Leonardo.AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “Our local representative in the EEA is the European Data Protection Office (EDPO) with a registered address at Ground Floor, 71 Lower Baggot Street, Dublin, D02 P593, Ireland.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “However, we always take steps to ensure that your data will remain protected in accordance with this Policy and applicable data protection laws. These measures include transferring your data to a country that the European Commission or UK authorities (as applicable) have determined provides an adequate level of protection for personal information, or by implementing appropriate transfer mechanisms and safeguards with our group companies, service providers and partners to protect your data.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “By using the Service, you understand and agree that Leonardo Interactive Pty Ltd (an entity in Australia) will receive and process your personal data. We may transfer your personal data to other countries where our affiliates and service providers are located. Please note that some of these countries may have data protection laws that are different from your country (and, in some cases, may not be as protective). For individuals in the EEA, Switzerland or UK, where we transfer your information to a third-party service provider that is not located in Europe, and is not in a country that benefits from an adequacy decision by the European Commission, UK or Swiss authorities, we will require those third party providers to enter into an agreement that provides appropriate safeguards for your information, including by using the EU Model Clauses and the UK International Data Transfer Addendum.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Your information will be stored in the United States and processed in Australia and any other country in which Leonardo.Ai, its group companies, service providers and partners maintain facilities or employ staff or contractors.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “**Cross-border transfers of information**” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “**Applicable Privacy Laws** means all worldwide data protection and privacy laws and regulations applicable to the processing of Personal Data including but not limited to: (i) the Australian Privacy Act 1988 (Cth) (ii) the General Data Protection Regulation 2016/679 (the “GDPR“); (iii) the GDPR as it forms part of the laws of the United Kingdom pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR“); and (iv) the Swiss Federal Data Protection Act of 19 June 1992 (the “Swiss DPA“); in each case as amended, superseded or replaced from time to time.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “This section of the Policy applies to individuals that are located in the European Economic Area (EEA), Switzerland or United Kingdom (UK). Leonardo.Ai processes your personal data in accordance with European laws and regulations, such as the General Data Protection Regulation (GDPR) and UK Data Protection Act (UK DPA).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “This means that your data may be transferred to and processed in countries other than the country in which you are located. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Our local representative in the United Kingdom is the European Data Protection Office UK (EDPO UK) with a registered address at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “**10.4** If you are part of a subscription for multiple Authorised Users, or if you are accessing our Services using your Canva credentials associated with a Canva multi-seat team, then we collect, use, transfer, disclose and store certain Personal Data on your behalf as a data processor in connection with your use of our Services. In those cases, our Data Processing Addendum applies. Our Data Processing Addendum sets out the specific Personal Data we collect and processing operations we perform on your behalf as a processor and is incorporated into these Terms. In the event of any conflict between these Terms and the Data Processing Addendum, the Data Processing Addendum shall prevail. Any categories of Personal Data or processing operations that are not set out in our Data Processing Addendum will be processed and protected by us as a data controller subject to and in accordance with our Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | Enterprise | low | “In certain circumstances, we process personal data as a processor on behalf of our commercial customers. Leonardo.Ai’s Terms of Service set out the circumstances where we process personal data as a processor. In these cases, it is our customer that is responsible for the processing of your personal data and our processing will be governed by the terms of the data processing addendum we have entered with the customer. If you have questions or concerns about how your personal data is handled by one of our commercial customers, you should contact the relevant customer that is using the Service and refer to their separate privacy policies.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will retain your personal information for as long as your account is active or as needed to provide you with the Service or for as long as we have a valid purpose to do so. In particular, we may retain your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “**(c)** Delete the Administered Account.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We will retain your personal information for as long as your account is active or as needed to provide you with the Service or for as long as we have a valid purpose to do so. In particular, we may retain your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When we have no ongoing legitimate business need to process your information, we will either delete or anonymise it, or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “**3.7** If you have not used your Account for an extended period of time (12 months or more of inactivity), we may close and permanently delete your Account. You acknowledge and agree that this means you will lose any Content you generated. We will notify you via the email address you provided when creating your Account prior to deleting your Account.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “When we have no ongoing legitimate business need to process your information, we will either delete or anonymise it, or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In the event of a proposed purchase, merger or acquisition of any part of our business, we may disclose your personal information to an actual or potential buyer (and its agents and advisers) provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If you have consented to the disclosure of your personal information to any other third party, we may also share the data with them.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “The Policy does not apply to, and we cannot control the activities of, third-party advertisers. Please consult the respective privacy policies of such advertisers or contact such advertisers for more information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “We do not sell or rent the information we collect about you with these third-party advertising servers or advertising networks for such parties’ own marketing purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may also aggregate or otherwise strip data of all personally identifying characteristics and may share that aggregated such anonymized data with third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- **For matters that require use of your information by law:** We will use or disclose your information where we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce our [Terms of Service](https://leonardo.ai/terms-of-service) or to protect the security or integrity of our Service; and/or (c) to exercise or protect the rights, property, or personal safety of Leonardo.Ai, our users or others.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Legal obligations:** It is necessary for compliance with our legal obligations – for example, to disclose your information in response to law enforcement requests and to retain your information for our record keeping purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “- from our third party partners” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “**(a)** Share your email address, name and account information with your Admin Entity;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “- **Legal obligations:** It is necessary for compliance with our legal obligations – for example, to disclose your information in response to law enforcement requests and to retain your information for our record keeping purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We reserve the right to disclose your personal information as required by law (e.g., to comply with a subpoena, warrant, or court order) and when we believe that disclosure is necessary to protect our rights, avoid litigation, protect your safety or the safety of others, investigate fraud, and/or respond to a government request. We may also disclose information about you if we determine that such disclosure should be made for reasons of national security, law enforcement, or other issues of public importance.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We respect and are committed to protecting your privacy. However, we may disclose your personal information to our group companies and to our services providers and partners who provide data processing services to us. This includes, for example, group companies and service providers who assist with functions such as billing, customer support, hosting and storage, data analytics, data labelling and machine learning, security, advertising and marketing, and other services. We may also disclose your personal information to our group companies and partners for other purposes that are described in this Privacy Policy or notified to you when we collect your information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “**10.6** We may need to disclose Personal Data to third parties, such as our related companies or our service providers (for example, IT and administrative service providers and our professional advisors).” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We partner with third-party ad servers, ad networks and social media platforms (e.g., Facebook, Instagram and Google) to deliver personalised advertisements on our Service and other sites that may be of interest to you and/or to measure their effectiveness, and/or to identify potential new users of our Service.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “**4.1** Once you have created your Account, you may choose a Subscription. The Subscriptions we offer will be set out on our Platform, including details of each Subscription’s features and limitations, Subscription Fees and Subscription Periods.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.