Workflow & Automation · dify.aiDify
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“You retain ownership of your Customer Content, including Customer Content from your accounts with Third-Party Services that are transmitted, processed, and/or stored in the Service. By transmitting, processing, and/or storing Customer Content in the Service, you hereby grant Dify a worldwide, non-exclusive, and limited-term license to access, use, process,…”
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Limits the scope of data subject rights by noting they may be overridden by legal requirements or contractual necessity, and that data may be retained even after consent withdrawal in certain circumstances.
Vague retention standards without defined maximum periods or user deletion request mechanisms described in this section. The backup-archive carve-out means data may persist well beyond account closure.
Mandatory venue in San Francisco makes litigation impractical for most non-local users, effectively limiting their ability to pursue claims. The irrevocable consent and venue waiver removes any flexibility.
Scores derived from 31 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Output ownership has conditions — review the commercial use and license carve-outs before building on these outputs.
- Data handling is conditional — 5 privacy or retention clauses warrant review before using Dify at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Dify's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 361 verified, verbatim-cited findings below — read the citations.
Based on 409 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 245 citationsstaticLast captured 2026-08-17
- Terms of ServiceVerified - read in full - 60 citationsstaticLast captured 2026-07-08
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment defines 'Content' broadly to include all data, information, or material created, uploaded, or stored by users through the Service, including AI applications, establishing the scope of user-generated content subject to ownership and use provisions.
" 14. “Content” means any data, information, or material created, uploaded, shared, or stored by the user through the Service, including AI applications created by the user through Dify, whether such application is provided in the form of an..."
Clause states that when users supply their own API key and select their own model provider, AI interaction data is transmitted directly to that provider and whether it is used for model training is governed by the agreement between the user and that provider, with the company bearing no responsibility — a disclaimer that limits the company's liability for third-party training use in the user-managed provider scenario.
" If you use a service where you select your own AI model provider and supply your own API key, your AI interaction data is transmitted directly to your chosen provider for processing. Whether such data is used for model training depends on ..."
Broad collection and storage of all content submitted through the product creates risk of secondary use. The clause does not limit storage duration or restrict what the stored content may subsequently be used for beyond what is stated elsewhere in the policy.
"Content you provide through our products: As part of the service, we collect and store the content you post, send, receive, and share through our product. This includes any data you enter in any “free text” box on our product, as well as..."
Specifies that the company collects and stores all content posted, sent, received, and shared through the product including free-text entries, files, links, and application data, establishing a broad content collection obligation with specific examples.
" service, we collect and store the content you post, send, receive, and share through our product. This includes any data you enter in any “free text” box on our product, as well as files and links you upload to the service. Examples of ..."
This segment specifies the categories of account and profile information collected at registration and during use (name, phone, email, passwords, display name, photo, job title), establishing the company's data collection obligations and the user's understanding of what personal data is processed.
" Account and profile information. When you register for an account, create or modify your profile, set preferences, sign-up for or make purchases through the Services, we collect information about you which includes without limitation yo..."
This segment describes the collection of contact information, issue summaries, and supporting documents submitted through user support channels (email, third-party IM tools), defining the scope of support-related data collection.
" user support, you can choose to submit information about any issues you encounter while using our services. You may contact us through email, third-party IM tools to directly communicate with our support team. You will be asked to provi..."
Extends the permitted use of this information to inform development of new products and services, broadening the scope of lawful processing purposes.
" and business, resolve issues and to inform the development of new products and services."
States the legal bases and purposes for processing personal information including service provision, business operation, contractual and legal compliance, security protection, and legitimate interests, establishing the foundational obligation and permission framework for data use.
" We collect and process personal information about you as necessary to provide the Products you use, operate our Sites and business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fu..."
Clause A's 11.1 specifies Delaware law, and its truncated 11.2 implies a jurisdiction consistent with that, which conflicts with Clause B's 11.2 explicitly stating exclusive jurisdiction in San Francisco, California, creating conflicting venues for dispute resolution.
