Stable Diffusion procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Stability processes your personal data on servers located outside of the European Economic Area (“EEA”), Switzerland, and the UK, including processing your personal data in our servers in the US. Where information is transferred outside the EEA, Switzerland, or the UK, we rely on: Adequacy decisions : We rely on the European Commission adequacy decisions under Article 45 GDPR where they recognise that a country outside of the EEA offers an adequate level of data protection; or” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Standard contractual clauses (“SCCs”) : We rely on the SCCs as approved by the European Commission under Article 46 GDPR (and their approved equivalent for the UK and Switzerland) that allows companies in the EEA to transfer data outside the EEA. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Stability retains your personal data for as long as reasonably necessary for the purposes outlined in this Privacy Policy, depending on factors such as the terms of your agreement, our purposes for processing the data (including whether the data is needed to resolve disputes and to enforce our agreements), and any legal requirements that we are subject to. The security of your personal data is important to us. We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, and unauthorized access or disclosure. Our security measures are designed to provide the level of security appropriate to the underlying level of risk associated with the data processing.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-Party Websites and Services . Our Services may involve integrations with, or may direct you to, third-party websites, apps, and services. By interacting with these third parties, you are providing information directly to that third party. As such, you should review the third party’s privacy policy. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-Party Partners . We may provide the personal data of individuals who visit our website to third-party partners, such as advertising partners, analytics providers, and social networks, who may assist us in advertising our Services to you. See our Cookie Policy . Where legally required, we provide you with the option to opt out of targeted advertising on our site and honor Global Privacy Controls (GPC).” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Payment Information : We (via our third-party partners, such as Stripe ) collect your payment information if you purchase our Services.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ A significant corporate event . If Stability is involved in a merger, corporate transaction, bankruptcy, or a transfer of business assets, Stability will disclose your personal data as part of these corporate transactions.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ k. Legal Compliance . We may comply with governmental, court, and law enforcement requests relating to our Services or information collected under our Terms, including with respect to your Inputs and Outputs.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To comply with legal obligations and to protect the rights, privacy, or safety of our users, Stability AI, or third parties ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We receive information from our trusted partners to protect against fraud and other security threats to our Services. We also receive information from marketing vendors that provide us with information about potential customers of our business services.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Our Services may use or be used in connection with third-party software, services, or integrations. By using our Services, you acknowledge that your Input, including any personal data you include within that Input, may be shared with such third-party service to enable functionality. Our Services may also incorporate third-party models or APIs ( here ), which may change from time to time as we update our Services. When you use our Services, you may not use any Outputs to train a model that competes with that third party ( see, e.g. , OpenAI terms ). By using our Services, you agree to comply with the terms of these third parties. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Regulatory or legal requirements, safety and security, rights of others, or to enforce our rights . We may disclose personal data to governmental regulatory authorities as required by law, in response to their requests for information or to assist in investigations. We may also disclose personal data to third parties in connection with disputes or litigation, or if we determine its disclosure is necessary to protect the health and safety of any person, to prevent fraud, credit risk, or illegal activity, to enforce our or others’ legal rights, or as otherwise required or permitted by applicable law.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ With an individual’s consent . Stability will disclose personal data when an individual gives us permission or directs us to disclose this information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Stability will disclose the above categories of personal data to the following third parties and for the purposes explained in this Privacy Policy: Affiliates & corporate partners . Stability discloses personal data between and among its affiliates and related entities.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To comply with legal obligations and to protect the rights, privacy, or safety of our users, Stability AI, or third parties. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers & trusted partners . Stability may disclose personal data with service providers and trusted partners for various business purposes, including cloud services, and safety and security services.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.