Image / Video / Audio Generation · heygen.comHeyGen
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“To train and enhance the models that power our products and services, including to make our avatar creation models more accurate. It is necessary for our legitimate interest and subject to appropriate safeguards. You may request to opt-out of this training and enhancement by contacting us at [email protected] .”
Watch: Commercial use
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Defines and limits the scope of the license granted to the user for the Mobile App as a non-transferable license confined to Apple devices owned or controlled by the user, as permitted by Apple App Store Usage Rules.
The confidentiality clause imposes affirmative obligations on users including a notification-and-challenge duty upon legal process. The catch-all 'when in doubt' standard expands the definition of Confidential Information beyond clearly designated items, potentially restricting user speech and creating compliance uncertainty.
The open-ended list of retention justifications (including 'protect ourselves') gives the platform significant discretion to retain data beyond what users might expect. The 30-day backup window means data is not immediately erased upon deletion request.
Scores derived from 48 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- HeyGen's training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
- Your outputs and prompts are explicitly yours — HeyGen's terms include affirmatively protective IP language.
- Data handling is conditional — 15 privacy or retention clauses warrant review before using HeyGen at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what HeyGen's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 118 verified, verbatim-cited findings below — read the citations.
Based on 158 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 57 citationsLast captured 2026-08-07
- Privacy PolicyVerified - read in full - 67 citationsstaticLast captured 2026-08-12
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This clause establishes the non-discrimination principle when users exercise their rights, sets out the identity verification procedure, permits authorized agent designation via written or power-of-attorney authorization, and describes the appeal procedure for denied requests.
" We will not discriminate against you for exercising any of these rights. Further information may be needed to verify your identity before exercising these rights, such as your email address or government issued ID. You may designate, in wr..."
This segment defines HeyGen's dual role as data processor and data controller in different contexts and establishes that processing will only occur on valid legal grounds, providing the definitional and legal basis framework for all subsequent processing descriptions.
" We use your personal information to provide you with the best possible products and services. Depending on the country in which you are located, we will only process your Personal Data based on a valid legal ground. In general, HeyGen acts..."
Collection of name, email, password, and optional profile fields is standard and expected. The delegation of payment data to Stripe is a common and generally lower-risk practice.
"We collect certain information about you from different sources, as described in this section. ### Information You Provide Us ### Some features of the Services may require you to provide us with information directly. You may elect not to ..."
This segment defines the scope of the Privacy Policy, clarifying that it applies to individual users but not to enterprise/business customer data (governed by separate contracts), establishing the boundaries of which processing activities are governed by this document.
" This Privacy Policy applies only to our collection and processing of information about users of the Services, including individuals who access and use the Services on behalf of a business customer. This Privacy Policy does not apply to th..."
Restricts users from exporting or re-exporting the Services or related materials to countries requiring U.S. or other governmental export licenses or approvals without first obtaining such approvals, and specifically prohibits export to U.S.-embargoed or terrorist-designated countries.
" You agree that you will not export or re-export, directly or indirectly, the Services and/or other information or materials provided by the Company hereunder, to any country for which the United States or any other relevant jurisdiction re..."
This segment prohibits users from downloading, modifying, copying, distributing, reproducing, or creating derivative works from HeyGen's proprietary technology, and from submitting illegal or inaccurate content, imposing specific use restrictions on the Services.
" Download, modify, copy, distribute, transmit, display, perform, reproduce, duplicate, publish, license, create derivative works from, or offer for sale any of our proprietary technology that makes up or is included in the Services, except ..."
This segment establishes the obligation to enroll in and pay recurring subscription charges, describes how mid-term service additions are billed, and sets out the automatic renewal mechanism for Recurring Subscriptions.
" (a) Subscriptions. To access and use certain Services, you may be required to enroll in a subscription payment plan and pay certain recurring charges, and by using those Services, you hereby agree to pay those recurring charges (all of the..."
This segment describes HeyGen's right to update pricing by posting on the Pricing Page with prior written notice, preserves current pricing for the duration of a paid subscription period, and establishes automatic renewal at the then-current price with authorization to charge the payment method on file.
" at any time by posting updated pricing on the Pricing Page and we will provide you with prior written notice of any such changes through through the Services, by email or other similar means; provided, however, that the prices for your Rec..."
Clause A states users 'can do it yourself' for deletion, while Clause B instructs DPF individuals to 'direct their query to [email protected]' for deletion, providing conflicting methods for the same action.
