Enterprise Search / Productivity · dust.comDust
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
“Foundational Model Providers (OpenAI, Anthropic, Mistral, Google, Fireworks) are prohibited from using any customer and personal data for model training. They apply a "Zero Data Retention" policy, meaning that Customer Content will not be logged for human review and will not be saved to disk or retained by those providers. Certificates can be found in the…”
Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.
Watch: subprocessors data sharing
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Restricts internal access to personal data to authorized personnel only and limits third-party disclosures to those necessary for the processing purposes described, imposing a need-to-know and purpose-limitation restriction on data sharing.
Establishes the procedure for updating and amending the Privacy Policy, including when changes become effective upon posting, the obligation to provide additional notice for material changes, and the binding effect of the version in force at the time of use.
This segment discloses the sources and purposes of processing identification and contact data, including platform delivery, marketing communications, leads qualification, and event management — establishing lawful basis and purpose limitation obligations for this data category.
How to read this page: Overall risk rates what Dust's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Partially verified — Terms of Service — Capture under review; Privacy Policy — Verified (read in full, 89 findings). Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Needs review
A core policy document is captured but requires review before AIRIN can mark the corpus fully verified.
- Terms of ServiceCompleteness unconfirmedstatic
- Privacy PolicyVerified - read in full - 89 citationspdf textLast captured 2026-08-31
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Specifies that international transfers of personal data outside the EEA/EU are protected either by adequacy decisions or Standard Contractual Clauses, obligating Dust to implement appropriate transfer safeguards and establishing data residency and transfer compliance requirements.
" Google: We access your Google User Data only to facilitate and enhance the functions of our application. Specifically, we synchronize your Google Docs, Google Slides, pdfs, and plain text files that are within the folders you select when c..."
Defines 'Marketing Communications' and 'Internal Development' including machine learning and benchmarking, establishing the scope of processing activities that include training-related uses of anonymised and aggregated data.
" "Marketing Communications" means when we contact you about Dust's Platform, events, or business. "Internal Development" means when Dust improves and better develops the Platform including testing, research, reporting, benchmarking, machin..."
Defines 'Marketing Communications' as a processing purpose category covering contact about the platform, events, or business, establishing the scope of this use category.
"**"Marketing Communications"** means when we contact you about Dust's Platform, events, or business."
Restricts internal access to personal data to authorized personnel only and limits third-party disclosures to those necessary for the processing purposes described, imposing a need-to-know and purpose-limitation restriction on data sharing.
" Within Dust, only authorized personnel have access to your Personal Data. We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Da..."
Permits disclosure of personal data to third parties for usual business practices, subject to the limitation that disclosures are only for the processing purposes previously set out, and introduces the list of third-party recipients.
"We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the ..."
Permits disclosure or transfer of Personal Data to fulfill legal obligations when required by a legal authority, and also in the context of corporate transactions such as mergers or acquisitions, establishing two distinct permissive grounds for third-party disclosure.
"We may also disclose or transfer your Personal Data to fulfil our legal obligations or when a legal authority requires a disclosure. We may also disclose your Personal Data if we are a party of a business sale, such as a merger or an acquis..."
Imposes an obligation on Dust to adhere to the referenced Google API Services User Data Policy, including Limited Use requirements, when using or transferring information received from Google APIs to any other app, incorporating an external policy standard by reference.
"Dust use and transfer of information received from Google API's to any other app will adhere to [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including Limited Use requirements."
Clause A states Dust acts as a Data Controller for Customer Personal Data, while Clause B explicitly states the policy does not cover Customer Personal Data because Dust acts as a Data Processor for it.
"As Data Controller, Dust will process Customer Personal Data to provide the Platform and for other limited purposes as outlined in Section 6 below."
