Pi

The Terms state that as between the user and Inflection AI, the user owns their Inputs. However, the user simultaneously grants a royalty-free, perpetual, irrevocable, sublicensable, worldwide license over that Content, which substantially dilutes the practical value of that ownership.

Users are said to own Outputs alongside Inputs. As with Inputs, this ownership is subject to the same broad, perpetual, sublicensable license granted to Inflection AI, and the Terms warn Outputs may be inaccurate and are only a 'starting point.'

The Terms expressly permit Inflection AI to use user Content to train and improve the models behind its Services and other AI models. No opt-out from this training use is offered anywhere in the supplied text, meaning all user prompts and outputs may feed model development by default.

The Terms mention that users can request account deletion by following instructions in the Privacy Policy, but the Privacy Policy is not actually provided in the supplied text. No retention periods, deletion SLAs, or security-related retention obligations are disclosed, and the content license expressly survives account termination.

The Terms reference Third-Party Services and repeatedly defer details of how information 'may be shared' to a Privacy Policy that is not supplied. The cookie notice states cookies are used to run ads, but the Terms do not disclose whether user Content is sold or licensed to unrelated parties. Silence on the specifics, combined with a broadly sublicensable content license, warrants caution.

The only opt-out mechanisms in the supplied text relate to arbitration (within 30 days) and to marketing SMS messages (texting STOP). There is no opt-out from model training use of Content or from data collection, and the Privacy Policy that might contain such rights is not provided. The absence of any training or data-processing opt-out is a significant gap.

The supplied documents name no compliance frameworks or certifications whatsoever — no SOC 2, ISO, GDPR, CCPA/CPRA, or NIST references. The Terms gesture at EU AI Act-style prohibited-use restrictions (biometric categorization, social scoring, mass surveillance) in the Acceptable Use section, but that is a restriction on the user, not a certification of the vendor. No relevant baseline framework is claimed or attested.

The Terms provide no transparency guarantees into model behavior and no enterprise auditing rights. They reference a transparency and content moderation page and disclaim that Outputs may be inaccurate, but offer no explainability or audit commitments. Users are prohibited from reverse engineering the models.

The Terms place responsibility for account security on the user and disclaim any warranty that the Services will be secure. No encryption, access-control, penetration-testing, bug-bounty, or incident-response practices are disclosed, no trust center or security page is referenced, and no breach history is mentioned. The security posture is effectively undisclosed.

The supplied text is a single set of consumer Terms with no enterprise tier, DPA, or paid-tier data-handling distinctions. The arbitration section distinguishes 'Consumer' versus non-consumer users only for which AAA rules apply, not for differences in data handling. No enterprise carve-outs (e.g., no-training commitments) are available in these documents.

The Terms disclose that Inflection AI uses a combination of automated technologies and human review to promote safe and responsible use of the Services, and reserve rights to use Content for safety and policy enforcement. This confirms staff may access user content, though the disclosure is framed around moderation rather than a general reading right.

The Terms provide that Content may be used to comply with applicable laws and detail an extensive mandatory arbitration, class-action waiver, mass-dispute, and California venue framework. They do not, however, describe government data-request handling or law-enforcement cooperation procedures — those would presumably sit in the missing Privacy Policy. The heavy dispute-resolution machinery signals litigation-management posture favoring the vendor.

The Terms confirm collection of name and phone number at registration plus 'other requested information,' and consent to marketing SMS, but there is no data inventory disclosing the full categories of PII or SPI processed. Because Pi is an open-ended conversational AI, users may submit highly sensitive content, yet the governing Privacy Policy — which would inventory this — is not supplied. Silence on what is collected drives a RED rating.

The Terms carry a 'Last updated: December 22, 2025' date, which is recent (roughly eight months before the analysis date) and demonstrably addresses AI/ML processing, model training, and third-party services matching the product's conversational-AI surface. However, the supplied Privacy Policy is truncated/absent and the product's data flows cannot be fully assessed against a real privacy policy, so the rating is capped below GREEN.

Two documents were supplied, but Document 2, labelled 'Privacy Policy,' contains the identical Terms of Service text (truncated), not an actual privacy policy. There is therefore no genuine second document type to cross-check against the Terms; the two texts are duplicative rather than contradictory. This mislabeling/duplication is a notable finding but not a substantive contradiction of terms.