" 11.1 These Terms will be governed by and construed in accordance with the laws of the State of Delaware, without reference to its conflict of laws principles. 11.2 If any dispute, controversy, difference or claim arising out of or relating to this Agreement occurs, any party may notify the other party of such dispute in writing. The parties shall negotiate and seek to resolve such dispute within fourteen (14) Business Days after the delivery of such notice. If the parties fail to resolve such dispute within the aforesaid period, any party may submit such disputes to the exclusive jurisdiction of a court of competent jurisdiction located in San Francisco, California, and each party irrevocably consents to such personal jurisdiction and waives all objections to this venue."
" 11.2 If any dispute, controversy, difference, or claim arising out of or relating to this Agreement arises, any party may notify the other party of such dispute in writing. The parties shall negotiate and seek to resolve such dispute within fourteen (14) Business Days after the delivery of such notice. If the parties fail to resolve such dispute within the aforesaid period, any party may submit such disputes to the exclusive jurisdiction of a court of competent jurisdiction located in San Francisco, California, and each party irrevocably consents to such personal jurisdiction and waives all objections to this venue."
Within one documentClause A completely excludes Dify's liability for specific types of damages (e.g., indirect, consequential), while Clause B sets a monetary cap on Dify's liability for all damages, implying a potential non-zero liability for those same types of damages where Clause A states zero.
" 6.2.1 Indirect Damages. To the maximum extent permitted by Law, Dify will not be liable to you or your Affiliates in relation to this Agreement or the Service during and after the Term, whether in contract, negligence, strict liability, tort or other legal or equitable theory, for any lost profits, personal injury, property damage, loss of data, business interruption, indirect, incidental, consequential, exemplary, special, reliance, or punitive damages, even if these losses, damages, or costs are foreseeable, and whether or not you or Dify have been advised of their possibility."
"liable to you or your Affiliates in relation to this Agreement or the Services during and after the Term, whether in contract, negligence, strict liability, tort or other legal or equitable theory, for losses, damages, or costs exceeding in the aggregate the total amount of Fees you paid to Dify.AI during the 3-month period immediately preceding the event giving rise to the liability."
Within one documentClause A states that personal information will *only* be provided to parties with protection systems equivalent to Japan's Act, even noting countries like China may not meet this, while Clause B lists China as a processing location for LangGenius, its affiliates, or service providers, but only generally states 'We take measures to ensure that the data... is processed,' without explicitly confirming that these measures, for all entities and locations listed, meet the strict Japan-equivalent standard set in Clause A, creating ambiguity and potential conflict.
" We may provide Your Information to third parties in the United States or other countries/regions. Specifically, our website servers are located in the United States, and our affiliates, partners, third parties, and service providers operate in the United States, European Economic Area, and China. These countries may not have systems for protecting personal information that are at an equivalent level as that of Japan. However, we will only provide personal information to parties that have established a system to ensure implementation of measures equivalent to those required under Japan’s Act on the Protection of Personal Information, and that are taking necessary measures to continuously maintain said compliant system. We shall provide information related to the said necessary measures upon request. If you would like such information, please send an inquiry via the information provided in “How to Contact Us” section below. For information on the personal information protection systems of each destination country/region, please refer to the “Survey on the Systems, etc. Concerning the Protection of Personal Information in Foreign Countries” published by the Personal Information Protection Commission of Japan ( https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku )."
" The information collected through our website and our products may be stored and processed in any country/region where LangGenius or its affiliated companies or service providers maintain facilities, including your region, the United States, Australia, Canada, China, and the European Economic Area and the United Kingdom. Our choice of processing location is to ensure efficient operations, improve performance, and create redundancy to protect data in the event of disruptions or other issues. We take measures to ensure that the data we collect in accordance with this Privacy Policy is processed in compliance with this Privacy Policy and applicable laws, regardless of where the data is located."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"Content you provide through our products: As part of the service, we collect and store the content you post, send, receive, and share through our product. This includes any data you enter in any “free text” box on our product, as well as files and links you upload to the service. Examples of the content we collect and store include applications you create in Dify.AI, descriptions of application-related commands, links to access applications, links to privacy policies for applications, or any other information you provide."
Broad collection and storage of all content submitted through the product creates risk of secondary use. The clause does not limit storage duration or restrict what the stored content may subsequently be used for beyond what is stated elsewhere in the policy.
