Image / Video / Audio Generation · freepik.comFreepik AI
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
This segment evaluates the GDPR obligation to disclose data retention periods, finding partial compliance but noting the AI-generated policy requires manual completion and may contain inaccurate retention assumptions that do not reflect actual business practices.
This segment identifies the GDPR obligation to provide an exhaustive and exact list of third-party categories or names with whom personal information is shared, and finds the AI-generated policy's use of 'e.g.' renders it non-compliant with this mandatory disclosure requirement.
This segment illustrates through the CalOPPA example that vague disclosures (e.g., sharing with 'service providers') are insufficient to satisfy specific statutory disclosure requirements, effectively restricting the use of generic language in privacy policies.
How to read this page: Overall risk rates what Freepik AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Partially verified — Terms of Service — Capture under review; Privacy Policy — Verified (read in full, 15 findings). Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Needs review
A core policy document is captured but requires review before AIRIN can mark the corpus fully verified.
- Terms of ServiceCompleteness unconfirmedstatic
- Privacy PolicyVerified - read in full - 15 citationsstaticLast captured 2026-08-03
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment disclaims that even an improved AI-generated privacy policy would only function correctly under unrealistic conditions—namely that GDPR is the sole applicable law, that laws never change, no new laws are enacted, and business practices remain static—highlighting the fundamental limitations and risks of relying on AI for privacy compliance.
" All you need to know is that it was impressive and just might work. Assuming GDPR is the only law that applies to your website, laws stop changing, no new privacy laws go into effect, and you never change your business practices."
This segment disclaims the misconception that GDPR compliance satisfies all privacy laws, clarifying that each law has unique requirements and that GDPR compliance does not substitute for compliance with other applicable laws.
" This privacy policy has the same issues as the previous one in that it doesn’t determine if other privacy laws apply to you and what your specific business practices are. There’s a common misconception that complying with GDPR (a stringen..."
This segment states a legal obligation derived from multiple privacy laws and the FTC that a privacy policy must accurately reflect actual business practices, not hypothetical or generic ones.
" Multiple privacy laws, as well as the Federal Trade Commission , state that your Privacy Policy must be accurate as to your actual business practices."
This segment evaluates GDPR disclosure requirements for contact information, personal data collection, and legal bases, finding partial compliance and disclaiming accuracy of legal bases listed since they may not reflect actual processing activities.
" Your name and contact information Yes and no. The Privacy Policy does include the company name but does not include the contact information though it does have fields that you can fill in with this information. What personal information ..."
This segment evaluates GDPR obligations regarding DPO contact details, cookie disclosures, and notification of policy updates, noting improved compliance compared to prior outputs.
" If the business has a Data Protection Officer, that Data Protection Officer’s name and contact details Yes (improvement from 2023) Use of cookies and other tracking technologies Yes, but not specific (improvement from 2023) How individ..."
Clause A strictly prohibits the use of user images or voices for AI model training under any circumstances, while Clause B explicitly permits such use, even with qualifications about aggregation and identification.
" For the improvement of our services , based on our legitimate interest in achieving more useful, effective, efficient and satisfactory tools for the User by studying the relationship between Inputs-Outputs-feedback. Under no circumstances will we use your images or voices, or those of third parties that you upload to our platform, to train or improve our artificial intelligence models or those of third-party providers. "
" Your image and/or voice may be used for the purposes of development, training, testing or improvement of software, algorithms and machine learning and artificial intelligence models in combination with other images, texts, graphics, films, audio and audiovisual works, always in aggregate form, without the processing seeking or enabling your unique identification."
Within one documentClause A states that images and audio can be inputs, while Clause B explicitly excludes personal data within images and audio from Magnific's data controller responsibilities for inputs, creating confusion about data handling.
" The generative AI tools that Magnific makes available to the User allow them to generate, based on their Inputs (prompts or instructions, images, videos, audio files or voices, or any content sent, uploaded or transmitted to Magnific’s systems) the Outputs (image or video) desired, either (i) simply describing them without starting from any base content or (ii) uploading initial content to our platform, consisting of image or audio files."
" Exceptionally, Magnific acts as data controller , in relation to the personal data that may be found in the Inputs (excluding images and audio) and in the Output or synthetic content generated by our tools, for three purposes:"
Within one documentClause A states that a Privacy Policy must be accurate to actual business practices, while Clause B explicitly notes that a specific part of a Privacy Policy (what personal information is collected) may not be accurate to actual business practices.
