Claid

GDPR overview

Claid states GDPR and CCPA compliance explicitly in the FAQ of its API pricing page, alongside encryption at rest and in transit and a SOC 2 audit described as in progress rather than completed. The privacy policy, effective 21 May 2024, positions Claid as processor and the customer as controller, and points to a Data Processing Agreement the company provides. It lists the expected rights, including access, rectification, erasure, restriction, objection and portability, with a 30-day response commitment and the right to complain to a supervisory authority. Two gaps deserve attention: the policy still relies on the EU-U.S. and Swiss-U.S. Privacy Shield frameworks, invalidated in 2020, and no Article 27 EU representative is named. Every request goes to a single address, support@claid.ai.

Who owns the data?

Under its privacy policy Claid acts as a data processor and treats the customer as the data controller. The company states that it does not sell, share or rent the data held in a customer account, and does not use it for purposes outside that policy. Customers can retrieve, modify or delete their data from their account at any time. To run the service Claid does capture IP addresses, request headers and the data submitted to its API, and it shares information with hosting and maintenance providers, with payment processors, and with public authorities on lawful request. The terms grant only a limited, non-transferable and revocable right to use the service itself.

Reuse rights

The FAQ on the API pricing page states plainly that customer data is never used for model training, and that data is encrypted at rest and in transit. Nothing in the collected terms claims a licence over the images a customer generates, so the output appears to remain the customer's to use commercially, although the point is never spelled out and is worth confirming before a large rollout. What the terms do restrict is the service itself: reselling, redistributing, modifying or reverse-engineering it is prohibited, as is using it to generate training data for other AI research or to benchmark against competing products. Support conversations are kept for a limited period for quality control, complaint handling and fraud detection.

Data retention & training

Hosting summary

Claid names no hosting country and no hosting region anywhere in the pages collected. The privacy policy refers only to "the laws of the countries where our servers are located" without identifying them, and the governing law is that of the State of California, with arbitration seated in Los Angeles. On the security side the company claims encryption at rest and in transit, industry-standard technical restrictions and access limited to authorised personnel, and describes SOC 2 as in progress rather than obtained. Third-party service providers are mentioned as recipients of data for hosting and maintenance, but no subprocessor list is published. A DNS lookup resolves the domain to a Cloudflare anycast address, which indicates a content delivery point of presence and says nothing about where data is actually stored. Anyone with a data residency requirement will need to ask the sales team directly, since the published documentation does not answer the question.