Workflow & Automation · make.comMake (AI Automation)
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“To improve our operations, systems, products, processes in order to enhance your experience, we need to understand your preferences, analyze aggregated, anonymized or statistical usage data and crash information as well as conduct surveys with regards to our Services. We hereby confirm that Google Workspace APIs are not used to develop, improve, or train…”
Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Absence of defined retention timelines makes it difficult for users to predict how long their data will be held. The legal-claims carve-out could extend retention significantly without notice to the user.
The breadth of automatic collection—including query content and workflow structure—means sensitive operational or personal information may be captured as usage metadata without explicit user action. This data is then available for service improvement and other stated purposes.
The enumerated purposes are wide-ranging. 'Legitimate business purposes' is a vague, open-ended category that could encompass significant secondary uses of personal data. While each purpose is tied to a legal basis, users may not anticipate all uses covered by these broad headings.
Scores derived from 53 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Make (AI Automation)'s terms explicitly protect your inputs from training use — the policy is affirmatively favorable on this point.
- Data handling is conditional — 3 privacy or retention clauses warrant review before using Make (AI Automation) at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Make (AI Automation)'s own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredIP/output assessment pending — terms of service not yet verified This lens receives a band only once its source document has been captured and read in full.
Know where this document lives? Point us to the URL or PDF and the pipeline will verify it.
Based on 94 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Partially verified — Privacy Policy — Verified (read in full, 75 findings); Terms of Service — Capture pending. Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Capture blocked
A known core policy document could not be publicly captured after the available capture strategies were tried.
Blocked core document: Terms of Service
- Privacy PolicyVerified - read in full - 75 citationspdf textLast captured 2026-08-24
- Terms of ServiceCapture blocked - document not publicly capturable
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment incorporates employer-mediated business relationships as a condition under which the Privacy Notice applies to personal data processing about individuals.
"- Your employer does business with us,"
The enumerated purposes are wide-ranging. 'Legitimate business purposes' is a vague, open-ended category that could encompass significant secondary uses of personal data. While each purpose is tied to a legal basis, users may not anticipate all uses covered by these broad headings.
"We may process your Personal Data for one or more of the following purposes: ###### Provide the requested Services To provide the requested Services and to make sure that we fulfill contractual obligations with you or your organization. T..."
This segment is a section header introducing the purposes for which Celonis processes personal data, establishing the framework for the lawful basis and purpose limitation principles described below.
"You provide Personal Data directly to us by accessing one of our websites or applications, attending one of our events, registering and/or using one of the Services, and participating in activities with us (e.g. user research). We may also ..."
Establishes obligation to disclose personal data to government, law enforcement, and regulatory bodies to meet applicable legal or regulatory requirements.
"- To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations."
Obligates disclosure of personal data to government, law enforcement, and regulatory bodies when required by applicable legal or regulatory obligations, making such sharing mandatory rather than discretionary.
" To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"When permitted and in compliance with applicable laws and regulations, Your Personal Data will be deleted upon your request or as soon as it is no longer serving the purpose for which it has been collected. If regulations require longer storage of your Personal Data, or if we need your Personal Data to assert legal claims or defend against legal claims, we will store your Personal Data until the expiration of the corresponding storage period or until the settlement of the claims."
Absence of defined retention timelines makes it difficult for users to predict how long their data will be held. The legal-claims carve-out could extend retention significantly without notice to the user.
AI-generated interpretation, not legal advice.
"- We have a legitimate interest to process your Personal Data (which is not overridden by your rights),"
Establishes legitimate interest as a legal basis permitting processing of personal data where such interest is not overridden by data subject rights.
AI-generated interpretation, not legal advice.
"We may automatically gather and analyze information on how and whether specific features of our Services are used, such as details about which of our applications and versions are being used, user interactions with the Services (including searches and other actions taken by users), pages and files viewed, online trainings attended, types of data sources queried, types of visualizations built, system configuration information, number of steps in a workflow, the type(s) of operations used and the queries submitted, as well as hardware properties such as CPU type and amount of RAM, logfile data, and date and time stamps associated with use of the Services."
