Pangram

The policy expressly states that user submissions do not grant Pangram ownership and remain the user's. This is a strongly user-favorable position on input data ownership.

The policy addresses input ownership and disclaims any 'indefinite, perpetual royalty,' but it does not clearly state who owns the AI-detection results/output generated by the Service. Because the document is silent on output ownership specifically, confidence is lowered and the rating reflects that ambiguity.

The policy repeatedly and explicitly commits that user submissions are not used to train, develop, refine, or improve Pangram's AI or machine learning systems, stating instead that outside datasets are used for training. This is among the most user-favorable training-use positions possible.

The policy provides a concrete deletion timeline — content submitted to registered accounts is securely deleted within 30 days of account closure — and offers deletion requests via a dedicated privacy email. It does not, however, specify security-related audit-log retention schedules or a deletion SLA for individual requests, and notes that query records are retained for billing/analytics even after a user deletes query details.

The policy states Pangram does not sell or share personal information and limits third-party disclosure to trusted vendors (e.g., AWS, Stripe, Twilio) bound by confidentiality and used only to deliver the service. Business transfers and legal-compliance disclosures are disclosed as exceptions, which is standard. Sharing appears disclosed and limited to what the service requires.

Users can unsubscribe from marketing emails, reply STOP to text messages, and delete query details from their history. However, the policy notes Pangram does not honor Do Not Track signals, and most consumer-rights requests must be routed through the Customer institution rather than exercised directly by end Users, limiting individual control.

For its edtech sector, the policy explicitly addresses FERPA (acting as a School Official) and COPPA, and asserts CCPA/CPRA service-provider status plus extension of state privacy rights to all U.S. residents. However, these are claimed/aligned positions with no third-party attestation, and the policy is silent on SOC 2, ISO 27001, ISO 42001, GDPR, and the EU AI Act. No audit reports or certificates are referenced, so the overall posture is 'claimed' rather than 'certified.'

The privacy policy does not address model explainability, auditability, or enterprise audit rights into model behavior. The product is an AI classifier whose outputs carry significant consequences (e.g., academic integrity), yet the policy is silent on transparency mechanisms, so confidence is lowered and silence is treated as a risk signal.

The policy describes only generic 'reasonable efforts' with physical and electronic safeguards and explicitly disclaims any guarantee of security. It does not disclose encryption at rest/in transit, access controls, penetration testing, bug bounty, or incident response, references no trust center or security page, and makes no breach-history disclosure. The absence of specifics is itself a risk signal.

The policy distinguishes the Free Service (raw text content for AI detection is collected) from Registered Customers (submissions plus metadata such as submission date and user ID), and ties the 30-day deletion commitment to Customer accounts. However, no enterprise agreement or DPA was retrievable, so differences in retention, training carve-outs, or security between tiers cannot be fully assessed.

The policy reserves the right for Pangram staff to access user submission data to diagnose and fix reported support issues. This access is scoped to support/troubleshooting rather than general review, but it does confirm staff can read user inputs under certain conditions.

The policy discloses that Pangram will share personal information in response to legal processes and enforceable governmental requests, and in connection with business transfers such as mergers or acquisitions. There are no references to specific litigation, government data-request volumes, or transparency reporting, so the disclosure is standard but limited.

Pangram collects a range of PII — name, email, password, place of employment, phone number, IP/general location, device information, usage data, and cookies — plus the full content of submitted text, URLs, and messages, which may itself contain sensitive material. Payment data is handled via Stripe without storing full card details. Because student data and free-text submissions (potentially including SPI) are processed, but with clear disclosure, purpose limitation, and no advertising use, a YELLOW rating is appropriate.

The Privacy Policy is dated 'Last Updated: August 14, 2025,' roughly 14 months before the analysis date, placing it in the 12–24 month window. It covers core AI-detection data flows, third-party vendors, and an explicit no-training commitment, which aligns with the AI-first product surface. It does not name specific third-party model providers whose outputs it detects (though as a detector it does not integrate them), and the slightly stale date caps this at YELLOW.

Only one policy type (the Privacy Policy) was retrievable, supplied in English and Spanish versions of the same document; the Terms of Service, DPA, and enterprise pages were inaccessible. A genuine cross-document consistency check across different document types is therefore impossible. The English and Spanish versions appear substantively aligned, and no contradictions are reported. Confidence is capped low to reflect the single-document-type limitation.