" When you submit information via our Site, you may be given options to restrict our use of your information. We aim to give you strong control on our use of your information. Depending on where you live, you may have certain rights in relation to your personal information. However, these rights are not absolute, and may only apply in certain circumstances. Access. You may have the right to request access to the information we hold about you, how we use it, and who we share it with. Delete. You may have the right to request that we delete information we hold about you. You can do it yourself by deleting data from your account or deleting the account. Correct. You may have the right to request that we correct inaccurate information we maintain about you. Opt out of targeted advertising. You may have a right to opt-out of the processing of your information for the purposes of targeted advertising. For more information, please see the “Cookies and Other Tracking Technologies” section above. Portability. You may have the right to receive a copy of personal information we hold about you and request that we transfer it to a third party. Restriction of processing to storage only. You may have the right to ask us to stop, suspend or restrict our processing of personal information. Objection. You may have the right to object to our processing of personal information, including to object to (i.e., opt out of) your information being used to train our models, by contacting us at [email protected] You can also object to marketing at any time by using the unsubscribe/opt-out function displayed in our communications to you. "
"Pursuant to the DPF Program, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the DPF, should direct their query to [email protected] ."
Within one documentClause A states users can delete information themselves, while Clause B instructs DPF individuals to email a specific address for deletion, presenting conflicting methods for exercising the same right.
" When you submit information via our Site, you may be given options to restrict our use of your information. We aim to give you strong control on our use of your information. Depending on where you live, you may have certain rights in relation to your personal information. However, these rights are not absolute, and may only apply in certain circumstances. Access. You may have the right to request access to the information we hold about you, how we use it, and who we share it with. Delete. You may have the right to request that we delete information we hold about you. You can do it yourself by deleting data from your account or deleting the account. Correct. You may have the right to request that we correct inaccurate information we maintain about you. Opt out of targeted advertising. You may have a right to opt-out of the processing of your information for the purposes of targeted advertising. For more information, please see the “Cookies and Other Tracking Technologies” section above. Portability. You may have the right to receive a copy of personal information we hold about you and request that we transfer it to a third party. Restriction of processing to storage only. You may have the right to ask us to stop, suspend or restrict our processing of personal information. Objection. You may have the right to object to our processing of personal information, including to object to (i.e., opt out of) your information being used to train our models, by contacting us at [email protected] You can also object to marketing at any time by using the unsubscribe/opt-out function displayed in our communications to you. "
"Pursuant to the DPF Program, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the DPF, should direct their query to [email protected] ."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"To train and enhance the models that power our products and services, including to make our avatar creation models more accurate. It is necessary for our legitimate interest and subject to appropriate safeguards. You may request to opt-out of this training and enhancement by contacting us at [email protected] ."Permalink to this finding →
HeyGen claims 'legitimate interest' as the legal basis for training its models on user-submitted content. An opt-out mechanism exists but is not the default, placing the burden on the user. Under GDPR this is contestable as legitimate interest for AI training may not override user interests without clearer necessity justification.
AI-generated interpretation, not legal advice.
" ii. Scope of License. The license granted to you is limited to a non-transferable license to use the Mobile App on any iPhone, iPod touch, iPad, or any other Apple device that you own or control as permitted by the Usage Rules set forth in the Apple App Store Terms of Service."
Defines and limits the scope of the license granted to the user for the Mobile App as a non-transferable license confined to Apple devices owned or controlled by the user, as permitted by Apple App Store Usage Rules.
AI-generated interpretation, not legal advice.
"We use Tracking Technologies because it is in our legitimate interests to facilitate, improve and tailor your experience with the Services, run analytics, de-bug and to provide and improve our products and services. For example, we use Datadog to better understand our user’s experience (e.g., how much time is spent on pages, what features they use, what links they choose to click, etc.) and this enables us to build and maintain the Services with user feedback. We may associate Usage Data with the device you use to access the Services, or email accounts you use to engage with us. We also use Tracking Technologies for advertising related purposes, including for remarketing and to deliver targeted ads to you, and analyze and measure the effectiveness of our advertisements."
Invoking legitimate interests for advertising/remarketing is contestable under GDPR. Association of usage data with email accounts increases de-anonymization risk. Specific third-party trackers named include Google Analytics, Datadog, DoubleClick, and Meta.
AI-generated interpretation, not legal advice.
" (d) Refunds and Exchanges. Payments are non-refundable, except where required by law."
This segment establishes that payments are non-refundable except where required by law, restricting users' ability to seek refunds for subscription or usage charges.
