Qbiq

The Terms explicitly state that all right, title, and interest in Customer Data remains the Customer's sole and exclusive property. However, the Customer simultaneously grants Qbiq a broad, irrevocable license to use that data both to provide the Service and for further development of the system, which dilutes practical control even though title is retained.

Deliverables — the output, architecture plans, and documents generated by the Qbiq System — are expressly assigned to the Customer as sole and exclusive property. Note, however, that on termination the Customer loses access to the Deliverables and is solely responsible for backing them up.

The Terms grant Qbiq an irrevocable license to use Customer Data for 'further development of the Qbiq System and related technology,' and declare that any machine learning data, metadata, and analytics derived from use are Qbiq's sole and exclusive property. There is no opt-out from this development/training use and no no-training commitment anywhere in the documents.

Neither document specifies any retention period, deletion SLA, or retention schedule. The Privacy Policy offers a manual deletion/correction request by email, but there is no defined timeline, and the Terms only address loss of access on termination — not deletion of data Qbiq holds. Silence on retention is a material gap for a service processing proprietary building plans.

Qbiq relies entirely on third-party hosting providers (some in the US) and discloses sharing of Personal Information with service providers, affiliates, and partners to run the business. More concerning is that Anonymous/aggregated information may be disclosed to third parties 'including advertisers and partners' with or without compensation. While disclosed, the advertiser-sharing of derived data goes beyond what the core planning service strictly requires.

The Privacy Policy provides concrete opt-out mechanisms for marketing emails (unsubscribe link), and links to Google Analytics and Mixpanel opt-outs, plus browser cookie controls. However, there is no ability to opt out of the core development/training use of Customer Data or of the sharing of anonymized derived data with partners/advertisers.

No relevant compliance frameworks or certifications are named anywhere in the documents — no SOC 2, ISO 27001, ISO 27018, GDPR compliance program, CCPA (beyond a California Civil Code §1798.83 marketing-disclosure notice), or EU AI Act. The Privacy Policy only references generic 'industry standards' and a limited California marketing-disclosure right. For an enterprise-facing AI SaaS handling proprietary data, the absence of any named attestation is a significant gap.

The documents provide no transparency into model behavior, no audit rights, and no explainability commitments. On the contrary, the Terms prohibit reverse engineering, benchmarking, and even publishing reviews or impressions of the system, which actively restricts the kind of independent scrutiny an enterprise auditor might undertake.

The Privacy Policy asserts administrative, physical, and technical safeguards but names no specific controls — no encryption at rest/in transit, access controls, penetration testing, bug bounty, or incident response, and no trust center or security page is referenced. It explicitly disclaims any guarantee of security. No breach history is disclosed. The Terms place breach-notification duties on the Customer, not Qbiq.

The published Terms are structured as a single business/Order Form agreement rather than distinct free vs. paid tiers, and no separate enterprise DPA or MSA was supplied. There is therefore no documented differentiation in data handling by tier; all users appear to be subject to the same broad development-use license and the same fees-cap liability regime. The lack of any enterprise-grade carve-out (no-training, deletion SLA, named sub-processors) is itself the risk.

The marketing surface indicates outputs are 'validated by in-house architects,' implying human involvement, but the policy documents themselves do not explicitly reserve a right for staff to read Customer prompts or Deliverables. The broad license to use Customer Data for development, combined with silence on access restrictions, leaves human review neither confirmed nor prohibited.

The Privacy Policy reserves a broad right to disclose Personal Information to comply with law, regulation, legal process, or governmental requests, and to transfer data on merger/acquisition/bankruptcy. No pending disputes are disclosed. Governing law is New York with exclusive jurisdiction in New York County, though the contracting entity is an Israeli company — a jurisdictional split worth noting.

The Privacy Policy collects a meaningful set of PII: name, email, organization name, login credentials, mobile phone number, IP address, browser/ISP data, usage patterns via Hotjar, Google Analytics and Mixpanel, and CVs from job applicants. This is disclosed with defined purposes, and no special-category SPI beyond a CV is described. Notably, the Terms contradict this by requiring Customer Data to contain no personal information — creating a disclosure inconsistency about what is actually collected.

Both governing documents are dated March 10, 2024 — roughly 29 months before the analysis date — which alone approaches the stale threshold. However, the Terms do address AI/ML derived data ('machine learning data created as a result of the Services'), so the policy is not entirely blind to the AI-first product. It is silent on named third-party model providers and the specific AI output pipelines (Revit/CAD generation, renders) visible in the product surface, so coverage is only partial. Rated YELLOW for partial coverage and age.

Multiple documents were supplied (Terms plus two Privacy Policy copies) and a material contradiction exists between the Terms and the Privacy Policy on personal data. The Terms require that Customer Data contain no personal information and be only anonymized, while the Privacy Policy describes collecting substantial Personal Information (name, email, phone, IP, CV). This inconsistency would lead a user to different conclusions about whether personal data may be handled at all. The two Privacy Policy copies are near-identical (one truncated), not a conflict in themselves.