AI-generated interpretation, not legal advice.
"Understand you and your preferences to enhance your experience and enjoyment using our Sites and Products, to provide recommendations, to solicit feedback, and to better market and advertise to you."
Using collected personal data to 'better market and advertise to you' is a commercial use of personal information. Depending on jurisdiction, this may require explicit consent (GDPR) or an opt-out right (CCPA).
AI-generated interpretation, not legal advice.
" You retain ownership of your Customer Content, including Customer Content from your accounts with Third-Party Services that are transmitted, processed, and/or stored in the Service. By transmitting, processing, and/or storing Customer Content in the Service, you hereby grant Dify a worldwide, non-exclusive, and limited-term license to access, use, process, copy, store, distribute, perform, transmit, export, and display Customer Content and to access your Dify Account, as reasonably necessary: (i) to provide, maintain, operate, improve, and update the Service; (ii) to prevent or address service, security, support, or technical issues; and (iii) as required by law. You shall be solely responsible for the accuracy, quality, content, and legality of Customer Data, and any actions triggered by Customer Data. You represent and warrant that: (i) you have obtained all necessary rights, releases, and permissions to transmit Customer Data through the Service and for any actions triggered by Customer Data on the Service, and to otherwise use, process, and/or store Customer Data on the Service used or stored; and (ii) Customer Data, and its transmission, processing, storage, and use as you authorize in these Terms or through your Dify.AI Account will not violate any laws or regulations, these Terms, or the terms of any applicable Third-Party Service."
Affirms that customers retain ownership of Customer Content while granting Dify.AI a worldwide, non-exclusive, limited-term license to access, use, process, copy, store, distribute, and display Customer Content as reasonably necessary to provide, maintain, and improve the service, establishing the scope of Dify.AI's licensed rights over customer data.
AI-generated interpretation, not legal advice.
" partners, such as our advertising and analytics partners, use various common technologies to provide functionality and identify you across different services and devices. Such technologies typically include tracking pixels, JavaScript, and various “local storage data” technologies, such as cookies and local storage. Such data may include text, personal information (such as your IP address), and information about how you use our services, depending on the technologies we use. For the purposes of this policy, we collectively refer to the cookies and other technologies identified here as “Cookies.” Most web browsers have a feature to block cookies. You can also choose to clear all cookies stored on your computer."
This segment defines the collective term 'Cookie' technologies and describes the types of data collected (including personal information such as IP address), establishing what constitutes tracking data for purposes of the policy.
AI-generated interpretation, not legal advice.
" Your Use of the Services: When you access any of our services and interact with them, we may track certain information about you, including but not limited to the features you use; the links you click on; the type, size, and filenames of attachments you upload to the services; and how you interact or click on our product services."
This segment describes automatic collection of behavioral and interaction data (features used, links clicked, attachment details, click interactions) when users access any service, establishing the scope of usage-based data collection.
AI-generated interpretation, not legal advice.
" other news about products and services offered by LangGenius and our partners."
This segment completes segment 59, specifying that marketing communications may also be on behalf of LangGenius's partners, thereby permitting commercial use of personal data for partner marketing purposes.
AI-generated interpretation, not legal advice.
" 2.1.1 LangGenius (and its Affiliates, as applicable) will make the Services available to you, including those described in the applicable Services Terms 2.1.2 You may use your Dify.AI Account and the Service only (i) for lawful purposes; and (ii) in accordance with these Terms and the Documentation. 2.1.3 You should not use or access the Service in violation of this Agreement. Further, you will not and will not permit anyone else to: (i) reverse engineer, decompile or seek to access the source code of the Service, except to the extent these restrictions are prohibited by law and then only upon advance notice to Dify.AI; (ii) copy, modify, create derivative works of or remove proprietary notices from the Service; (iii) conduct security or vulnerability tests of the Service, interfere with its operation or circumvent its access restrictions; (iv) use the Service to develop a product or Service competitive to Dify.AI; or (v) otherwise use the Service outside of the scope of the rights expressly granted herein. 2.1.4 You may not access or use the Service for any High-Risk Activities or to upload or transmit any Sensitive Personal Data. We have no liability under these Terms for any High-Risk Activities or Sensitive Personal Data in violation of the foregoing. 2.1.5 You acknowledge that (i) you are exclusively responsible for and control the content and distribution of any applications made or initiated to any person or entity in connection with your use of the Service; and (ii) any such application are made or initiated only as a result of your actions. "
This segment establishes the permitted scope of use (lawful purposes, in accordance with the Terms and Documentation) and imposes restrictions prohibiting reverse engineering, decompilation, source code access, and unauthorized activities, restricting the commercial and technical use of the Service.