AI-generated interpretation, not legal advice.
"Information From Third Parties ### We may obtain information about you from outside sources, including: Integration partners. Information we receive when you connect HeyGen to an integration service. Login integrations. Information we receive when you choose to access the Services through a login integration or a Single Sign On service. Social media platforms. Information we receive from social media platforms, such as when you interact with us on YouTube, TikTok or Instagram. "
Data collection from third-party sources can result in a more extensive personal data profile than users realize. This is particularly relevant under GDPR Article 14, which requires notice when data is obtained from third parties rather than directly from the individual.
AI-generated interpretation, not legal advice.
" If you do not access or use our Services for a continuous period of six (6) months (the “Inactivity Period”), and you are under the Free Plan, HeyGen may, upon reasonable notice, delete your account. For the purposes of this provision, “inactivity” means no measurable usage of the Services of any kind during the Inactivity Period."
Defines 'Inactivity Period' as six continuous months of no measurable service usage, establishes the condition (Free Plan, inactivity) under which HeyGen may delete a user's account upon reasonable notice, and sets the procedure for such deletion.
AI-generated interpretation, not legal advice.
" Below, we list the purposes and appropriate legal grounds for processing: Providing and managing your Account and access to and use of our Services. It is necessary to perform our obligations under the Terms of Service agreement between you and us. Personalizing and tailoring your experience with our Services, including surfacing recommendations, enabling you to create Output and generating such output for you. It is necessary to perform our obligations under the services agreement between you and us. Providing customer support, responding to communications from you, sending you emails that you have subscribed to, or announcements relating to your account. It is necessary to perform our obligations under the services agreement between you and us. To train and enhance the models that power our products and services, including to make our avatar creation models more accurate. It is necessary for our legitimate interest and subject to appropriate safeguards. You may request to opt-out of this training and enhancement by contacting us at [email protected] . Providing customer support, responding to communications from you, sending you emails that you have subscribed to or announcements relating to your account. It is necessary to perform our obligations under the services agreement between you and us. Understanding the usage of our services, understanding trends and preferences, improving and repairing errors in the services, and in this context developing new products, services, features, and functionalities. "Permalink to this finding →
This segment enumerates specific purposes for which HeyGen processes personal data (account management, service personalization, output generation, customer support) and identifies the legal basis (contractual necessity) for each, creating binding obligations as to the scope and grounds for processing.
AI-generated interpretation, not legal advice.
" We may process your Personal Data to research, develop and improve our AI models. We have a legitimate interest in using your Personal Data for the purpose of research and development of AI models, to the extent that the balance between rights and interests is safeguarded. You may opt-out from such processing by contacting us at [email protected] . "
This segment permits processing of personal data for research, development, and improvement of AI models under a legitimate interest basis, subject to a rights-and-interests balancing safeguard, and grants data subjects the right to opt out by contacting the company, establishing a conditional permission for AI model training use of personal data.
AI-generated interpretation, not legal advice.
" As described above, the Site and Services may use certain Tracking Technologies to collect Usage Data, including first-party Tracking Technologies (those placed directly by us and are used only by us) and third-party Tracking Technologies (those placed by websites, services and/or parties other than us). These Tracking Technologies include those provided by Google Analytics, Datadog, DoubleClick and Meta. We use Tracking Technologies because it is in our legitimate interests to facilitate, improve and tailor your experience with the Services, run analytics, de-bug and to provide and improve our products and services. For example, we use Datadog to better understand our user’s experience (e.g., how much time is spent on pages, what features they use, what links they choose to click, etc.) and this enables us to build and maintain the Services with user feedback. We may associate Usage Data with the device you use to access the Services, or email accounts you use to engage with us. We also use Tracking Technologies for advertising related purposes, including for remarketing and to deliver targeted ads to you, and analyze and measure the effectiveness of our advertisements. We use cookies on our Site in accordance with current English and EU Cookie Laws, and if you are in the EU or UK, we request your consent before dropping Tracking Technologies that are not strictly necessary for the Services. Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of Tracking Technologies. "
This segment describes HeyGen's use of first-party and third-party tracking technologies (Google Analytics, Datadog, DoubleClick, Meta) to collect Usage Data, invoking legitimate interest as the legal basis and establishing a permission for such tracking and analytics activities.
AI-generated interpretation, not legal advice.
" Information drawn from other personal information provided to us, which could include your preferences, interests, and other information used to personalize your experience."
This clause identifies inferred information (preferences, interests, personalization data) derived from other personal information as a category of personal information collected under the CCPA disclosure framework.