The breadth of automatic collection—including query content and workflow structure—means sensitive operational or personal information may be captured as usage metadata without explicit user action. This data is then available for service improvement and other stated purposes.
AI-generated interpretation, not legal advice.
"We may process your Personal Data for one or more of the following purposes: ###### Provide the requested Services To provide the requested Services and to make sure that we fulfill contractual obligations with you or your organization. This includes but is not limited to resolving technical issues you encounter, responding to your requests for assistance, providing training related to our Services and responding to any request you may send us through our website, email or any other way. ###### Improve and enhance our Services To improve our operations, systems, products, processes in order to enhance your experience, we need to understand your preferences, analyze aggregated, anonymized or statistical usage data and crash information as well as conduct surveys with regards to our Services. We hereby confirm that Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models. ###### Enable security and compliance To maintain the security and compliance of our Services with the objective to protect against, investigate and deter fraudulent, unauthorized, or illegal activity and to avoid and detect attacks on our applications or misuse of our Services. To ensure appropriate security of our office premises and comply with any legal and regulatory obligations. ###### Perform sales, marketing and events related activities To communicate news about upcoming events, products, services and for direct advertising. To inform you about our Services. To manage your registration to our events and to make visual and audio media related to the event available to you. ###### Other legitimate business purposes Such as to conduct customer surveys, collect and assess feedback, determine the effectiveness of our marketing campaigns, and to evaluate and improve ou"
The enumerated purposes are wide-ranging. 'Legitimate business purposes' is a vague, open-ended category that could encompass significant secondary uses of personal data. While each purpose is tied to a legal basis, users may not anticipate all uses covered by these broad headings.
AI-generated interpretation, not legal advice.
"When you visit one of our websites or applications, data from your computer or mobile device may be collected, such as device type, location, information about the browser type and version, the operating system and version, the internet service provider or mobile carrier, the IP Address (or proxy server) as well as geographic areas derived from your IP address, time and date of access, duration of access, referring URL (if any), and identifiers that help us to recognize your device and validate that you are a licensed user."
This segment is a section header introducing the methods by which Celonis collects personal data, establishing context for the collection procedures described below.
AI-generated interpretation, not legal advice.
"You provide Personal Data directly to us by accessing one of our websites or applications, attending one of our events, registering and/or using one of the Services, and participating in activities with us (e.g. user research). We may also obtain Personal Data from your employer in the context of providing the Services or obtain information about you from third party sources, such as public databases, websites, resellers and distributors, marketing or business partners, security and fraud detection firms and social media platforms."
This segment is a section header introducing the purposes for which Celonis processes personal data, establishing the framework for the lawful basis and purpose limitation principles described below.
AI-generated interpretation, not legal advice.
"To communicate news about upcoming events, products, services and for direct advertising. To inform you about our Services. To manage your registration to our events and to make visual and audio media related to the event available to you."
Specifies permitted uses of personal data including communicating news, informing about services, managing event registrations, and making event media available.
AI-generated interpretation, not legal advice.
" Depending on the purpose and the necessity, we may disclose your Personal Data to the following categories of recipients: To any subsidiaries of Celonis SE (i.e. internal transfer within our organization),"
Permits disclosure of personal data to Celonis SE subsidiaries as part of internal organizational transfers, establishing the intra-group data sharing right.
AI-generated interpretation, not legal advice.
"- To third parties who act as data processors under our instruction as specified in the related concluded contracts,"
Permits disclosure of personal data to third parties acting as data processors operating under the controller's instruction pursuant to concluded contracts.
AI-generated interpretation, not legal advice.
"- When you sign up to one of our events and we ask third parties to host, sponsor or present, including webinars and trainings, we may forward your contact data to the respective third party who may use it to provide access to the event or to contact you for related marketing purposes,"
Permits forwarding of contact data to third-party event hosts, sponsors, or presenters for event access provision and related marketing purposes when a user signs up for events.
AI-generated interpretation, not legal advice.
" To third parties who entered into a written agreement with us. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis, fraud prevention, network and information security, technical support and customer service,"
Permits disclosure of personal data to third-party vendors and service providers (e.g., marketing, billing, fraud prevention) who have entered into written agreements, defining the contractual safeguard required for such sharing.