AI-generated interpretation, not legal advice.
" (d) you do not respond in a timely manner to Dify.AI’s request for User Information or do not provide Dify.AI adequate time to verify and process updated User Information;"
Conditions continued service access on the customer's timely response to requests for user information and provision of adequate time for verification, restricting access where the customer fails to cooperate with identity or compliance verification.
AI-generated interpretation, not legal advice.
" (g) Dify.AI believes that your use of the Services (i) is or may be harmful to Dify.AI or any third party; (ii) degrades, or may degrade, the security, stability or reliability of the Dify.AI services, Dify.AI Technology or any third party’s system (e.g., your involvement in a distributed denial of service attack)(iii)enables or facilitates, or may enable or facilitate, illegal or prohibited transactions; (iv)is or may be unlawful."
Enumerates specific harmful, security-degrading, illegal, or unlawful use scenarios that justify Dify.AI's enforcement action against the user's account or service access.
AI-generated interpretation, not legal advice.
" (f) Dify.AI believes that you are engaged in a business, trading practice or other activity that presents an unacceptable risk to Dify.AI; or"
Establishes a condition under which Dify.AI may suspend or terminate service, restricting user access when the user's business activities present unacceptable risk to Dify.AI.
AI-generated interpretation, not legal advice.
" These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data (such as where tax authorities require us to retain it) or where it is needed for the proper performance of a contract. Under certain circumstances, this may mean that we are able to retain data even if you withdraw your consent."
Limits the scope of data subject rights by noting they may be overridden by legal requirements or contractual necessity, and that data may be retained even after consent withdrawal in certain circumstances.
AI-generated interpretation, not legal advice.
"We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the Products and protecting system security. We also retain personal data as needed to maintain appropriate business and financial records, protect our legal interests, resolve disputes, or comply with legal or regulatory requirements. Thereafter, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will store your personal information using appropriate security measures and take appropriate steps designed to isolate it from any further processing until deletion is possi"
Vague retention standards without defined maximum periods or user deletion request mechanisms described in this section. The backup-archive carve-out means data may persist well beyond account closure.
AI-generated interpretation, not legal advice.
"The parties agree that the waivers and limitations specified in this Section 6.4 apply regardless of the form of action, whether in contract, tort (including negligence), strict liability, or otherwise and will survive and apply even if any limited remedy specified in these Terms is found to have failed of its essential purpose."
This survival clause ensures that even if a limited remedy is deemed to have failed its essential purpose (a common basis for circumventing damage caps under UCC/common law), the liability limitations still apply, foreclosing a common user legal argument.
AI-generated interpretation, not legal advice.
"We will not refund or reimburse you if we terminate your Dify.AI Account for cause, including (without limitation) for a violation of this Agreement."
Paired with broad termination rights, this no-refund clause means users can lose prepaid fees entirely if Dify.AI determines (with significant discretion) that a violation occurred.
AI-generated interpretation, not legal advice.
" 6.2.1 Indirect Damages . To the maximum extent permitted by Law, Dify.AI will not be liable to you or your Affiliates in relation to this Agreement or the Service during and after the Term, whether in contract, negligence, strict liability, tort or other legal or equitable theory, for any lost profits, personal injury, property damage, loss of data, business interruption, indirect, incidental, consequential, exemplary, special, reliance, or punitive damages, even if these losses, damages, or costs are foreseeable, and whether or not you or Dify.AI have been advised of their possibility . 6.2.2 General Damages . To the maximum extent permitted by Law, Dify.AI will not be liable to you or your Affiliates in relation to this Agreement or the Services during and after the Term, whether in contract, negligence, strict liability, tort or other legal or equitable theory, for losses, damages, or costs exceeding in the aggregate the total amount of Fees you paid to Dify.AI during the 3-month period immediately preceding the event giving rise to the liability. 6.2.3. Applicability . The parties agree that the waivers and limitations specified in this Section 6.4 apply regardless of the form of action, whether in contract, tort (including negligence), strict liability, or otherwise and will survive and apply even if any limited remedy specified in these Terms is found to have failed of its essential purpose."
