Terms of Service

Effective date: August 16, 2026

1. Agreement and Order of Documents

These Terms govern access to and use of Dataflag's vendor data-governance rating service. If there is a conflict about personal data processing, the Data Processing Addendum controls. If there is a conflict about AI or model use, the AI and Data Use Addendum controls. If Dataflag and a customer sign a separate order form or negotiated agreement, that agreement controls only to the extent it expressly conflicts with these online terms.

2. Definitions

"Customer Content" means data, files, documents, text, prompts, inputs, uploads, workspace records, internal notes, vendor records submitted by Customer, and customer-specific outputs or reports generated for Customer through the Service.

"Public Vendor Materials" means vendor legal terms, privacy notices, DPAs, AI addenda, subprocessor pages, public websites, and other materials that Dataflag obtains from public sources independently of Customer's non-public submissions.

"Dataflag Materials" means the Service, software, workflows, scoring methodology, templates, rubrics, DGAIR framework materials, non-customer-specific rating logic, and Dataflag's pre-existing intellectual property.

3. Ownership

As between Customer and Dataflag, Customer retains all rights, title, and interest in Customer Content. Dataflag does not acquire ownership of Customer Content, including prompts, uploads, files, inputs, or customer-specific outputs.

Dataflag retains all rights in Dataflag Materials. Customer does not receive ownership of Dataflag Materials, the DGAIR methodology, or Public Vendor Materials by using the Service.

If Customer submits third-party materials, Customer represents that it has the right to submit them to the Service or that the materials are publicly available. Dataflag will not make Customer's non-public Customer Content available to other customers unless Customer instructs or authorizes Dataflag to do so.

4. Limited License to Customer Content

Customer grants Dataflag a limited, non-exclusive license to process Customer Content only as necessary to:

• provide, operate, secure, maintain, and support the Service;
• generate ratings, reports, alerts, clause findings, evidence artifacts, and customer-requested outputs;
• troubleshoot, prevent abuse, detect security issues, and maintain service reliability;
• provide billing, account administration, and customer support;
• comply with law and enforce the agreement; and
• improve the Service in ways that do not train, fine-tune, improve, or develop AI/ML models using Customer Content and do not commercialize identifiable Customer Content or re-identifiable derived artifacts.

Dataflag may not use Customer Content for any purpose not described in this section.

5. AI and Model Training

Customer Content is not used by Dataflag to train, fine-tune, improve, or develop AI/ML models by default. Customer Content includes prompts, files, uploads, document text, extracted clauses, ratings, outputs, and customer-specific reports.

Dataflag may use Customer Content for AI/ML training only if Customer gives prior written opt-in authorization accepted by an authorized workspace administrator. Any opt-in authorization must identify the data categories, model or feature, purpose, duration, revocation process, and whether any third-party model provider is involved.

6. Third-Party AI Providers

Dataflag may send Customer Content to third-party AI/model providers only to provide the Service. Dataflag requires those providers to process Customer Content under written terms that prohibit training, fine-tuning, model improvement, reuse, sale, or retention beyond what is necessary to provide the Service and comply with law.

7. No Sale or Commercialization

Dataflag does not sell Customer Content or personal information. Dataflag does not share Customer Content or personal information for cross-context behavioral advertising or targeted advertising.

Dataflag does not license, sell, monetize, or commercialize identifiable Customer Content, user content, prompts, uploads, outputs, customer-specific reports, or re-identifiable derived artifacts. Dataflag may use Public Vendor Materials and non-customer-specific Dataflag Materials to operate and improve its vendor-rating business, provided it does not disclose or commercialize Customer's non-public Customer Content.

8. Subprocessors and Service Providers

Dataflag may share Customer Content with subprocessors and service providers only under written agreements that limit processing to providing, securing, maintaining, supporting, or billing for the Service. Current subprocessors are listed on the Subprocessors page.

9. Confidentiality, Security, and Support Access

Dataflag will protect Customer Content as confidential information. Dataflag personnel may access Customer Content only on a need-to-know basis for service operation, support requested by Customer, security, abuse prevention, legal compliance, or incident response.

Dataflag will maintain administrative, technical, and organizational safeguards designed to protect Customer Content from unauthorized access, disclosure, alteration, and destruction. These safeguards include access controls, authentication protections, encryption in transit, vulnerability management, audit logging, and separation of production access by role.

10. Retention, Export, and Deletion

During the subscription term, Customer may access and export Customer Content and customer-specific reports using the Service or by written request to hello@dataflag.io.

After termination or upon Customer's deletion request, Dataflag will delete Customer Content from active production systems within 30 days unless retention is required by law, security, dispute resolution, or financial recordkeeping obligations. Backups are overwritten or deleted within 90 days unless subject to a legal hold or security investigation.

Dataflag may retain billing records, security logs, and legal records for the periods described in the Privacy Notice, but will not use retained records for AI training, advertising, or commercialization.

11. Material Changes

Dataflag will provide at least 30 days' advance notice of material changes to these Terms that expand Dataflag's rights to use Customer Content, change AI training posture, materially change subprocessor practices, or materially reduce deletion/export rights. Dataflag will not apply a material expansion of AI training or commercialization rights to Customer Content collected before the change without Customer's affirmative consent.