Dust procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Your Personal Data may be accessed, transferred, stored and/or processed outside the European Economic Area (EEA), specifically in the United States. If your Personal Data is transferred outside the European Union (EU), we make sure that (i) the transfer is performed to a country recognized by an adequacy decision from the European commission; or (ii) the transfer is covered by appropriate safeguards, such as the Standard Contractual Clauses published by the EU commission.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “**Delivering the Platform, providing customer service and managing payments, contracts and transactions and otherwise meeting our contractual requirements:**” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Fulfilling your request related to the Platform and communicating with you in contract-related matters: For the agreement duration with Customers and then archived for 5 years” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Your Personal Data will be stored in accordance with applicable data protection laws and data protection authorities guidelines to the extent necessary for the processing purposes set out in this Platform Privacy Policy and in accordance with our Data Retention Policy. Delivering the Platform, providing customer service and managing payments, contracts and transactions and otherwise meeting our contractual requirements: For the agreement duration with Customers and then archived for 5 years” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “For the agreement duration with Customers and then archived for 5 years” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Organizing, managing, and facilitating access to our events: For the duration of the event and 5 years in archives after the end of the event” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “**Organizing, managing, and facilitating access to our events:**” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Your Personal Data will be stored in accordance with applicable data protection laws and data protection authorities guidelines to the extent necessary for the processing purposes set out in this Platform Privacy Policy and in accordance with our Data Retention Policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Dust use and transfer of information received from Google API's to any other app will adhere to [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including Limited Use requirements.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Some of our service providers may perform actions on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at privacy@dust.tt .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “We may also disclose or transfer your Personal Data to fulfil our legal obligations or when a legal authority requires a disclosure. We may also disclose your Personal Data if we are a party of a business sale, such as a merger or an acquisition.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share, disclose and transfer your Personal Data with our current and future subsidiaries and affiliated companies for all purposes mentioned in Section 4 above.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Within Dust, only authorized personnel have access to your Personal Data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Some of our service providers may perform actions on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data. Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions. Foundational Model Providers (OpenAI, Anthropic, Mistral, Google, Fireworks) are prohibited from using any customer and personal data for model training. They apply a "Zero Data Retention" policy, meaning that Customer Content will not be logged for human review and will not be saved to disk or retained by those providers. Certificates can be found in the Sub-Processors list .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Within Dust, only authorized personnel have access to your Personal Data. We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “This Privacy Policy only applies where we are processing your Personal Data for our own purposes and are acting as Data Controller under the General Data Protection Regulation (UE) 2016/679 ("GDPR").” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.