Limits Dify.AI's liability to the maximum extent permitted by law by excluding indirect, incidental, consequential, exemplary, special, reliance, and punitive damages including lost profits, personal injury, property damage, and loss of data, regardless of foreseeability or prior notice of such damages.
AI-generated interpretation, not legal advice.
" You understand and agree that in the process of using this Service, you may encounter the following situations that may cause service interruptions. In any of the following situations, LangGenius will be exempt from liability for any losses incurred to you: "
Establishes that LangGenius is exempt from liability for losses caused by service interruptions arising from the enumerated force majeure and related circumstances, limiting its financial exposure to users.
AI-generated interpretation, not legal advice.
"To the maximum extent permitted by Law, Dify.AI will not be liable to you or your Affiliates in relation to this Agreement or the Service during and after the Term, whether in contract, negligence, strict liability, tort or other legal or equitable theory, for any lost profits, personal injury, property damage, loss of data, business interruption, indirect, incidental, consequential, exemplary, special, reliance, or punitive damages, even if these losses, damages, or costs are foreseeable, and whether or not you or Dify.AI have been advised of their possibility ."
This is a very broad consequential damages waiver covering lost profits, personal injury, property damage, data loss, and business interruption. It applies 'during and after the Term' and survives contract termination, maximising Dify.AI's protection and minimising user recourse.
AI-generated interpretation, not legal advice.
" d. Network security incidents, such as computer viruses, Trojan horses or other malicious programs, or hacker attacks; "
Exempts LangGenius from liability for losses caused by network security incidents including malware, Trojan horses, and hacker attacks, categorizing these as uncontrollable external events.
AI-generated interpretation, not legal advice.
Common questions about Dify's policies
- Does Dify train its AI models on your data?
- No training on your content by default — based on 4 verified findings from Dify's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Dify's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
22 verified clausesClauses in Dify's policies that work in your favour — commitments the platform made to you.
- Confidentiality
“8.1 Each party ( “Disclosing Party” ) may disclose Confidential Information to the other party ( “Receiving Party” ) in connection with the Service. Confidential Information is anything that reasonably should be understood to be confidential given the nature o…”
Defines 'Disclosing Party,' 'Receiving Party,' and 'Confidential Information,' establishing the scope of what qualifies as confidential and the circumstances under which it is recognized, including explicit carve-outs fr…
📍 § 8.1Jump to exact text → - Confidentiality
“Nothing above will prevent either party from sharing Confidential Information with financial and legal advisors; provided, such advisors are bound to confidentiality obligations at least as restrictive as those in these Terms. 8.3 The Receiving Party may acce…”
Creates two exceptions to the confidentiality restrictions: (1) permitting disclosure to financial and legal advisors bound by equivalent confidentiality obligations, and (2) permitting legally compelled disclosure provi…
📍 § 8.2Jump to exact text → - Confidentiality
“Each party ( “Disclosing Party” ) may disclose Confidential Information to the other party ( “Receiving Party” ) in connection with the Service. Confidential Information is anything that reasonably should be understood to be confidential given the nature of th…”
Standard bilateral confidentiality definition with customary exclusions (public domain, prior knowledge, independent development). Protects both user and platform information equally.
📍 § 8.1Jump to exact text → - Confidentiality
“The Receiving Party will (i) take at least reasonable measures to prevent the unauthorized disclosure or use of Confidential Information, and limit access to those employees, affiliates, and contractors who need to know such information in connection with the…”
'Reasonable measures' is a common and generally acceptable standard. The advisor carve-out is standard practice. No unusual risk to users.