AI-generated interpretation, not legal advice.
" We automatically collect certain information about your interaction with the Services (“Usage Data”), including through cookies, web beacons and other technologies (“Tracking Technologies”). This information includes: Device information, such as device type, operating system, unique device identifier, and IP address."
This segment identifies specific categories of automatically collected Usage Data (device type, OS, unique device identifier, IP address) and the tracking technologies used, establishing what data is collected automatically and informing users of the scope of data processing.
AI-generated interpretation, not legal advice.
"While you do not have to allow us to use Tracking Technologies, they do enable us to continually improve our Services, making it a better and more useful experience for you. If you so choose, you can choose to disable or delete cookies in your Internet browser at any time. Most internet browsers also enable you to choose whether you wish to disable all cookies or only third-party cookies. For further details, please consult the help menu in your internet browser or the documentation that came with your device. Disabling or deleting cookies may cause some of the Services to work incorrectly, and you may lose any information that enables you to access our Site more quickly and efficiently, including login and personalization settings. While your browser may allow you to transmit a “do not track” / “opt-out preference” signal or other mechanism for exercising choices regarding the collection of information by Tracking Technologies, like many websites, our website is not designed to respond to such signals. Google and Meta also provide options to customize how your information is collected and used. For example, you can utilize Google Analytics’s Opt-Out Browser Add On here , or alter Facebook Ads Display options in your Facebook account. If you apply certain ad blockers or tools to restrict cookies, it may interfere with your ability to opt out."
This segment grants users the right to disable or delete cookies in their browser at any time, discloses that disabling cookies may impair service functionality, and explains the practical consequences, establishing user rights with respect to tracking technology opt-out.
AI-generated interpretation, not legal advice.
" We use your personal information to provide you with the best possible products and services. Depending on the country in which you are located, we will only process your Personal Data based on a valid legal ground. In general, HeyGen acts as a data processor when processing personal data on behalf of our business customers in accordance with their instructions. However, HeyGen acts as a data controller when processing personal data for purposes such as marketing, service improvement, and regulatory compliance."Permalink to this finding →
This segment defines HeyGen's dual role as data processor and data controller in different contexts and establishes that processing will only occur on valid legal grounds, providing the definitional and legal basis framework for all subsequent processing descriptions.
AI-generated interpretation, not legal advice.
"We collect certain information about you from different sources, as described in this section. ### Information You Provide Us ### Some features of the Services may require you to provide us with information directly. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Depending upon your use of our Services, we may collect some or all of the following information about you: Account and contact information. When you create an account, we collect your name, email address and account password. We may also collect other information associated with your account, such as your phone number, business/company name and position, mailing address and social media handles. Depending on the plan that you subscribe to, we may collect payment information and transaction history. A"
Collection of name, email, password, and optional profile fields is standard and expected. The delegation of payment data to Stripe is a common and generally lower-risk practice.
AI-generated interpretation, not legal advice.
"We have a legitimate interest in using your Personal Data for the purpose of understanding usage. Enhancing the safety and security of our Services, such as conducting troubleshooting, data analysis, testing, evaluation and system reporting. We have a legitimate interest in using your Personal Data for the purpose of ensuring security and safety. Complying with applicable legal obligations, enforcing our contractual arrangements and policies, and protecting or defending the Services, our rights and the rights of our users or others. We may need it to comply with a legal obligation, for instance, to comply with court order. Enforcing our contractual arrangements and policies, and protecting or defending the Services, our rights, and the rights of our users or others. We have a legitimate interest in using your Personal Data to safeguard our contracts and legally recognized interests. Sending you marketing communications, including news and offers on our products or services (with your permission/consent or where otherwise permitted by applicable law). Unless permitted by law, we will not send you unsolicited marketing communications. We will also take all reasonable steps to ensure that we comply with our obligations under applicable email marketing laws. You can unsubscribe from our emails at any time by using the unsubscribe function in the email communication to you. We will remove your email address from our subscriber list upon receipt of such a request. "Permalink to this finding →
This segment identifies additional processing purposes (usage analytics, safety/security, legal compliance, contract enforcement) and their legal bases (legitimate interest, legal obligation), establishing HeyGen's obligations and rights to process personal data for these purposes.
AI-generated interpretation, not legal advice.
" Other information regarding your interaction with the Services, such as your operating system, browser type, date and time stamps, and clickstream data (including referring site, the types of content that you view or engage with, the features that you use, and other actions you take on the Services, as well as the site you exit to). Please see the "Cookies and Other Tracking Technologies" section below for more information on how we use tracking technologies and your choices."
