluate a risk delta.

There is no statement about whether staff may access, read, or review user prompts or outputs. The supplied text does not address human review in any form.

The supplied text contains no terms addressing government data requests, law-enforcement cooperation, or the vendor's own legal disputes relating to a service. (The litigation described in the articles concerns a third party, ReconAfrica, and is editorial content, not policy exposure of the tool.) Silence on how the vendor handles legal/government demands is a risk for professional users.

No data inventory disclosing what PII or SPI is collected appears in the supplied text. The only observable collection point is email capture for article access and newsletter signup, but no policy defines the categories collected or processed. The policy text is effectively silent on data collection, which the rubric treats as RED.

No policy document was actually supplied — only editorial articles bearing copyright dates through 2026 and links to external Disney legal pages. No effective or last-updated date for any governing privacy policy or terms is discoverable in the supplied text, and the supplied 'product surface' is a media homepage that shows no AI/ML capability described by any policy. With no discoverable policy effective date and no AI-coverage evidence, this category is RED.

Multiple documents were supplied, but none is an actual legal/policy document — they are news articles — so a meaningful cross-document policy comparison is not possible. However, the footers point inconsistently to two different governing regimes: some pages link to National Geographic's own /legal/privacy.html and /legal/terms.html, while others (and the account-creation flow) route to Disney/Walt Disney Company Terms of Use and Privacy Policy. This unresolved divergence over which legal terms actually govern is a material consistency problem for a user trying to determine their rights.