Dify procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The information collected through our website and our products may be stored and processed in any country/region where LangGenius or its affiliated companies or service providers maintain facilities, including your region, the United States, Australia, Canada, China, and the European Economic Area and the United Kingdom. Our choice of processing location is to ensure efficient operations, improve performance, and create redundancy to protect data in the event of disruptions or other issues. We take measures to ensure that the data we collect in accordance with this Privacy Policy is processed in compliance with this Privacy Policy and applicable laws, regardless of where the data is located.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you reside in the EEA, the UK, or Switzerland, you may have the right to lodge a complaint with your local supervisory authority for data protection. Use the following contact information and link to find your local supervisory authority.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ This section below is specifically for you if you are located in the European EconomicArea (EEA), United Kingdom or Switzerland. LangGenius is the data controller of your personal information when we use it as described in these” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ (including the UK) and Switzerland to the United States or other countries/regions where the European Commission has not determined their laws provide adequate data protection, we use legal mechanisms designed to help ensure your rights and protections, including contracts. Specifically, our website servers are located in the United States, and our affiliates, partners, third parties, and service providers operate in the United States, European Economic Area, and China. This means that when we collect your personal information, we may process it in any of these countries. However, we have taken appropriate safeguards to require that your personal information is protected in accordance with this privacy policy. The main safeguard relied upon by LangGenius is the” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We may provide Your Information to third parties in the United States or other countries/regions. Specifically, our website servers are located in the United States, and our affiliates, partners, third parties, and service providers operate in the United States, European Economic Area, and China. These countries may not have systems for protecting personal information that are at an equivalent level as that of Japan. However, we will only provide personal information to parties that have established a system to ensure implementation of measures equivalent to those required under Japan’s Act on the Protection of Personal Information, and that are taking necessary measures to continuously maintain said compliant system. We shall provide information related to the said necessary measures upon request. If you would like such information, please send an inquiry via the information provided in “How to Contact Us” section below. For information on the personal information protection systems of each destination country/region, please refer to the “Survey on the Systems, etc. Concerning the Protection of Personal Information in Foreign Countries” published by the Personal Information Protection Commission of Japan ( https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku ).” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ When we transfer personal information from the European Economic Area, the UK, and Switzerland to the United States or other countries/regions where the European Commission has not determined their laws provide adequate data protection, we use legal mechanisms designed to help ensure your rights and protections, including contracts. Specifically, our website servers are located in the United States, and our affiliates, partners, third parties, and service providers operate in the United States, European Economic Area, and China. This means that when we collect your personal information, we may process it in any of these countries. However, we have taken appropriate safeguards to require that your personal information is protected in accordance with this privacy policy. The main safeguard relied upon by LangGenius is the Standard Contractual Clauses for Data Protection approved by the European Commission. For more information about these mechanisms, please contact us using the detailed contact information provided in the “How to Contact Us” section below.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “EU - Ireland Representative Company Name: Instant EU GDPR Representative Ltd Name: Adam Brogden Email: contact@gdprlocal.com Tel: + 353 15 549 700 Your Reporting Link: https://langgeniusinc.gdprlocal.com/eu” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ European Commission. For more information about these mechanisms, please contact us using the detailed contact information provided in the “How to Contact Us” section below.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ The information collected through our website and our products may be stored and processed in any country/region where LangGenius or its affiliated companies or service providers maintain facilities, including your region, the United States, Australia, Canada, China, and the European Economic Area (including the United Kingdom). Our choice of processing location is to ensure efficient operations, improve performance, and create redundancy to protect data in the event of disruptions or other issues. We take measures to ensure that the data we collect in accordance with this Privacy Policy is processed in compliance with this Privacy Policy and applicable laws, regardless of where the data is located.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Right to Know and Access. You have the right to request disclosure of the personal information we collect and process. This includes: (1) categories of personal information collected or disclosed; (2) the business purposes for such collection; (3) the categories of sources from which information is originated; (4) the categories of third parties or service providers with whom we share information; and (5) the specific pieces of personal information we maintain about you.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Lucan Co. Dublin” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ This section below is specifically for you if you are located in the European Economic Area (EEA), United Kingdom or Switzerland. LangGenius is the data controller of your personal information when we use it as described in these Lawful Basis for Processing Personal Information , meaning that we determine and are responsible for how your personal information is processed.” | Captured 2026-08-17Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the Products and protecting system security. We also retain personal data as needed to maintain appropriate business and financial records, protect our legal interests, resolve disputes, or comply with legal or regulatory requirements. Thereafter, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will store your personal information using appropriate security measures and take appropriate steps designed to isolate it from any further processing until deletion is possi” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We may anonymize and aggregate any of the personal information we collect (so that it does not directly identify you). We may use anonymized information for purposes that include testing our IT systems, research, data analysis, improving the Service. We may also share such anonymized and aggregated information with others.