📍 § 8.2Jump to exact text → - Moderation & enforcementterms can change anytime
“We may modify this Policy at any time, without prior notice, and changes may apply to any personal information we already hold about you, as well as any new personal information collected after the Policy is modified. If we make changes, we will notify you…”
Establishes the procedure for policy modifications, including the right to modify at any time without prior notice, the obligation to notify via date revision, and heightened notice requirements for material changes affe…
- Terms changes: advance notice promised
Location: exact-text link only — source has no section structureJump to exact text → - Prompt ownership
“You retain ownership of your Customer Content, including Customer Content from your accounts with Third-Party Services that are transmitted, processed, and/or stored in the Service. By transmitting, processing, and/or storing Customer Content in the Service, y…”
The license grant is non-exclusive and 'limited-term,' which is better than perpetual, but the scope — including copying, distributing, transmitting, and displaying content for service improvement — is broad. The 'improv…
📍 § 4.3 (Customer Data and the Service)Jump to exact text →
+ 16 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
3 verified clausesWhat Dify requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementconduct restrictions
“You further warrant that all applications made or initiated in connection with your use of the Service comply with all applicable foreign and U.S. federal or state laws and regulations, before you make or initiate any application through the Service. 2.1.6 Yo…”
This segment imposes an obligation on the user to ensure all applications comply with applicable foreign and U.S. laws before use, and includes representations and warranties regarding export control compliance, restrict…
📍 § 2.1.5Jump to exact text → - Moderation & enforcementconduct restrictions
“2.1.1 LangGenius (and its Affiliates, as applicable) will make the Services available to you, including those described in the applicable Services Terms 2.1.2 You may use your Dify.AI Account and the Service only (i) for lawful purposes; and (ii) in accordanc…”
This segment establishes the permitted scope of use (lawful purposes, in accordance with the Terms and Documentation) and imposes restrictions prohibiting reverse engineering, decompilation, source code access, and unaut…
📍 § 2.1.1Jump to exact text → - Moderation & enforcement
“(c) you do not update in a timely manner your implementation of the Services or Dify.AI Technology to the latest production version Dify.AI recommends or requires;”
Conditions continued service access on the customer's timely update of their implementation to the latest recommended or required production version, restricting access for non-compliant implementations.
📍 § 7.2 (Suspension)Jump to exact text →
What the policies actually cover
17 topics- Product telemetry & usage tracking23 clauses
- Advertising & tracking6 clauses
- Sensitive data (biometric, location, health)3 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure4 clauses
- Data shared with other AI providers1 clause
- Does not train on your content1 protective1 clause
- Arbitration & class-action waiver1 clause
- Damages & liability cap9 clauses
- Indemnity direction1 clause
- Terms can change at any time2 protective4 clauses
- Deletion rights & post-termination survival1 protective3 clauses
- License survival after account deletion1 clause
- Auto-renewal & cancel window1 clause
- Feedback ownership1 clause
- Breach-notification promises1 clause
- Conduct restrictions2 obligations2 clauses
242 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy addresses how long content is retained, and the Privacy Policy, § 2 (How we use information we collect?) addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, § 4.3 (Customer Data and the Service) describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “Legal Bases for Processing” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Services you have requested or authorized, including maintaining and improving the performance of the ...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain each category of personal information for as long as necessary to fulfill the purposes outlined in this Section, typically until the end of your customer relationship with us, or as required by applicable laws.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | confidentiality | improves | LOW | 2 |
| All applicable tiers | data retention | conditional | MEDIUM | 7 |
| All applicable tiers | indemnity liability | worsens | HIGH | 9 |
| All applicable tiers | moderation enforcement | worsens | HIGH | 1 |
| All applicable tiers | output ownership | conditional | MEDIUM | 2 |
| All applicable tiers | privacy data use | worsens | HIGH | 9 |
| All applicable tiers | prompt ownership | conditional | MEDIUM | 2 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 5 |
| All applicable tiers | training use | conditional | MEDIUM | 1 |
| Pro / Paid | privacy data use | conditional | MEDIUM | 1 |
| Team / Business | confidentiality | conditional | MEDIUM | 2 |
| Team / Business | data retention | conditional | MEDIUM | 6 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“We may share this information with the following service providers through the provision of the Service: Amazon Web Services (AWS), Google Workspace.”Before citation
“We do not sell or share your personal information with third parties for “cross-context behavioral advertising”, and do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“We do not sell or share your personal information with third parties for “cross-context behavioral advertising”, and do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.”Before citation
“For individuals residing in Japan: with respect to your retained personal data, you may request disclosure, correction, suspension of use, erasure, or suspension of provision to third parties. To make such a request, please email privacy@dify.ai . After we verify your identity, we will respond within the period prescribed by law (in principle, within two weeks of receiving the request). No fee will be charged for a request for disclosure.”After citation
model training improved from high/training permitted to low/no training claim.