This segment identifies additional Usage Data automatically collected (OS, browser type, timestamps, clickstream data) and references the Cookies section for tracking technology choices, establishing the scope of automated data collection and cross-referencing user rights regarding tracking.
AI-generated interpretation, not legal advice.
" (a) Subscriptions. To access and use certain Services, you may be required to enroll in a subscription payment plan and pay certain recurring charges, and by using those Services, you hereby agree to pay those recurring charges (all of the foregoing, hereinafter, a “Recurring Subscription”). If you add Services to your Recurring Subscription in the middle of your subscription term, you will be charged for such additional Services through the end of the then-current subscription term. In addition, your Recurring Subscription will automatically renew until you cancel it in accordance herewith or your Recurring Subscription is otherwise terminated. You authorize us to store your payment method information and to automatically charge your payment method(s) for the amount of your Recurring Subscription with no further action required by you. The length of your Recurring Subscription will be provided when you make your purchase. In the event that HeyGen is unable to charge your payment method(s) as authorized by you when you enrolled in a Recurring Subscription, HeyGen may in its sole discretion (i) suspend your access to the Services until payment is received or (ii) seek to update your payment method information through third-party sources (i.e., your bank or a payment processor) to continue charging your payment method as authorized by you. You may cancel your Recurring Subscription through your account at any time, but if you cancel your Recurring Subscription before the end of the current subscription period, we will not refund any charges already paid to us. Following any cancellation, however, you will continue to have access to the applicable Services through the end of your current subscription period. HeyGen may change the prices charged for Recurring Subscriptions"
This segment establishes the obligation to enroll in and pay recurring subscription charges, describes how mid-term service additions are billed, and sets out the automatic renewal mechanism for Recurring Subscriptions.
AI-generated interpretation, not legal advice.
" We may change this Privacy Policy from time to time, in which case we will update the “Effective” date at the top of this Privacy Policy and post the updated Privacy Policy on our Site. If we make material changes to the way in which we use personal information collected about you, we will use commercially reasonable efforts to notify you and take additional steps as required by applicable law. We recommend that you check this page regularly to keep up-to-date. If you do not agree to any updates to this Privacy Policy, please do not use or access any of the Services."
This clause establishes the procedure for updating the Privacy Policy, including updating the effective date, posting the revised policy, providing commercially reasonable notice for material changes, and the consequence (discontinuation of service use) if users do not agree to updates.
AI-generated interpretation, not legal advice.
Common questions about HeyGen's policies
- Does HeyGen train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 3 verified findings from HeyGen's published policy. Informational only, not legal advice.
- Who owns the content you create with HeyGen?
- You own your outputs — based on 3 verified findings from HeyGen's published policy. Informational only, not legal advice.
- Can you use HeyGen's output commercially?
- Commercial use allowed — with conditions — based on 1 verified finding from HeyGen's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from HeyGen's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
24 verified clausesClauses in HeyGen's policies that work in your favour — commitments the platform made to you.
- Output ownershipattribution requirements
“As part of your use of the Services, you may be able to input, post, upload and submit information (“User Input”) to the Services, and you may direct the Services to generate and output new content based on your User Input (“User Output”). HeyGen reserves the…”
This segment defines User Input and User Output, confirms that users own all rights in their User Input and User Output for paid plan tiers, permits commercial use of User Output, and reserves HeyGen's right to remove co…
📍 § 3Jump to exact text → - Privacy & data use
“When you submit information via our Site, you may be given options to restrict our use of your information. We aim to give you strong control on our use of your information. Depending on where you live, you may have certain rights in relation to your personal…”
This clause enumerates user rights including access to personal information, deletion of personal information, and the ability to restrict the company's use of that information, conditioned on jurisdiction and not absolu…
📍 § 10 (Summary of Your Rights)Jump to exact text → - Privacy & data usesale/sharing of personal data
“For information regarding the specific purposes for which we collect and disclose your personal information and the categories of sources from which we collect your personal information, please see section 3 “What Information Do We Collect?” and section 4 “How…”
This clause cross-references prior sections for collection purposes and sources, references the data retention section, and states the company's restriction on selling or sharing sensitive personal information beyond CCP…
📍 Privacy Policy › “Account access credentials, such as username and password*”Jump to exact text → - Privacy & data use