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Products you have requested or authorized, including maintaining and improving the performance of the Products and protecting system security. We also retain personal data as needed to maintain appropriate business and financial records, protect our legal interests, resolve disputes, or comply with legal or regulatory requirements. Thereafter, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will store your personal information using appropriate security measures and take appropriate steps designed to isolate it from any further processing until deletion is possible.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws. For example, we retain your account information for as long as your account is active or as needed to provide you with Services you have requested or authorized, including maintaining and improving the performance of the Services and protecting system security. We also retain personal data as needed to maintain appropriate business and financial records, protect our legal interests, resolve disputes, or comply with legal or regulatory requirements. Thereafter, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will store your personal information using appropriate security measures and take appropriate steps designed to isolate it from any further processing until deletion is possible.” | Captured 2026-08-17Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data (such as where tax authorities require us to retain it) or where it is needed for the proper performance of a contract. Under certain circumstances, this may mean that we are able to retain data even if you withdraw your consent.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain each category of personal information for as long as necessary to fulfill the purposes outlined in this Section, typically until the end of your customer relationship with us, or as required by applicable laws.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Recipients of content and AI interaction data: We may share this information with AI model providers acting as our sub-processors for the purpose of providing AI features. Please refer to our Sub-processor List for details of such providers.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We receive information about you from other service users, our partners, and third-party service providers, social media platforms, and public databases. We may combine this information with the information we collect through other means. This helps us update and improve our records, identify new customers, create more personalized advertising, and recommend services that you may be interested in. When asked to provide personal information, you may refuse. However, if you choose not to provide the information required for certain products, these products or some of their features may not be available or may not function properly.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share this information with the following service providers through the provision of the Service: Google Workspace, AWS” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Recipients of your registration/account information:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share this information with the following service providers through the provision of the Service: Amazon Web Services (AWS), Google Workspace.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share your personal information with your consent. We may also share any category of personal information described above:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “### Recipients of payment transaction and billing information: ###” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Sharing with our business partners and other third-party service providers. We share information with third parties who help us operate, provide, improve, integrate, customize, support, and market our services. For example, to provide services to you, we may share information with third-party service partners who provide consulting support. We work with third-party service providers who provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analytics, and other services to us. Such services may require the service provider to access or use information about you. If a service provider needs to access information about you to act on our behalf in performing services, they will do so under our close instruction and adopt appropriate security and confidentiality procedures to protect your informat” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ through the provision of the Service: Github, Google, Amazon Web Services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share this information with the following service providers through the provision of the Service: Stripe, Amazon Web Services, Google Workspace, Brevo.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ regulations. We may share information as required by law or subpoena, or if we reasonably believe that such action is necessary to comply with applicable laws or the reasonable requests of law enforcement, enforce our terms of service, or protect the security or integrity of our website and products, or to exercise or protect the rights, property, or personal safety of our customers, users, or others.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Sharing with potential buyers and advisors. If there is a company sale, merger, reorganization, dissolution, similar event, or measures taken in anticipation of such an event (such as due diligence in a transaction), your personal information may (in accordance with applicable law) be shared with our advisors and any potential buyer’s advisors and be transferred to the new owner of the business” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Sharing with our business partners and other third-party service providers. We share information with third parties who help us operate, provide, improve, integrate, customize, support, and market our services. For example, to provide services to you, we may share information with third-party service partners who provide consulting support. We work with third-party service providers who provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analytics, and other services to us. Such services may require the service provider to access or use information about you. If a service provider needs to access information about you to act on our behalf in performing services, they will do so under our close instruction and adopt appropriate security and confidentiality procedures to protect your information. This includes AI model providers who process your AI interaction data on our behalf as described in Section 2. For details of such providers, please refer to our Sub-processor List.