pcloud.com privacy policy — score 65/100 (medium risk)
Ultima analiză
Acest raport are mai mult de 28 de zile. Afișează ultima analiză salvată pentru această politică — actualizează pentru a reîncărca pagina live și a reînnoi scorul.
Conținutul raportului (rezumat, constatări, citate) a fost generat în engleză și nu este localizat.
Detalii raport
medium riscpCloud lets you choose EU or US storage but still shares extensive personal and usage data with many parties and lacks clear limits on AI training or US‑transfer safeguards.
The policy is fairly transparent about the categories of data collected and the rights granted, but it permits broad processing for legitimate interests, extensive third‑party sharing, and transfers to the United States without detailing adequacy safeguards or Standard Contractual Clauses. No explicit clause limits the use of personal data for AI model training, and retention periods are vague.
Evaluare pe categorii
Defalcare a politicii pe domenii cheie de conformitate. Bun = solid, rezonabil = mixt, slab = îngrijorător.
Collects extensive device, usage, and contact‑list data even for guest users, with no clear limitation to what is strictly necessary.
Provides detailed lists of data categories, purposes, and user rights, though some clauses are vague (e.g., “legitimate interests”).
Shares data with payment processors, advertising/analytics firms, and many other parties; specific processor list is absent.
Allows transfers to the US based on user choice but does not describe adequacy mechanisms or contractual safeguards.
No explicit statement on whether personal data is used to train AI models or an opt‑out mechanism.
Clearly outlines access, rectification, erasure, restriction, portability, objection and provides contact details.
Constatări cheie
Clauze notabile, probleme sau practici pozitive identificate (critice primele)
Insufficient safeguards for US transfers
Section 8 states users can store data in the US, triggering transfers, but provides no reference to Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions, leaving the legal basis unclear.
Broad collection of technical and behavioural data
The policy lists IP address, browser version, OS, device identifiers, navigation paths and “behaviour” as collected for both registered and guest users, despite claiming the data is “anonymous”. This may exceed what is necessary for the core storage service.
Lack of explicit AI/model‑training limitation
The policy mentions using personal data to “adapt certain Services or experiences” and for “targeted offers on third‑party sites”, but does not state whether data is used for training machine‑learning models nor offer an opt‑out.
Vague retention periods
Section 3 says data is kept for the “shortest necessary” period but also may be retained longer for “legitimate commercial interest” without specifying time limits, making compliance with the GDPR’s storage limitation principle uncertain.
Third‑party sharing breadth without processor list
Section 5 lists many categories of recipients (payment providers, advertising, analytics, potential acquirers) but does not publish a concrete sub‑processor list or the contractual safeguards in place.
Rezumat pentru utilizator
You can delete your account, but your data may be kept for up to 30 days after deletion and may be retained longer for “legitimate interests”.
Postură de conformitate
Mixed – the policy meets many GDPR disclosure requirements but falls short on data minimisation, transfer safeguards, and AI‑specific controls.
Transferuri UE
User‑controlled region choice is a positive step, yet the policy does not explain the legal basis (e.g., SCCs, BCRs) for transfers to the US, nor does it address the impact of US surveillance laws.
Semnale detectate
Date și practici specifice identificate în text
Fragmente probatorii
Citate directe din politică care susțin aceste constatări
Nous recueillons des informations vous concernant lorsque vous utilisez le Site ou le Service, telles que votre adresse IP, le type et la version de votre navigateur, votre système d’exploitation, la source de référence et des informations sur l’appareil.
Vous pouvez choisir de stocker vos informations sur des serveurs sécurisés situés dans l’Union européenne ou aux États-Unis. Si vous choisissez de stocker vos informations aux États-Unis, vous provoquez le transfert de vos Données à caractère personnel sur nos serveurs situés aux États-Unis.
Nous ne partageons pas vos Données à caractère personnel avec des tiers à des fins de commercialisation.
Nous pouvons partager vos Données à caractère personnel ou d’autres informations avec votre consentement ou vos indications, y compris si vous autorisez une connexion de compte avec un compte ou une plateforme tiers.
Nous pouvons conserver les Données à caractère personnel pendant des périodes plus longues que requises par la loi si c’est dans notre intérêt commercial légitime et n’est pas interdit par la loi.
Lipsă sau neclar
- No explicit Standard Contractual Clauses or adequacy decision for US transfers
- No detailed sub‑processor list or contractual safeguards disclosed
- No clear statement on whether personal data is used to train AI or machine‑learning models, nor an opt‑out mechanism
- No specific retention periods for each data category
Întrebări de pus
- What legal mechanism (e.g., SCCs, BCRs) do you rely on for transfers of personal data to the United States?
- Can you provide a current list of sub‑processors and the contractual safeguards you have with them?
- Do you use personal data for training AI or machine‑learning models, and if so, can users opt‑out?
- What are the exact retention periods for each category of personal data, especially for data kept under “legitimate interests”?
- How do you ensure that data shared with advertising and analytics partners remains pseudonymised and does not enable re‑identification?
Distribuie această analiză
Oricine are acest link poate vedea rezultatul de mai sus.
Creat de DentroChat
Chat AI 100% european pentru toți
Discută cu AI, lucrează cu fișiere, generează imagini și caută pe web. Datele rămân în Europa.