" This Privacy Policy only applies where we are processing your Personal Data for our own purposes and are acting as Data Controller under the General Data Protection Regulation (UE) 2016/679 ("GDPR"). It does not cover the Personal Data Dust collects, uses, and discloses when acting as a Data Processor under the GDPR on behalf of its Customers ("Customer Personal Data") and under their instructions in connection with Dust Platform. We invite you to contact your company or organization if you have any questions about its privacy practices. As Data Controller, Dust will process Customer Personal Data to provide the Platform and for other limited purposes as outlined in Section 6 below. Where Dust is the Data Controller, if you have any questions about this Platform Privacy Policy or about our data protection practices, you can contact us. See how to contact us in Section 13 below."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" Within Dust, only authorized personnel have access to your Personal Data. We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:"Permalink to this finding →
Restricts internal access to personal data to authorized personnel only and limits third-party disclosures to those necessary for the processing purposes described, imposing a need-to-know and purpose-limitation restriction on data sharing.
AI-generated interpretation, not legal advice.
" Source: When you order and use our Platform, or contact us or otherwise interact with us; From third parties and publicly available sources Purpose: Delivering the Platform; Marketing Communications (as defined below); Leads qualification; Organizing, managing, and facilitating access to our events"
This segment discloses the sources and purposes of processing identification and contact data, including platform delivery, marketing communications, leads qualification, and event management — establishing lawful basis and purpose limitation obligations for this data category.
AI-generated interpretation, not legal advice.
" Web page interactions (clicks, browsing, zooms and other interactions), referring web page/source through which you accessed the Sites, and statistics associated with the interaction between device or browser and the Sites"
This segment enumerates specific digital behavioral data categories collected (clicks, browsing, web interactions, referral sources, statistics), defining the scope of this personal data category.
AI-generated interpretation, not legal advice.
" Domain server, type of device/operating system/browser used to access the Platform, local and language settings; session logging, heatmaps and scrolls; screen resolution, ISP, referring or exit pages; and date and time of your visit"
This segment enumerates specific device and technical data categories collected (browser type, session logging, heatmaps, etc.), defining the scope of this personal data category.
AI-generated interpretation, not legal advice.
" Source: When you order and use our Platform, contact us, or otherwise interact with us; From third parties and publicly available sources Purpose: Marketing Communications; Leads qualification; Organizing, managing, and facilitating access to our events"
This segment discloses sources and purposes for processing professional/employment data including marketing communications, leads qualification, and events — establishing purpose limitation and lawful basis for this data category.
AI-generated interpretation, not legal advice.
"If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at [privacy@dust.tt](mailto:privacy@dust.tt)."
Establishes a right for California residents to request information about disclosures of personal information to third parties for direct marketing purposes during the preceding calendar year, limited to one request per year, and specifies the procedure for making such a request via email.
AI-generated interpretation, not legal advice.
" The "Effective Date" at the top of this webpage mentions when this Platform Privacy Policy was last revised. We may update and amend this Platform Privacy Policy from time to time. Any changes will become effective when we post a revised version of this Platform Privacy Police. If we make changes that materially alter your privacy rights, Dust will provide additional notice, such as via email or through the platform directly. Your use of our Platform is subject to the terms in the version of this Platform Privacy Policy that is posted at the time of your use of the Platform and we encourage you to review this Platform Privacy Policy any time you use our Platform."
Establishes the procedure for updating and amending the Privacy Policy, including when changes become effective upon posting, the obligation to provide additional notice for material changes, and the binding effect of the version in force at the time of use.
AI-generated interpretation, not legal advice.
" We may share, disclose and transfer your Personal Data with our current and future subsidiaries and affiliated companies for all purposes mentioned in Section 4 above."
Permits Dust to share, disclose, and transfer personal data with current and future subsidiaries and affiliated companies for the purposes enumerated in Section 4, granting broad intra-group sharing rights.
AI-generated interpretation, not legal advice.
" If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at privacy@dust.tt ."
Grants California residents a specific right under California Civil Code Section 1798.83 to request disclosure of personal information shared with third parties for direct marketing, limited to one request per year, and specifies the procedure for exercising that right via email.
AI-generated interpretation, not legal advice.
"We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:"
Permits disclosure of personal data to third parties for usual business practices, subject to the limitation that disclosures are only for the processing purposes previously set out, and introduces the list of third-party recipients.
AI-generated interpretation, not legal advice.
"Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions."
States Dust's obligation to conclude data processing agreements with service providers to ensure Personal Data is used, stored, and transferred securely and in accordance with applicable laws and Dust's instructions — a user-favorable procedural commitment.