“Data security is of great importance to us, and to protect your personal information, we have put in place suitable physical, electronic, and managerial procedures designed to safeguard and secure personal information collected through our Site. You can review…”
This clause states that the company has implemented physical, electronic, and managerial security measures, but disclaims any guarantee of complete security for data transmitted via the Internet, limiting the company's l…
📍 § 9 (How Do We Secure Your Information?)Jump to exact text → - Audit rights, DPA & residency
“For purposes of this Privacy Policy, HeyGen's role as controller or processor depends on the specific processing activity. HeyGen acts as a data processor when processing personal data on behalf of, and under the instructions of, our customers in connection wi…”
This segment defines HeyGen's dual roles as data processor (processing personal data on behalf of customers per their instructions) and data controller (processing for its own purposes including AI model training, accoun…
📍 Privacy Policy › “Los Angeles, CA 90094”Jump to exact text → - Audit rights, DPA & residency
“By using our Services, you understand that your personal information may be processed and stored on servers, and transferred to third parties, outside your country of residence, including the United States. The personal information that you provide to us and…”
This clause informs users that personal information may be transferred to, stored in, and processed in countries outside their country of residence (including the United States), and that staff outside the EEA, UK, or Sw…
📍 § 15 (Data Transfers,Third-party Websites and Materials)Jump to exact text →
+ 18 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
7 verified clausesWhat HeyGen requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcement
“Download, modify, copy, distribute, transmit, display, perform, reproduce, duplicate, publish, license, create derivative works from, or offer for sale any of our proprietary technology that makes up or is included in the Services, except (i) you may create an…”
This segment prohibits users from downloading, modifying, copying, distributing, reproducing, or creating derivative works from HeyGen's proprietary technology, and from submitting illegal or inaccurate content, imposing…
📍 § 2 (License to Use the Services)Jump to exact text → - Moderation & enforcementconduct restrictions
“disassemble or decode the Services (including any underlying idea or algorithm), or attempt to do any of the same; Use, reproduce or remove any copyright, trademark, service mark, trade name, slogan, logo, image, graphics, design, commercial symbol, or other…”
This segment restricts users from disassembling or decoding the Services, using or removing proprietary marks, using unauthorized automation software or hacks, and impersonating others, imposing multiple categories of us…
📍 § 2 (License to Use the Services)Jump to exact text → - Moderation & enforcement
“You agree that you will not export or re-export, directly or indirectly, the Services and/or other information or materials provided by the Company hereunder, to any country for which the United States or any other relevant jurisdiction requires any export lic…”
Restricts users from exporting or re-exporting the Services or related materials to countries requiring U.S. or other governmental export licenses or approvals without first obtaining such approvals, and specifically pro…
📍 § 19 (Export Controls)Jump to exact text → - Moderation & enforcementconduct restrictions
“materials that are malicious or technologically harmful into our systems; Use any portion of the Services to build any products or services that are competitive to any portion of the Services or to create similar ideas, features, or functions of any portion o…”
This segment prohibits users from injecting malicious materials into HeyGen's systems, building competitive products using the Services, using the Services for benchmarking or competitive analysis, violating applicable l…
📍 § 2 (License to Use the Services)Jump to exact text → - Confidentiality
“You may receive access to Confidential Information of HeyGen and other third parties through your use of the Services. You may use Confidential Information only as needed to access or use the Services pursuant to the Terms. You will protect such Confidential I…”
This segment imposes obligations on users to use Confidential Information only as needed to access the Services, to protect it with reasonable care, and to provide prior written notice to HeyGen if compelled by law or co…
📍 § 6 (Confidentiality)Jump to exact text →
+ 2 more verified clauses of this kind on this platform, cited in full in the report.
What the policies actually cover
14 topics- Product telemetry & usage tracking7 clauses
- Advertising & tracking1 protective5 clauses
- Sale or sharing of personal data2 protective3 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure2 clauses
- Trains by default, opt-out available3 clauses
- Arbitration & class-action waiver2 protective4 clauses
- Damages & liability cap9 clauses
- Indemnity direction1 protective3 clauses
- Terms can change at any time2 protective2 clauses
- Deletion rights & post-termination survival1 protective4 clauses
- Auto-renewal & cancel window3 clauses
- Attribution requirements2 protective1 obligation3 clauses
- Conduct restrictions3 obligations3 clauses
72 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, § 8 (How Long Do We Store Your Information?) addresses how long content is retained, and the Privacy Policy, § 4 addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause restricts commercial use.
