Higgsfield procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ 15.1. General . We are a U.S.-based company and many of our service providers, advisers, partners or other recipients of data are also based in the U.S. This means that, if you use the Service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside Europe. We also have locations in the UK and Kazakhstan, and vendors and partners located throughout the world, including in the U.S., EU, UK, and China. 15.2. Sharing Outside the US . Where we share your personal information with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented: Transfers to territories with an adequacy decision . We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission or UK Government (as and where applicable) (from time to time) or under specific adequacy frameworks approved by the European Commission or UK Government (as and where applicable) (from time to time), such as the EU-U.S. Data Privacy Framework or the UK Extension thereto. Transfers to territories without an adequacy decision . We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “However, in these cases: we seek to use specific appropriate safeguards, which are designed to give personal information effectively the same protection it has in Europe – for example, standard-form contracts approved by relevant authorities for this purpose (e.g., Standard Contractual Clauses/ ‘SSCs’ as approved by the European Commission); or in limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your personal information to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ – for example, reliance on your explicit consent to that transfer.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “We may request specific information from you to help us confirm your identity and process your request. Whether or not we are required to fulfill any request you make will depend on a number of factors (e.g., why and how we are processing your personal information). If we reject any request you may make (whether in whole or in part), we will let you know our grounds for doing so at the time, subject to any legal restrictions. Typically, you will not have to pay a fee to exercise your rights; however, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We try to respond to all legitimate requests promptly and try to provide you with a disposition within a month of receipt. It may take us longer than a month if your request is particularly complex or if you have made a number of requests; in this case, we will notify you and keep you updated via the email address you provide. 14.3. Your Right to Lodge a Complaint with your Supervisory Authority . Although we urge you to contact us first to find a solution for any concern you may have, in addition to your rights outlined above, if you are not satisfied with our response to a request you make, or how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence. For users in the European Economic Area – the contact information for the data protection regulator in your place of residence can be found here: https://edpb.europa.eu/about-edpb/board/members_en For users in the UK – the contact information for the UK data protection regulator can be found here: https://ico.org.uk/make-a-complaint/ ” | Captured 2026-07-03Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ You may contact us at support@higgsfield.ai if you want further information on the specific mechanism used by us when transferring your personal information out of Europe.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ 14.1. General . European data protection laws may give you certain rights regarding your personal information in certain circumstances. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold: Access. Provide you with information about our processing of your personal information and give you access to your personal information. Correct. Update or correct inaccuracies in your personal information. Delete. Delete your personal information where there is no good reason for us continuing to process it – you also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). Transfer/Portability. Transfer to you or a third party of your choice a machine-readable copy of your personal information which you have provided to us. Restrict. Restrict the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it. Object. Object to our processing of your personal information where we are relying on Legitimate Interests – you also have the right to object where we are processing your personal information for direct marketing purposes. Withdraw Consent. When we use your personal information based on your consent, you have the right to withdraw that consent at any time. 14.2. Exercising These Rights . You may submit these requests by contacting us at support@higgsfield.ai . ” | Captured 2026-07-03Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 3.1. General . We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. 3.2. When Information No Longer Needed . When we no longer require the personal information we have collected about you, we may either delete it, anonymize or aggregate it, or isolate it from further processing.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 90 days. This applies both for cases when an account owner directly cancels and for auto-canceled accounts. These retention periods may be extended if required for legal purposes such as litigation holds, law enforcement requests, or specific tax/financial audits. You can choose to delete certain content through your account. If you wish to request to close your account, please contact us at support@higgsfield.ai .” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 12.1. General . We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for the ‘Compliance and protection’ purposes outlined above. 12.2. Factors . To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. 12.3. When we no longer need data . When we no longer require the personal information that we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 5.5. Blocking images/clear gifs . Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings. 5.6. Do Not Track . Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit https://www.allaboutdnt.com . 5.7. Declining to provide information . We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services. 5.8. Linked third-party platforms . If you choose to connect to the Service through your social media account or other third-party platform, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from a third-party platform, that choice will not apply to information that we have already received from that third party. 5.9. Delete your content or close your account . We give you the option to remove content from your account after it has been uploaded. Anything you remove from your account may remain on our active servers for 30 days while they are active, and copies of the content may be held in backups of our application databases after that. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Compliance with Law. Legitimate Interests. Where Compliance with Law is not applicable, we have a legitimate interest in participating in, supporting, and following legal process and requests, including through co-operation with authorities. We also have a legitimate interest in ensuring the protection, maintenance, and enforcement of our and their rights, property, and/or safety.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “For example, you may log in with your Google account. This data may include your Google username, profile picture and other information associated with your Google account on that third-party service that is made available to us based on your account settings on that service. Our use and disclosure of information received from Google’s APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements. 1.3. Automatic data collection . We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as: Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area. Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them. ” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 15.1. General . We are a U.S.-based company and many of our service providers, advisers, partners or other recipients of data are also based in the U.S. This means that, if you use the Service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside Europe. We also have locations in the UK and Kazakhstan, and vendors and partners located throughout the world, including in the U.S., EU, UK, and China. 15.2. Sharing Outside the US . Where we share your personal information with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented: Transfers to territories with an adequacy decision . We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission or UK Government (as and where applicable) (from time to time) or under specific adequacy frameworks approved by the European Commission or UK Government (as and where applicable) (from time to time), such as the EU-U.S. Data Privacy Framework or the UK Extension thereto. Transfers to territories without an adequacy decision . We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection. ” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.” | Captured 2026-07-03Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Note that we likewise share your personal information with vendors and other third parties (which may not be located in Europe) in accordance with, and for the purposes described in, the chart below.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Linked third-party services . If you log into the Service with, or otherwise link or sync your Service account to or with, an authentication, social media or other third-party service, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy and the settings associated with your account with the third-party service. Professional advisors . Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us. Authorities and others . Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above. Business transferees . We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in Higgsfield, financing of Higgsfield, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares). For example, we may need to share certain personal information with prospective counterparties and their advisers. We may also disclose your personal information to an acquirer, successor, or assignee of Higgsfield as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “However, in these cases: we seek to use specific appropriate safeguards, which are designed to give personal information effectively the same protection it has in Europe – for example, standard-form contracts approved by relevant authorities for this purpose (e.g., Standard Contractual Clauses/ ‘SSCs’ as approved by the European Commission); or in limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your personal information to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ – for example, reliance on your explicit consent to that transfer.” | Captured 2026-07-03Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.