“By transmitting, processing, and/or storing Customer Content in the Service, you hereby grant Dify a worldwide, non-exclusive, and limited-term license to access, use, process, copy, store, distribute, perform, transmit, export, and display Customer Content and to access your Dify Account, as reasonably necessary: (i) to provide, maintain, operate, improve, and update the Service; (ii) to prevent or address service, security, support, or technical issues; and (iii) as required by law.”Before citation
“About AI interaction data. LangGenius is a platform company. We do not train AI models ourselves, and we will not use your AI interaction data for model training. How your AI interaction data is used depends on the type of service you use:”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“such as social networks. If you interact with us through a social network, we may receive information from the social network such as your name, profile information, and any other information you permit the social network to share with third parties.”Before citation
“We do not sell or share your personal information with third parties for “cross-context behavioral advertising”, and do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.”After citation
legal burden changed from medium/liability limited to medium/indemnity.
“From time to time, Dify may invite Customer and Users to discuss or evaluate certain pre-release or beta releases on a trial basis (collectively “Beta Releases”) of the Service. Customer may accept or decline any such evaluation or trial. Beta Releases designated by Dify as “beta,” “pilot,” “non-production evaluation,” “design partner,” or other similar designations are solely for Customer’s internal evaluation purposes. If Customer opts into Beta Releases, Customer agrees to participate in usage and other testing and provide feedback about the Beta Releases, as reasonably requested by Dify. Beta Releases are not considered the Service under this Agreement, and may not be supported and may be subject to additional terms as outlined in an Order Form. Dify may discontinue Beta Releases at any time and may never make Beta Releases generally available. Dify will not be liable for any damages or harm arising out of or in connection with Beta Releases. Beta Releases are provided on an “AS IS” basis without express or implied warranty and indemnity. Dify will have no liability for, and Customer hereby releases Dify from any liability or damage arising out of or in connection with any Beta Releases.”Before citation
“Comply with applicable laws, rules, or regulations and cooperate and defend legal claims and audits.”After citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We do not sell or share your personal information with third parties for “cross-context behavioral advertising”, and do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.”Open timeline citation
Latest stance: third party or vendor sharing on audit rights dpa residency
“We may provide Your Information to third parties in the United States or other countries/regions. Specifically, our website servers are located in the United States, and our affiliates, partners, third parties, and service providers operate in the United States, European Economic Area, and China. These countries may not have systems for protecting personal information that are at an equivalent level as that of Japan. However, we will only provide personal information to parties that have established a system to ensure implementation of measures equivalent to those required under Japan’s Act on the Protection of Personal Information, and that are taking necessary measures to continuously maintain said compliant system. We shall provide information related to the said necessary measures upon request. If you would like such information, please send an inquiry via the information provided in “How to Contact Us” section below. For information on the personal information protection systems of each destination country/region, please refer to the “Survey on the Systems, etc. Concerning the Protection of Personal Information in Foreign Countries” published by the Personal Information Protection Commission of Japan ( https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku ).”Open timeline citation
Latest stance: indefinite or necessity based on data retention
“We retain each category of personal information for as long as necessary to fulfill the purposes outlined in this Section, typically until the end of your customer relationship with us, or as required by applicable laws.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“With respect to the categories of personal information identified above in this Section (1), we disclose your personal information to the following categories of third parties:”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-08-17· verified 2026-08-17
- Terms of Service:Last captured 2026-07-08· verified 2026-07-08
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 217 fewer findings this quarter vs last (295 vs 512). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Dify's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Dify's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.