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share information as required by law or subpoena, or if we reasonably believe that such action is necessary to comply with applicable laws or the reasonable requests of law enforcement, enforce our terms of service, or protect the security or integrity of our website and products, or to exercise or protect the rights, property, or personal safety of our customers, users, or others” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ The Service may contain, or otherwise enable, links to and integrations with Third-Party Services, whether located within the Service or on separate Third-Party Service websites that connect back to the Service. These Third-Party Services are provided for your convenience only and Dify.AI does not approve, endorse, or recommend any Third-Party Services (or any products or other services associated therewith) to you. Your access and use of any Third-Party Service is at your own risk, and Dify.AI is not responsible for the accuracy or reliability of any information, data, opinions, advice, or statements made by, on, or through such Third-Party Services. Dify.AI disclaims all responsibility and liability for your use of any Third-Party Service. Third-Party Services are not governed by this Agreement or Dify.AI’s Privacy Policy. Your use of any Third-Party Service, including those linked from https://dify.ai/, is subject to that Third-Party Service’s own terms of use and privacy policies (if any). You acknowledge and agree that your account information regarding your use of a Third-Party Service integration through your Dify.AI Account may be shared with that Third-Party Service. Pursuant to your configuration and usage of the Service, Customer Data will be transmitted to and from your Dify.AI Account to one or more Third-Party Service(s) you’ve linked with your Dify.AI Account. We may also share your Customer Data with a specific Third-Party Service that you linked to your Dify.AI Account in order to prevent or resolve service, security, support, or technical issues related to that Third-Party Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell or share your personal information with third parties for “cross-context behavioral advertising”, and do not have actual knowledge that we sell or share personal information of consumers under 16 years of age.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share this information with the following service providers through the provision of the Service: Metabase, Cloudflare, and AWS.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We are not responsible for the data policies and procedures or content of any third party. We recommend that you review the privacy policies of each website you visit.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Sharing information to maintain compliance with laws and regulations. We may share information as required by law or subpoena, or if we reasonably believe that such action is necessary to comply with applicable laws or the reasonable requests of law enforcement, enforce our terms of service, or protect the security or integrity of our website and products, or to exercise or protect the rights, property, or personal safety of our customers, users, or others.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “### Recipients of your registration/account information: ###” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Sharing with potential buyers and advisors. If there is a company sale, merger, reorganization, dissolution, similar event, or measures taken in anticipation of such an event (such as due diligence in a transaction), your personal information may (in accordance with applicable law) be shared with our advisors and any potential buyer’s advisors and be transferred to the new owner of the business.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ providers. We share information with third parties who help us operate, provide, improve, integrate, customize, support, and market our services. For example, to provide services to you, we may share information with third-party service partners who provide consulting support. We work with third-party service providers who provide website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analytics, and other services to us. Such services may require the service provider to access or use information about you. If a service provider needs to access information about you to act on our behalf in performing services, they will do so under our close instruction and adopt appropriate security and confidentiality procedures to protect your information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ services on Dify.AI, we collect your payment and billing information. You may also be required to provide credit card information to third-party secure payment processing service providers (such as Stripe). We do not store your credit card information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (b) a Governmental Authority requires or directs Dify.AI to do so;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ through the provision of the Service: Stripe, Amazon Web Services, Google Workspace, Brevo.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Recipients of payment transaction and billing information:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Sharing with our data processors and sub-processors. We may entrust third-party data processors (referred to as “contractors” or “sub-processors” under applicable laws) with the processing of your personal information to the extent necessary to achieve the purposes described in Section 2 of this Policy. We will assess whether such processors meet our selection criteria, enter into appropriate data processing agreements, and ensure that they will properly manage your information in accordance with our instructions and applicable data protection laws.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Recipients of Chat, comments and opinions:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 7. “Third-Party Services” means any third-party service, connection, site, platform, application, software, or integration that interoperates with the Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share this information with the following service providers through the provision of the Service: Stripe, AWS.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ through the provision of the Service: Stripe, and Amazon Web” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ other news about products and services offered by LangGenius and our partners.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Name, Email address, Employer’s name, Financial Information (Payment Transaction, Billing Information, etc.), Chat, Comments and Opinions, etc. ” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ through the provision of the Service: Sentry, Cloudflare, and Amazon Web Services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ With respect to the categories of personal information identified above in this Section (1), we disclose your personal information to the following categories of third parties:” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share this information with the following service providers through the provision of the Service: Github, Google, AWS.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “You acknowledge and agree that your account information regarding your use of a Third-Party Service integration through your Dify.AI Account may be shared with that Third-Party Service. Pursuant to your configuration and usage of the Service, Customer Data will be transmitted to and from your Dify.AI Account to one or more Third-Party Service(s) you’ve linked with your Dify.AI Account. We may also share your Customer Data with a specific Third-Party Service that you linked to your Dify.AI Account in order to prevent or resolve service, security, support, or technical issues related to that Third-Party Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Recipients of information about how you access and use the Service:” | Captured 2026-08-17Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ 11. “Fees” mean the fees applicable to your use of the Service in accordance with the applicable package as included in our pricing notice included in the Service or on Dify’s website or, if applicable, as set forth in a Dify order form.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.