" Multiple privacy laws, as well as the Federal Trade Commission , state that your Privacy Policy must be accurate as to your actual business practices."
" Your name and contact information Yes and no. The Privacy Policy does include the company name but does not include the contact information though it does have fields that you can fill in with this information. What personal information is collected Yes although the list may not be accurate to your actual business and privacy practices. The legal basis for collecting and processing the personal information Yes (improvement from 2023). However, this list simply includes all available legal bases and may not take into account which legal bases you actually use for which processing purpose or which piece of personal information. In addition, it states that the legitimate interests legal basis is used, requiring the business to conduct a legitimate interests analysis. Purposes for which the personal information will be used Yes although the list may not be accurate to your actual business and privacy practices. "
Within one documentClause A states that a Privacy Policy must be accurate to actual business practices, while Clause B explicitly notes that a specific part of a Privacy Policy (what personal information is collected) may not be accurate to actual business practices.
" Multiple privacy laws, as well as the Federal Trade Commission , state that your Privacy Policy must be accurate as to your actual business practices."
" Your name and contact information Yes and no. The Privacy Policy does include the company name but does not include the contact information though it does have fields that you can fill in with this information. What personal information is collected Yes although the list may not be accurate to your actual business and privacy practices. The legal basis for collecting and processing the personal information Yes (improvement from 2023). However, this list simply includes all available legal bases and may not take into account which legal bases you actually use for which processing purpose or which piece of personal information. In addition, it states that the legitimate interests legal basis is used, requiring the business to conduct a legitimate interests analysis. Purposes for which the personal information will be used Yes although the list may not be accurate to your actual business and privacy practices. "
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" How long personal information is stored Yes. However, the Privacy Policy requires you to fill in the exact period of data retention for account and billing data. It also assumes that marketing data will be kept until the individual withdraws their consent, which may not be accurate. For example, some companies may delete marketing data if an individual has not opened marketing emails for a certain period of time (e.g. 2 years), even if consent has not been withdrawn. If personal information is used for automated decision making or profiling, then the logic behind such automated decision making or profiling No (if you do use the personal information for automated decision making or profiling). "
This segment evaluates the GDPR obligation to disclose data retention periods, finding partial compliance but noting the AI-generated policy requires manual completion and may contain inaccurate retention assumptions that do not reflect actual business practices.
AI-generated interpretation, not legal advice.
" The categories or names of the third parties with whom personal information will be shared Yes. However, the list does not include sufficient detail to satisfy GDPR requirements. Due to the “e.g.” listed in the policy, this appears to be a list of examples but that other third parties may receive personal information. GDPR requires you to provide an exhaustive and exact list of the categories (or names) of the third parties with whom you may share personal information. "
This segment identifies the GDPR obligation to provide an exhaustive and exact list of third-party categories or names with whom personal information is shared, and finds the AI-generated policy's use of 'e.g.' renders it non-compliant with this mandatory disclosure requirement.
AI-generated interpretation, not legal advice.
" For example, CalOPPA (a relatively simple privacy law) requires a Privacy Policy to disclose how a website will respond to Do Not Track signals and the categories of third parties it will share personal information with. While ChatGPT’s Privacy Policy states that we share personal information with “service providers,” this is way too vague to satisfy this requirement."
This segment illustrates through the CalOPPA example that vague disclosures (e.g., sharing with 'service providers') are insufficient to satisfy specific statutory disclosure requirements, effectively restricting the use of generic language in privacy policies.
AI-generated interpretation, not legal advice.
" So, the first thing a website owner needs to do is find out what privacy laws apply to them – something AI can’t help with yet."
This segment establishes an obligation on website owners to determine which privacy laws apply to them, and notes that AI tools currently cannot fulfill this obligation on their behalf.
AI-generated interpretation, not legal advice.
" All you need to know is that it was impressive and just might work. Assuming GDPR is the only law that applies to your website, laws stop changing, no new privacy laws go into effect, and you never change your business practices."
This segment disclaims that even an improved AI-generated privacy policy would only function correctly under unrealistic conditions—namely that GDPR is the sole applicable law, that laws never change, no new laws are enacted, and business practices remain static—highlighting the fundamental limitations and risks of relying on AI for privacy compliance.
AI-generated interpretation, not legal advice.