AI-generated interpretation, not legal advice.
" To third parties who act as data processors under our instruction as specified in the related concluded contracts,"
Permits disclosure of personal data to third-party data processors acting under Celonis's instruction pursuant to concluded data processing contracts, establishing the processor relationship and its contractual basis.
AI-generated interpretation, not legal advice.
" When you sign up to one of our events and we ask third parties to host, sponsor or present, including webinars and trainings, we may forward your contact data to the respective third party who may use it to provide access to the event or to contact you for related marketing purposes,"
Permits forwarding of event registrant contact data to third-party hosts, sponsors, or presenters for event access or related marketing purposes, giving notice of a specific data sharing scenario tied to event sign-ups.
AI-generated interpretation, not legal advice.
"- To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations."
Establishes obligation to disclose personal data to government, law enforcement, and regulatory bodies to meet applicable legal or regulatory requirements.
AI-generated interpretation, not legal advice.
"- To third parties who entered into a written agreement with us. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis, fraud prevention, network and information security, technical support and customer service,"
Permits disclosure of personal data to third-party vendors and service providers under written agreements for specified support functions including marketing, billing, fraud prevention, and technical support.
AI-generated interpretation, not legal advice.
" To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations."
Obligates disclosure of personal data to government, law enforcement, and regulatory bodies when required by applicable legal or regulatory obligations, making such sharing mandatory rather than discretionary.
AI-generated interpretation, not legal advice.
" As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration"
Informs data subjects of the possibility to invoke binding arbitration under certain circumstances due to Celonis's subjection to FTC investigatory and enforcement powers, establishing an alternative dispute resolution right tied to regulatory oversight.
AI-generated interpretation, not legal advice.
"- As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration"
Grants data subjects the right to invoke binding arbitration under certain circumstances given Celonis's subjection to FTC investigatory and enforcement powers, establishing a dispute resolution mechanism.
AI-generated interpretation, not legal advice.
Common questions about Make (AI Automation)'s policies
- Does Make (AI Automation) train its AI models on your data?
- No training on your content by default — based on 1 verified finding from Make (AI Automation)'s published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Make (AI Automation)'s own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
18 verified clausesClauses in Make (AI Automation)'s policies that work in your favour — commitments the platform made to you.
- Audit rights, DPA & residency
“A list of applicable recipients can be provided upon request. If you are a EU, UK or Swiss resident, your Personal Data may be transferred outside of the European Economic Area (EEA), UK or Switzerland. We are liable for onward transfers to third parties and…”
Establishes Celonis's liability for onward transfers to third parties, commits to ensuring adequate protection for cross-border transfers from the EEA, UK, and Switzerland, and declares compliance with the EU-U.S. DPF, U…
📍 Privacy Policy › “Who will have access to your Personal Data?”Jump to exact text → - Audit rights, DPA & residency
“Celonis Inc., and Celonis Labs LLC comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Celonis Inc. a…”
Records certification and commitment by Celonis Inc. and Celonis Labs LLC to comply with EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF principles for processing personal data transferred from the EU, UK, and Switzerland.
📍 Privacy Policy › “**Who will have access to your Personal Data?**”Jump to exact text → - Audit rights, DPA & residency
“In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Celonis commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information…”
Commits Celonis to cooperate with and comply with the advice of EU DPAs, the UK ICO, and the Swiss FDPIC regarding unresolved complaints about personal data handling under the DPF frameworks, establishing a binding coope…
📍 Privacy Policy › “Not to be discriminated for exercising your rights,”Jump to exact text → - Audit rights, DPA & residency
“In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Celonis commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information…”
Establishes Celonis's obligation to cooperate with and comply with the advice of EU DPAs, the UK ICO, and the Swiss FDPIC for resolving unresolved complaints about personal data handling under the EU-U.S. DPF, UK Extensi…
📍 Privacy Policy › “**What are your rights regarding your Personal Data?**”Jump to exact text → - Model trainingdoes-not-train
“To improve our operations, systems, products, processes in order to enhance your experience, we need to understand your preferences, analyze aggregated, anonymized or statistical usage data and crash information as well as conduct surveys with regards to our S…”
This segment is a section header for the purpose of enabling security and compliance, acting as a definitional label for the processing purpose described below.