AI-generated interpretation, not legal advice.
"Foundational Model Providers (OpenAI, Anthropic, Mistral, Google, Fireworks) are prohibited from using any customer and personal data for model training. They apply a "Zero Data Retention" policy, meaning that Customer Content will not be logged for human review and will not be saved to disk or retained by those providers. Certificates can be found in the [Sub-Processors list](https://dust-tt.notion.site/Sub-Processors-cb656ff3093c4aee9e080e3021e71f9c)."
Prohibits foundational model providers from using customer and personal data for model training and specifies a Zero Data Retention policy meaning Customer Content will not be logged for human review or saved to disk — explicitly protective of the user by forbidding training use by named subprocessors.
AI-generated interpretation, not legal advice.
" IP address, Cookie IDs, device IDs, as described by our Cookie Notice "
This segment defines the category of unique identifiers collected (IP address, Cookie IDs, device IDs) and incorporates by reference the Cookie Notice for further detail — establishing scope of this data category and cross-referencing another policy document.
AI-generated interpretation, not legal advice.
" Purpose: Managing payments, contracts, transactions, and otherwise meeting our contractual requirements"
This segment identifies the purpose for processing Agreement and Transaction Data (managing payments, contracts, transactions, and meeting contractual requirements), establishing purpose limitation and contractual necessity as legal basis for this data category.
AI-generated interpretation, not legal advice.
" To provide the Platform to our Customers in accordance with the agreement with them To manage our relationship with our Customers, including managing payments, contracts, and transactions Contacting our Customers about events, demos, webinars, and new features"
Specifies the operative purposes for processing personal data including platform provision, customer relationship management, payment handling, and marketing communications, establishing processing obligations tied to contractual performance.
AI-generated interpretation, not legal advice.
" Dust collects and processes your Personal Data when you use the Platform. This includes:"
This segment states that Dust collects and processes Personal Data when users use the Platform, establishing a general data collection obligation/practice disclosure.
AI-generated interpretation, not legal advice.
" We always process your Personal Data in accordance with the applicable laws."Permalink to this finding →
Imposes a general obligation on the processor to always process personal data in compliance with applicable laws, establishing a baseline legal compliance requirement.
AI-generated interpretation, not legal advice.
" Where we rely on your consent, you may at any time withdraw your consent by contacting us. See how to contact us in Section 13 below."
Grants data subjects the right to withdraw consent at any time and provides the procedure for doing so by contacting the company, establishing an enforceable right of withdrawal.
AI-generated interpretation, not legal advice.
Common questions about Dust's policies
- Does Dust train its AI models on your data?
- No training on your content by default — based on 2 verified findings from Dust's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Dust's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
12 verified clausesClauses in Dust's policies that work in your favour — commitments the platform made to you.
- Subprocessors & data sharingdata shared with other AI providers
“Some of our service providers may perform actions on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data. Dust seeks to conclude d…”
Obligates Dust to conclude data processing agreements with service providers, ensure appropriate security measures, and restricts Foundational Model Providers (OpenAI, Anthropic, Mistral, Google, Fireworks) from using cu…
📍 Privacy Policy › “Our service providers”Jump to exact text → - Privacy & data usedata shared with other AI providers
“Google: We access your Google User Data only to facilitate and enhance the functions of our application. Specifically, we synchronize your Google Docs, Google Slides, pdfs, and plain text files that are within the folders you select when connecting your Google…”
Specifies that international transfers of personal data outside the EEA/EU are protected either by adequacy decisions or Standard Contractual Clauses, obligating Dust to implement appropriate transfer safeguards and esta…
📍 Privacy Policy › “Third parties you connect to Dust”Jump to exact text → - Privacy & data usebreach notification promises
“We use industry-standard physical, procedural, and electronic security measures to protect your Personal Data held with our service providers and us, and keep them updated taking into account the state of the art- More precisely, we store the usage data insid…”
Obligates Dust to maintain industry-standard physical, procedural, and electronic security measures including encrypted databases and specific infrastructure providers (PostgreSQL, Google Cloud, QDrant Cloud), committing…
📍 § 8 (How do we secure your Personal Data?)Jump to exact text → - Moderation & enforcementterms can change anytime