" Disclosures located within a Privacy Policy must be based on all the privacy laws that apply to your website . There’s no one-size-fits-all Privacy Policy that satisfies all laws. Each law has its own specific requirements for what disclosures a Privacy Policy must include."
This segment imposes an obligation that privacy policy disclosures must be based on all applicable privacy laws, and disclaims the existence of any universal one-size-fits-all policy, noting each law has distinct disclosure requirements.
AI-generated interpretation, not legal advice.
" ChatGPT just guesses that you may collect emails (for example) instead of listing out specific details on what information is collected by the website. It also states that the website uses encryption and firewalls. That’s great… unless your website doesn’t. That sounds like the origin story of one doozy of a class action lawsuit. Finally, the Privacy Policy generated by ChatGPT stated that we use analytics and advertising, which we do not (at the time of this blog)."
This segment warns that AI-generated privacy policies may contain inaccurate assumptions about data collection, security practices, and business activities, disclaiming the reliability of such outputs and noting potential legal liability from inaccurate disclosures.
AI-generated interpretation, not legal advice.
" GDPR has a specific set of disclosures that it requires Privacy Policies to make. Unfortunately, Donata found that AI missed several of these disclosures."
This segment identifies GDPR's specific mandatory disclosure requirements for privacy policies and notes that the AI-generated policy omitted several required disclosures, establishing GDPR's obligatory disclosure framework.
AI-generated interpretation, not legal advice.
" This privacy policy has the same issues as the previous one in that it doesn’t determine if other privacy laws apply to you and what your specific business practices are. There’s a common misconception that complying with GDPR (a stringent privacy law) will make your Privacy Policy applicable to every privacy law . This isn’t true as each law has its own unique requirements and, GDPR does not include many of the disclosure requirements that are required by other privacy laws."
This segment disclaims the misconception that GDPR compliance satisfies all privacy laws, clarifying that each law has unique requirements and that GDPR compliance does not substitute for compliance with other applicable laws.
AI-generated interpretation, not legal advice.
" Multiple privacy laws, as well as the Federal Trade Commission , state that your Privacy Policy must be accurate as to your actual business practices."
This segment states a legal obligation derived from multiple privacy laws and the FTC that a privacy policy must accurately reflect actual business practices, not hypothetical or generic ones.
AI-generated interpretation, not legal advice.
" Your name and contact information Yes and no. The Privacy Policy does include the company name but does not include the contact information though it does have fields that you can fill in with this information. What personal information is collected Yes although the list may not be accurate to your actual business and privacy practices. The legal basis for collecting and processing the personal information Yes (improvement from 2023). However, this list simply includes all available legal bases and may not take into account which legal bases you actually use for which processing purpose or which piece of personal information. In addition, it states that the legitimate interests legal basis is used, requiring the business to conduct a legitimate interests analysis. Purposes for which the personal information will be used Yes although the list may not be accurate to your actual business and privacy practices. "
This segment evaluates GDPR disclosure requirements for contact information, personal data collection, and legal bases, finding partial compliance and disclaiming accuracy of legal bases listed since they may not reflect actual processing activities.
AI-generated interpretation, not legal advice.
" If the business has a Data Protection Officer, that Data Protection Officer’s name and contact details Yes (improvement from 2023) Use of cookies and other tracking technologies Yes, but not specific (improvement from 2023) How individuals will be notified of updates to the Privacy Policy Yes "
This segment evaluates GDPR obligations regarding DPO contact details, cookie disclosures, and notification of policy updates, noting improved compliance compared to prior outputs.
AI-generated interpretation, not legal advice.
" If I’ve said it once, I’ve said it a thousand times: privacy laws are always changing , and website policies must also change to keep up with these changes. You’d think by now I’d have come up with a more poetic way of saying that."
This segment reaffirms the ongoing obligation that website policies must be updated as privacy laws change, establishing a continuous compliance duty.
AI-generated interpretation, not legal advice.
" This issue will repeat itself throughout this blog, so let’s just get it out of the way. AI (and most Privacy Policy Generators, for that matter) won’t automatically update your policies as laws change."
This segment disclaims that AI tools and most privacy policy generators will not automatically update policies when laws change, warning users of a material limitation affecting legal compliance obligations.
AI-generated interpretation, not legal advice.
" There’s also another itty-bitty-tinsy issue: It doesn’t comply with GDPR. "
This segment asserts that the AI-generated privacy policy failed to comply with GDPR despite being instructed to do so, disclaiming the reliability and legal sufficiency of the AI output.
