Diffusion Studio procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Several of our sub-processors are located outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on:” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Data Protection Officer: We have not appointed a DPO because we are not required to under Article 37 GDPR” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ the EU-US Data Privacy Framework where the recipient is certified.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You may request a copy of the transfer safeguards by contacting contact@diffusion.studio .” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ When you delete your account via the in-app Delete account function, we trigger deletion of your authentication record at Supabase and your associated user_data and usage_records rows. Backups are purged on a rolling 24h cycle.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Billing data: for 10 years as required by tax and accounting law in Delaware.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Support correspondence: 2 years after the ticket is closed.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ User content (uploaded media): until you delete it, or until 24 hours after creation.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal data only as long as necessary for the purposes set out above:” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Account data: for the lifetime of your account, then deleted within 24 hours (subject to legal-hold exceptions).” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may terminate at any time by deleting your account in-app (which deletes your data as described in the Privacy Policy) or by emailing support@diffusion.studio .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Service integrates third-party providers, including but not limited to Supabase, Stripe, Google Cloud, AWS, Fly.io, Sentry, Umami, OpenAI, Google (Gemini/Veo), ElevenLabs, AssemblyAI and Fal.ai. Your use of features that depend on these providers may be subject to their own terms. We are not responsible for the availability, content or practices of third-party services.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ some third-party model providers retain Outputs for safety review under their own terms (see Section 4 of the Privacy Policy for the list of sub-processors).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Amazon Web Services (S3) Hosting of static assets (fonts) Technical data only eu-central-1 Fly.io API hosting All data in transit through the API Multi-region (including US and EU) ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ billing address, country and tax identifiers (collected and stored by Stripe)” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share your personal data only with the following categories of recipients, each acting as a processor under a Data Processing Agreement:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ OpenAI Image generation, text-to-speech Prompts and reference inputs you submit US Google (Gemini / Veo) Video generation Prompts and reference inputs you submit US ElevenLabs Music, sound effects, text-to-speech Prompts and reference inputs you submit US AssemblyAI Audio/video transcription Audio you submit for transcription US Fal.ai Background removal, image and video upscaling Images/videos you submit US ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ crash reports and exception traces (including user ID and email) collected via Sentry” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ pageviews, route changes and product events (e.g. sign_in , sign_out , account_deleted ) collected via Umami analytics” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ We may modify, suspend or discontinue features at any time. Where a change materially reduces the Service for paid users, we will give you at least 14 days notice and offer a pro-rated refund of unused credits.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If you are a consumer resident in the EU, you have the right to withdraw from a subscription within 14 days of purchase, in accordance with Directive 2011/83/EU.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ To withdraw, email contact@diffusion.studio within the 14-day window. Refunds are issued via the original payment method within 14 days.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ However , by starting to use credits before the 14-day period expires, you expressly request that we begin performance of the service immediately and you acknowledge that you lose your right of withdrawal once the credits granted under that billing cycle are fully consumed (Art. 16(m), Directive 2011/83/EU).” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.