📍 Privacy Policy › “Improve and enhance our Services”Jump to exact text → - Audit rights, DPA & residency
“If you are a EU, UK or Swiss resident, your Personal Data may be transferred outside of the European Economic Area (EEA), UK or Switzerland. We are liable for onward transfers to third parties and we take the necessary steps to ensure that the transfer of your…”
Establishes that personal data of EU, UK, and Swiss residents may be transferred outside the EEA/UK/Switzerland and imposes liability for onward transfers, obligating adequate protection measures for such cross-border tr…
📍 Privacy Policy › “**Who will have access to your Personal Data?**”Jump to exact text →
+ 12 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
1 verified clauseWhat Make (AI Automation) requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementconduct restrictions
“- Access or use any of our applications or platforms, such as make.com,”
This segment specifies that accessing or using Celonis applications and platforms, including make.com, triggers application of the Privacy Notice to personal data processing.
📍 Privacy Policy › “About this Privacy Notice”Jump to exact text →
What the policies actually cover
9 topics- Product telemetry & usage tracking7 clauses
- Advertising & tracking2 protective4 clauses
- Sale or sharing of personal data1 protective1 clause
- Government & law-enforcement disclosure2 clauses
- Does not train on your content1 protective1 clause
- Arbitration & class-action waiver2 clauses
- Deletion rights & post-termination survival1 clause
- Breach-notification promises1 clause
- Conduct restrictions1 obligation1 clause
55 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “**How long do we store your Personal Data?**” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “Improve and enhance our Services” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain each category of information for as long as necessary to fulfill the business purposes outlined in this notice, or to satisfy legal, accounting, and reporting obligations.”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“We retain each category of information for as long as necessary to fulfill the business purposes outlined in this notice, or to satisfy legal, accounting, and reporting obligations.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“- As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“- As we may be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) you have the possibility, under certain circumstances, to invoke binding arbitration.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | conditional | MEDIUM | 2 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 4 |
| All applicable tiers | privacy data use | worsens | HIGH | 9 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| All applicable tiers | training use | improves | LOW | 5 |
| Government | audit rights dpa residency | conditional | MEDIUM | 1 |
| Government | privacy data use | conditional | MEDIUM | 1 |
| Government | subprocessors data sharing | conditional | MEDIUM | 1 |
| Team / Business | data retention | conditional | MEDIUM | 2 |
| Team / Business | privacy data use | worsens | HIGH | 4 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“- To third parties who entered into a written agreement with us. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis, fraud prevention, network and information security, technical support and customer service,”Before citation
“While we do not sell your personal data for monetary compensation, our use of third-party marketing, analytics, and cross-context behavioral advertising cookies, as well as sharing information with business partners when you provide consent, may be classified as "selling" or "sharing" under US state privacy laws (including the CCPA).”After citation
Latest stance: sale or sell on privacy data use
“You have the right to direct us not to "sell" or "share" your personal information. You can exercise this right at any time by emailing us at [privacy@make.com](mailto:privacy@make.com).”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“If you are a EU, UK or Swiss resident, your Personal Data may be transferred outside of the European Economic Area (EEA), UK or Switzerland. We are liable for onward transfers to third parties and we take the necessary steps to ensure that the transfer of your Personal Data outside of the EEA, UK or Switzerland receives an adequate level of protection.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“- To third parties who entered into a written agreement with us. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis, fraud prevention, network and information security, technical support and customer service,”Open timeline citation
Latest stance: indefinite or necessity based on data retention
“We retain each category of information for as long as necessary to fulfill the business purposes outlined in this notice, or to satisfy legal, accounting, and reporting obligations.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-08-24· verified 2026-08-24
- Terms of Service:Last captured 2026-06-07
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 178 more findings this quarter vs last (265 vs 87). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Make (AI Automation)'s policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified Make (AI Automation)'s Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from Make (AI Automation)'s own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.