pcloud.com privacy policy — score 65/100 (medium risk)
Senast analyserad
Den här rapporten är äldre än 28 dagar. Den visar den senast sparade analysen för den här policyn — uppdatera för att hämta den live-sidan och förnya poängen.
Rapportinnehållet (sammanfattning, fynd, citat) genererades på engelska och är inte lokaliserat.
Rapportdetaljer
medium riskpCloud lets you choose EU or US storage but still shares extensive personal and usage data with many parties and lacks clear limits on AI training or US‑transfer safeguards.
The policy is fairly transparent about the categories of data collected and the rights granted, but it permits broad processing for legitimate interests, extensive third‑party sharing, and transfers to the United States without detailing adequacy safeguards or Standard Contractual Clauses. No explicit clause limits the use of personal data for AI model training, and retention periods are vague.
Bedömning per kategori
Uppdelning av policyn över viktiga efterlevnadsområden. Bra = stark, rimlig = blandad, dålig = oroande.
Collects extensive device, usage, and contact‑list data even for guest users, with no clear limitation to what is strictly necessary.
Provides detailed lists of data categories, purposes, and user rights, though some clauses are vague (e.g., “legitimate interests”).
Shares data with payment processors, advertising/analytics firms, and many other parties; specific processor list is absent.
Allows transfers to the US based on user choice but does not describe adequacy mechanisms or contractual safeguards.
No explicit statement on whether personal data is used to train AI models or an opt‑out mechanism.
Clearly outlines access, rectification, erasure, restriction, portability, objection and provides contact details.
Viktiga fynd
Anmärkningsvärda klausuler, problem eller positiva rutiner (kritiska först)
Insufficient safeguards for US transfers
Section 8 states users can store data in the US, triggering transfers, but provides no reference to Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions, leaving the legal basis unclear.
Broad collection of technical and behavioural data
The policy lists IP address, browser version, OS, device identifiers, navigation paths and “behaviour” as collected for both registered and guest users, despite claiming the data is “anonymous”. This may exceed what is necessary for the core storage service.
Lack of explicit AI/model‑training limitation
The policy mentions using personal data to “adapt certain Services or experiences” and for “targeted offers on third‑party sites”, but does not state whether data is used for training machine‑learning models nor offer an opt‑out.
Vague retention periods
Section 3 says data is kept for the “shortest necessary” period but also may be retained longer for “legitimate commercial interest” without specifying time limits, making compliance with the GDPR’s storage limitation principle uncertain.
Third‑party sharing breadth without processor list
Section 5 lists many categories of recipients (payment providers, advertising, analytics, potential acquirers) but does not publish a concrete sub‑processor list or the contractual safeguards in place.
Sammanfattning för användaren
You can delete your account, but your data may be kept for up to 30 days after deletion and may be retained longer for “legitimate interests”.
Efterlevnadsställning
Mixed – the policy meets many GDPR disclosure requirements but falls short on data minimisation, transfer safeguards, and AI‑specific controls.
EU-överföringar
User‑controlled region choice is a positive step, yet the policy does not explain the legal basis (e.g., SCCs, BCRs) for transfers to the US, nor does it address the impact of US surveillance laws.
Upptäckta signaler
Specifika datapunkter och rutiner identifierade i texten
Bevisutdrag
Direkta citat från policyn som stödjer dessa fynd
Nous recueillons des informations vous concernant lorsque vous utilisez le Site ou le Service, telles que votre adresse IP, le type et la version de votre navigateur, votre système d’exploitation, la source de référence et des informations sur l’appareil.
Vous pouvez choisir de stocker vos informations sur des serveurs sécurisés situés dans l’Union européenne ou aux États-Unis. Si vous choisissez de stocker vos informations aux États-Unis, vous provoquez le transfert de vos Données à caractère personnel sur nos serveurs situés aux États-Unis.
Nous ne partageons pas vos Données à caractère personnel avec des tiers à des fins de commercialisation.
Nous pouvons partager vos Données à caractère personnel ou d’autres informations avec votre consentement ou vos indications, y compris si vous autorisez une connexion de compte avec un compte ou une plateforme tiers.
Nous pouvons conserver les Données à caractère personnel pendant des périodes plus longues que requises par la loi si c’est dans notre intérêt commercial légitime et n’est pas interdit par la loi.
Saknas eller otydligt
- No explicit Standard Contractual Clauses or adequacy decision for US transfers
- No detailed sub‑processor list or contractual safeguards disclosed
- No clear statement on whether personal data is used to train AI or machine‑learning models, nor an opt‑out mechanism
- No specific retention periods for each data category
Frågor att ställa
- What legal mechanism (e.g., SCCs, BCRs) do you rely on for transfers of personal data to the United States?
- Can you provide a current list of sub‑processors and the contractual safeguards you have with them?
- Do you use personal data for training AI or machine‑learning models, and if so, can users opt‑out?
- What are the exact retention periods for each category of personal data, especially for data kept under “legitimate interests”?
- How do you ensure that data shared with advertising and analytics partners remains pseudonymised and does not enable re‑identification?
Dela den här analysen
Alla med den här länken kan se resultatet ovan.
Byggd av DentroChat
100 % europeisk AI-chatt för alla
Chatta med AI, arbeta med filer, generera bilder och sök på webben. Data stannar i Europa.