“ranted a limited, non-exclusive, non-transferable, revocable license to your User Output solely for personal, non-commercial, and internal evaluation purposes. User Output generated under a Free Plan may not be sold, sublicensed, redistributed, monetized, or used in connection with commercial activities, advertising, client work, revenue-generating product or any other services.”Open source citation
The clause provides a deletion or time-bounded retention path.
“We only keep your personal information for as long as we need to provide our products and services as described in this Privacy Policy and/or for as long as we have your permission to keep it. In determining the length of time we retain information, we consider various criteria, including whether we need the information to continue to administer your account, provide the Services, maintain output and content that ...”Open source citation
The clause provides a deletion or time-bounded retention path.
“We only keep your personal information for as long as we need to provide our products and services as described in this Privacy Policy and/or for as long as we have your permission to keep it. In determining the length of time we retain information, we consider various criteria, including whether we need the information to continue to administer your account, provide the Services, maintain output and content that ...”Open source citation
The clause provides a deletion or time-bounded retention path.
“We only keep your personal information for as long as we need to provide our products and services as described in this Privacy Policy and/or for as long as we have your permission to keep it. In determining the length of time we retain information, we consider various criteria, including whether we need the information to continue to administer your account, provide the Services, maintain output and content that ...”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“You and HeyGen also agree that, to the fullest extent permitted by applicable law, any proceeding to resolve any dispute, claim, or controversy will be brought and conducted only in the respective party’s individual capacity and not as part of any class (or purported class), consolidated, multiple-plaintiff, or representative action or proceeding (“class action”). You agree to waive the right to participate as a p...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | commercial use | worsens | HIGH | 1 |
| All applicable tiers | data retention | improves | LOW | 3 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 20 |
| All applicable tiers | output ownership | worsens | HIGH | 5 |
| All applicable tiers | prompt ownership | improves | LOW | 2 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 2 |
| Free | commercial use | conditional | MEDIUM | 3 |
| Free | governing law disputes | conditional | MEDIUM | 1 |
| Free | prompt ownership | worsens | HIGH | 7 |
| Free | tier differences | worsens | HIGH | 3 |
| Free | training use | worsens | HIGH | 3 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: sale or sell on privacy data use
“For information regarding the specific purposes for which we collect and disclose your personal information and the categories of sources from which we collect your personal information, please see section 3 “What Information Do We Collect?” and section 4 “How Do We Use Your Information” above. Information about our retention of personal information is described in section 8, “How Long Do We Store Your Information”. We only use and disclose sensitive personal information for the purposes specified in the CCPA or otherwise with your consent. We do not “sell” or “share” (as those terms are defined in the CCPA) personal information, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we sell or share personal information about California residents under 16 years of age. California residents under the age of 18 who have registered to use the Services and posted UGC to the Services can request that their UGC be removed by contacting us at [email protected] . Such a request must state that they personally posted such UGC or information and detail where the UGC is posted. We will make reasonable good faith efforts to remove the content from prospective public view or anonymize it so the minor cannot be individually identified. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished the post and archived copies of it may be stored by search engines and others that we do not control. HeyGen is subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open timeline citation
Latest stance: third party or vendor sharing on subprocessors data sharing
“We only disclose your personal information as described in this Privacy Policy. Unless otherwise described, we will never sell your personal information to anyone for monetary consideration. You are in control of your personal information at all times. In certain circumstances, we may disclose your personal information to third parties for the purposes described in this Privacy Policy, including: Vendors and Service Providers. We may contract with third parties who help us provide the Services, including for payment processing, cloud storage, chatbot operation, voice transcriptions, image generation, system administration, security, customer relationship management, delivery of goods, search engine facilities, data analytics, advertising, and marketing. In some cases, these third parties may require access to some or all of your information. We will take all reasonable steps to ensure that your information will be handled safely and securely, such as through data protection agreements. In some cases we may be legally liable for such onward transfers to third-parties. You can access list of our subprocessors here . With direction or consent. We may also disclose information to third parties, including other users of the Services, when you request, direct or consent to us doing so, such as when you make output or other content available to others, through your use of login integrations and social media widgets or with your consent.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“Withdrawal of consent. Where we rely on consent to process your personal information, you may have the right to withdraw this consent at any time. If you confirm that you wish to withdraw your consent, we will delete your information from our systems. However, you acknowledge this may limit our ability to provide you with the best possible products and services. In general, you also have the right to opt-out of our sharing your personal data with third parties or using your data for purposes other than those for which it was originally collected. To exercise these rights above, please contact us at [email protected] .”