“The "Effective Date" at the top of this webpage mentions when this Platform Privacy Policy was last revised. We may update and amend this Platform Privacy Policy from time to time. Any changes will become effective when we post a revised version of this Platfo…”
Establishes the procedure for updating and amending the Privacy Policy, including when changes become effective upon posting, the obligation to provide additional notice for material changes, and the binding effect of th…
- Terms changes: advance notice promised
📍 § 14 (Updates and Amendments to this Platform Privacy Policy)Jump to exact text → - Privacy & data usechildren's data
“Our Platform is not designed to attract children under the age of 16. We do not knowingly collect Personal Data from children and do not wish to do so. If we learn that a person under the age of 16 is using our Platform, we will prohibit and attempt to block s…”
Establishes obligations on the platform to not knowingly collect data from children under 16, to block and prohibit their use of the platform, and to promptly delete any Personal Data collected from such persons, while a…
📍 § 11 (Children's Privacy)Jump to exact text → - Audit rights, DPA & residency
“Your Personal Data may be accessed, transferred, stored and/or processed outside the European Economic Area (EEA), specifically in the United States. If your Personal Data is transferred outside the European Union (EU), we make sure that (i) the transfer is pe…”
Details the obligation to use Standard Contractual Clauses or adequacy decisions when transferring personal data outside the EU, confirming the legal mechanism for ensuring lawful cross-border data transfers.
📍 § 7 (How do we transfer your Personal Data globally?)Jump to exact text →
+ 6 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
0 verified clausesWhat Dust requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Dust's published policies yet.
What the policies actually cover
8 topics- Product telemetry & usage tracking8 clauses
- Advertising & tracking2 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure1 clause
- Data shared with other AI providers2 protective2 clauses
- Terms can change at any time1 protective1 clause
- Deletion rights & post-termination survival2 protective3 clauses
- Breach-notification promises1 protective1 clause
70 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “5\. How long do we keep your Personal Data?” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “Card data, Corporate bank account information of customers” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause limits liability or disclaims warranties.
“Limited Warranty : A.C.T. Dust Collectors warrants the equipment to be free from defects in material and workmanship for a period of Ten (10) years from the date of purchase. This Limited Warranty does not cover: (i) normal wear and tear including, but not limited to, corrosion, abrasion and elements; (ii) damage due to improper installation, maintenance, or operation; (iii) damage due to unauthorized repair, alte...”Open source citation
The clause requires defense, indemnity, or hold-harmless obligations.
“Indemnity . The Buyer shall indemnity and hold harmless the Seller from and against all loss or damage, including any fine, penalty, suit, action, claim, liability, cost or expense, arising from injuries or death to persons, and damage to or destruction of property in any manner caused by incident to, or connected to the products furnished by Seller.”Open source citation
The clause permits disclosure or sharing with third parties, affiliates, vendors, or subprocessors.
“Some of our service providers may perform actions on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data. Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the app...”Open source citation
The clause permits disclosure or sharing with third parties, affiliates, vendors, or subprocessors.
“Within Dust, only authorized personnel have access to your Personal Data. We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:”Open source citation
The clause permits disclosure or sharing with third parties, affiliates, vendors, or subprocessors.
“We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | indemnity liability | conditional | MEDIUM | 1 |
| All applicable tiers | privacy data use | conditional | MEDIUM | 10 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| All applicable tiers | training use | conditional | MEDIUM | 1 |
| Free | indemnity liability | conditional | MEDIUM | 1 |
| Standard | privacy data use | conditional | MEDIUM | 1 |
| Team / Business | privacy data use | conditional | MEDIUM | 5 |
| Team / Business | subprocessors data sharing | conditional | MEDIUM | 2 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: third party or vendor sharing on privacy data use
“Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at [privacy@dust.tt](mailto:privacy@dust.tt).”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at [privacy@dust.tt](mailto:privacy@dust.tt).”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-09-21· verified 2026-06-08verified once — no re-scan in 105 days
- Privacy Policy:Last captured 2026-08-31· verified 2026-08-31
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 183 more findings this quarter vs last (240 vs 57). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Dust's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified Dust's Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from Dust's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.