AI-generated interpretation, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Freepik AI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
0 verified clausesClauses in Freepik AI's policies that work in your favour — commitments the platform made to you.
No protective clause has been verified in Freepik AI's published policies yet. That means we did not find one in the documents we read — not that the platform offers nothing.
📋 Rules you must follow
0 verified clausesWhat Freepik AI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in Freepik AI's published policies yet.
What the policies actually cover
2 topics- Advertising & tracking2 clauses
- Terms can change at any time1 clause
12 further verified clauses are cited on this page but not yet assigned a topic.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause restricts commercial use.
“In relation to your non-commercial enquiries, the data is deleted once they have been answered.”Open source citation
The clause appears to reserve or claim ownership rights for the platform.
“We reserve the right to terminate or suspend your access to our website at any time, without notice, for conduct that we believe violates these Terms of Use or is harmful to other users or our business interests.”Open source citation
The clause limits liability or disclaims warranties.
“The content on our website is provided "as is" without warranties of any kind, either express or implied. We do not guarantee the accuracy, completeness, or reliability of any content on the website.”Open source citation
The clause limits liability or disclaims warranties.
“In no event shall Freepik AI be liable for any damages arising out of or in connection with your use of our website. This limitation of liability applies to all damages of any kind, including direct, indirect, incidental, punitive, and consequential damages.”Open source citation
The clause permits sale of personal data or information.
“The CCPA defines "sale" as the disclosure or making available of personal information to a third party in exchange for monetary or other valuable consideration, and "sharing" includes the disclosure or making available of personal information to a third party for cross-context behavioural advertising purposes. Although we do not disclose personal information to third parties in exchange for monetary compensation, ...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | commercial use | conditional | MEDIUM | 3 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 2 |
| All applicable tiers | privacy data use | worsens | HIGH | 5 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| All applicable tiers | training use | worsens | HIGH | 2 |
| Team / Business | commercial use | conditional | MEDIUM | 2 |
| Team / Business | moderation enforcement | worsens | HIGH | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“The categories or names of the third parties with whom personal information will be shared Yes. However, the list does not include sufficient detail to satisfy GDPR requirements. Due to the “e.g.” listed in the policy, this appears to be a list of examples but that other third parties may receive personal information. GDPR requires you to provide an exhaustive and exact list of the categories (or names) of the third parties with whom you may share personal information.”Before citation
“We do not sell or share sensitive personal information, nor do we sell or share personal information about individuals we know to be under sixteen (16) years of age.”After citation
Latest stance: training permitted on training use
“Your image and/or voice may be used for the purposes of development, training, testing or improvement of software, algorithms and machine learning and artificial intelligence models in combination with other images, texts, graphics, films, audio and audiovisual works, always in aggregate form, without the processing seeking or enabling your unique identification.”Open timeline citation
Latest stance: sale or sell on commercial use
“The CCPA defines "sale" as the disclosure or making available of personal information to a third party in exchange for monetary or other valuable consideration, and "sharing" includes the disclosure or making available of personal information to a third party for cross-context behavioural advertising purposes. Although we do not disclose personal information to third parties in exchange for monetary compensation, we may "sell" or "share" the following categories of personal information: identifiers; commercial information; and Internet and network activity information. We may disclose these categories to third-party advertising networks, analytics providers and social networks for marketing and advertising purposes and to improve and measure our advertising campaigns.”Open timeline citation
Latest stance: third party or vendor sharing on commercial use
“The CCPA defines "sale" as the disclosure or making available of personal information to a third party in exchange for monetary or other valuable consideration, and "sharing" includes the disclosure or making available of personal information to a third party for cross-context behavioural advertising purposes. Although we do not disclose personal information to third parties in exchange for monetary compensation, we may "sell" or "share" the following categories of personal information: identifiers; commercial information; and Internet and network activity information. We may disclose these categories to third-party advertising networks, analytics providers and social networks for marketing and advertising purposes and to improve and measure our advertising campaigns.”Open timeline citation
Latest stance: sale or sell on privacy data use
“We do not sell or share sensitive personal information, nor do we sell or share personal information about individuals we know to be under sixteen (16) years of age.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-08-21· verified 2026-06-08verified once — no re-scan in 102 days
- Privacy Policy:Last captured 2026-08-03· verified 2026-08-03
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 113 more findings this quarter vs last (150 vs 37). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Freepik AI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified Freepik AI's Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from Freepik AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.