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“This Privacy Policy applies only to our collection and processing of information about users of the Services, including individuals who access and use the Services on behalf of a business customer. This Privacy Policy does not apply to the collection and processing of information on behalf of customers of our enterprise or business offerings, which are governed by our customer contracts. If you have questions about the use of information by a business customer, please reach out to the relevant customer directly. This Privacy Policy also does not extend to any websites or platforms operated by third parties that are linked to our Site (whether we provide those links or other users share them), nor does it apply to content, data, applications, or materials from third parties, including other users. We are not responsible for the privacy or security of, or information found on these sites or platforms, or the accuracy, completeness, or reliability of third-party materials, and have no control over how your information is collected, stored, or used by other websites. We advise you to check the privacy policies of any third-party website or platform before providing any information to them. Our inclusion of any links to third-party websites or platforms does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.”Open timeline citation
Latest stance: sale or sell on subprocessors data sharing
“We only disclose your personal information as described in this Privacy Policy. Unless otherwise described, we will never sell your personal information to anyone for monetary consideration. You are in control of your personal information at all times. In certain circumstances, we may disclose your personal information to third parties for the purposes described in this Privacy Policy, including: Vendors and Service Providers. We may contract with third parties who help us provide the Services, including for payment processing, cloud storage, chatbot operation, voice transcriptions, image generation, system administration, security, customer relationship management, delivery of goods, search engine facilities, data analytics, advertising, and marketing. In some cases, these third parties may require access to some or all of your information. We will take all reasonable steps to ensure that your information will be handled safely and securely, such as through data protection agreements. In some cases we may be legally liable for such onward transfers to third-parties. You can access list of our subprocessors here . With direction or consent. We may also disclose information to third parties, including other users of the Services, when you request, direct or consent to us doing so, such as when you make output or other content available to others, through your use of login integrations and social media widgets or with your consent.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“See our Biometric Information Privacy Notice for further information about how we process information to create avatars. Information posted to the Services. Certain features on the Services may enable you to share templates or make your videos and other content available to other users. We collect information that you choose to share or make available (“UGC”), and we, or others, may store, display, reproduce, publish or otherwise use UGC (including with your name and email address) and may or may not attribute it to you. Others, including other users, may also have access to UGC and may have the ability to share it with third parties. Communications information. We collect your name, email address, and other information you provide in communications with us, including through the “Contact Sales” page or when interacting with our online chatbot.”Open timeline citation
Latest stance: deletion or time bound on data retention
“We only keep your personal information for as long as we need to provide our products and services as described in this Privacy Policy and/or for as long as we have your permission to keep it. In determining the length of time we retain information, we consider various criteria, including whether we need the information to continue to administer your account, provide the Services, maintain output and content that you have generated, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property and products. We conduct reviews when appropriate to ascertain whether we still need to keep your information. After you delete the information or the account, it is kept in the backups for the purpose of disaster recovery for 60 days and then automatically and permanently erased. If you submit a request to delete your information, we strive to take steps to delete that information within 72 hours of your request, unless we are required or permitted to retain such information under applicable law. For additional information, see “Summary of Your Rights” below.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“When you submit information via our Site, you may be given options to restrict our use of your information. We aim to give you strong control on our use of your information. Depending on where you live, you may have certain rights in relation to your personal information. However, these rights are not absolute, and may only apply in certain circumstances. Access. You may have the right to request access to the information we hold about you, how we use it, and who we share it with. Delete. You may have the right to request that we delete information we hold about you. You can do it yourself by deleting data from your account or deleting the account. Correct. You may have the right to request that we correct inaccurate information we maintain about you. Opt out of targeted advertising. You may have a right to opt-out of the processing of your information for the purposes of targeted advertising. For more information, please see the “Cookies and Other Tracking Technologies” section above. Portability. You may have the right to receive a copy of personal information we hold about you and request that we transfer it to a third party. Restriction of processing to storage only. You may have the right to ask us to stop, suspend or restrict our processing of personal information. Objection. You may have the right to object to our processing of personal information, including to object to (i.e., opt out of) your information being used to train our models, by contacting us at [email protected] You can also object to marketing at any time by using the unsubscribe/opt-out function displayed in our communications to you.”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-08-07· verified 2026-08-07
- Privacy Policy:Last captured 2026-08-12· verified 2026-08-12
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 64 fewer findings this quarter vs last (122 vs 186). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of HeyGen's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from HeyGen's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.