pcloud.com privacy policy — score 65/100 (medium risk)
Última análise
Este relatório tem mais de 28 dias. Mostra a última análise guardada para esta política — atualize para voltar a obter a página em direto e renovar a pontuação.
O conteúdo do relatório (resumo, conclusões, citações) foi gerado em inglês e não está localizado.
Detalhes do relatório
medium riscopCloud lets you choose EU or US storage but still shares extensive personal and usage data with many parties and lacks clear limits on AI training or US‑transfer safeguards.
The policy is fairly transparent about the categories of data collected and the rights granted, but it permits broad processing for legitimate interests, extensive third‑party sharing, and transfers to the United States without detailing adequacy safeguards or Standard Contractual Clauses. No explicit clause limits the use of personal data for AI model training, and retention periods are vague.
Avaliação por categoria
Repartição da política pelas principais áreas de conformidade. Bom = sólido, razoável = misto, fraco = preocupante.
Collects extensive device, usage, and contact‑list data even for guest users, with no clear limitation to what is strictly necessary.
Provides detailed lists of data categories, purposes, and user rights, though some clauses are vague (e.g., “legitimate interests”).
Shares data with payment processors, advertising/analytics firms, and many other parties; specific processor list is absent.
Allows transfers to the US based on user choice but does not describe adequacy mechanisms or contractual safeguards.
No explicit statement on whether personal data is used to train AI models or an opt‑out mechanism.
Clearly outlines access, rectification, erasure, restriction, portability, objection and provides contact details.
Conclusões principais
Cláusulas relevantes, problemas ou boas práticas identificadas (críticas primeiro)
Insufficient safeguards for US transfers
Section 8 states users can store data in the US, triggering transfers, but provides no reference to Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions, leaving the legal basis unclear.
Broad collection of technical and behavioural data
The policy lists IP address, browser version, OS, device identifiers, navigation paths and “behaviour” as collected for both registered and guest users, despite claiming the data is “anonymous”. This may exceed what is necessary for the core storage service.
Lack of explicit AI/model‑training limitation
The policy mentions using personal data to “adapt certain Services or experiences” and for “targeted offers on third‑party sites”, but does not state whether data is used for training machine‑learning models nor offer an opt‑out.
Vague retention periods
Section 3 says data is kept for the “shortest necessary” period but also may be retained longer for “legitimate commercial interest” without specifying time limits, making compliance with the GDPR’s storage limitation principle uncertain.
Third‑party sharing breadth without processor list
Section 5 lists many categories of recipients (payment providers, advertising, analytics, potential acquirers) but does not publish a concrete sub‑processor list or the contractual safeguards in place.
Resumo para o utilizador
You can delete your account, but your data may be kept for up to 30 days after deletion and may be retained longer for “legitimate interests”.
Postura de conformidade
Mixed – the policy meets many GDPR disclosure requirements but falls short on data minimisation, transfer safeguards, and AI‑specific controls.
Transferências UE
User‑controlled region choice is a positive step, yet the policy does not explain the legal basis (e.g., SCCs, BCRs) for transfers to the US, nor does it address the impact of US surveillance laws.
Sinais detetados
Dados e práticas específicas identificadas no texto
Fragmentos de evidência
Citações diretas da política que suportam estas conclusões
Nous recueillons des informations vous concernant lorsque vous utilisez le Site ou le Service, telles que votre adresse IP, le type et la version de votre navigateur, votre système d’exploitation, la source de référence et des informations sur l’appareil.
Vous pouvez choisir de stocker vos informations sur des serveurs sécurisés situés dans l’Union européenne ou aux États-Unis. Si vous choisissez de stocker vos informations aux États-Unis, vous provoquez le transfert de vos Données à caractère personnel sur nos serveurs situés aux États-Unis.
Nous ne partageons pas vos Données à caractère personnel avec des tiers à des fins de commercialisation.
Nous pouvons partager vos Données à caractère personnel ou d’autres informations avec votre consentement ou vos indications, y compris si vous autorisez une connexion de compte avec un compte ou une plateforme tiers.
Nous pouvons conserver les Données à caractère personnel pendant des périodes plus longues que requises par la loi si c’est dans notre intérêt commercial légitime et n’est pas interdit par la loi.
Em falta ou pouco claro
- No explicit Standard Contractual Clauses or adequacy decision for US transfers
- No detailed sub‑processor list or contractual safeguards disclosed
- No clear statement on whether personal data is used to train AI or machine‑learning models, nor an opt‑out mechanism
- No specific retention periods for each data category
Perguntas a fazer
- What legal mechanism (e.g., SCCs, BCRs) do you rely on for transfers of personal data to the United States?
- Can you provide a current list of sub‑processors and the contractual safeguards you have with them?
- Do you use personal data for training AI or machine‑learning models, and if so, can users opt‑out?
- What are the exact retention periods for each category of personal data, especially for data kept under “legitimate interests”?
- How do you ensure that data shared with advertising and analytics partners remains pseudonymised and does not enable re‑identification?
Partilhar esta análise
Qualquer pessoa com esta ligação pode ver o resultado acima.
Criado pela DentroChat
Chat de IA 100% europeu para todos
Converse com IA, trabalhe com ficheiros, gere imagens e pesquise na web. Os dados permanecem na Europa.