Typesafe (Jev)
What Typesafe (Jev) keeps, for how long, whether it trains on it, and what rights you grant, for Jev API and Playground, Jev for Enterprise. Each answer quotes Typesafe (Jev)'s own policy.
Jev API and Playground API
- Default retention How long prompts and chats are kept
-
Stated No fixed period. The privacy policy keeps data as long as reasonably needed for the Services or business purposes; the DPA keeps customer personal data 'as long as necessary'.
What the policies say (3 quotes)
"We retain personal data about you for as long as reasonably necessary to provide you with the Services, or otherwise in support of our business or commercial purposes."
Privacy policytypesafe.aicaptured 2026-11-08"We collect the personal data you provide when you use the Services, including your prompts, data, instructions, and other input (“Input”)."
Privacy policytypesafe.aicaptured 2026-11-08"Customer Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law."
Data processingtypesafe.aicaptured 2026-11-08 - After you delete How long until it is gone
-
Stated You can request deletion; TypeSafe deletes or de-identifies data once no longer needed, unless law requires longer. No timeframe. The DPA has no deletion or return-of-data terms on termination.
What the policy says
"When you request that we do so, we take measures to delete your personal data or keep it in a form that does not permit identifying you when this personal data is no longer reasonably necessary for the purposes for which we process it, unless we are required by law to keep this data for a longer period."
Privacy policytypesafe.aicaptured 2026-11-08 - Kept longer when Safety flags, legal holds, backups
-
Stated Data may be kept longer when law requires, and preserved for legal process, fraud or safety. The DPA adds statute-of-limitations retention. No durations or backup periods are stated.
What the policies say (4 quotes)
"When you request that we do so, we take measures to delete your personal data or keep it in a form that does not permit identifying you when this personal data is no longer reasonably necessary for the purposes for which we process it, unless we are required by law to keep this data for a longer period."
Privacy policytypesafe.aicaptured 2026-11-08"We may access, preserve, and disclose personal data if we believe doing so is required or appropriate to:"
Privacy policytypesafe.aicaptured 2026-11-08"To find and prevent fraud and abuse, resolve disputes, or respond to trust and safety issues;"
Privacy policytypesafe.aicaptured 2026-11-08"Customer Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law."
Data processingtypesafe.aicaptured 2026-11-08 - Zero data retention Whether it exists and who can get it
-
Inferred Inferred: ZDR is offered only to enterprise customers, so standard API and Playground users apparently don't get it. Neither the captured policies nor the DPA say this outright.
What the policy says
"Zero data retention is available for enterprise customers. Ask about the setup for your account."
TypeSafe AItypesafe.aicaptured 2026-11-08 - Trains on your data By default
-
Stated No training. The privacy policy says TypeSafe won't train or fine-tune models on prompts or other Input. It says nothing about outputs; only the enterprise page mentions outputs.
What the policies say (2 quotes)
"We will not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input."
Privacy policytypesafe.aicaptured 2026-11-08"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Inferred Inferred: no opt-out needed since Input isn't trained on. The privacy policy still allows product development and aggregates; the DPA limits customer personal data to providing the Services.
What the policies say (5 quotes)
"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"To understand your preferences and analyze how you use the Services and develop new products, services, and technology;"
Privacy policytypesafe.aicaptured 2026-11-08"To generate anonymized or aggregated data that we may use for lawful purposes;"
Privacy policytypesafe.aicaptured 2026-11-08"Typesafe will only Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions, which are set forth in this DPA, the Agreement, or otherwise provided by Customer to Typesafe in writing (“**Documented Instructions**”)."
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will not (a) “sell” or “share” (as such terms are defined in the California Consumer Privacy Act (“**CCPA**”)) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than in accordance with the Documented Instructions"
Data processingtypesafe.aicaptured 2026-11-08 - Human review Whether people read conversations
-
Inferred Inferred: TypeSafe may monitor AUP compliance and investigate violations and fraud. The policies don't say whether or when staff read prompts.
What the policies say (2 quotes)
"TypeSafe may monitor compliance with this AUP and investigate any violations."
Acceptable Use Policytypesafe.aicaptured 2026-11-08"To find and prevent fraud and abuse, resolve disputes, or respond to trust and safety issues;"
Privacy policytypesafe.aicaptured 2026-11-08 - Memory Remembered facts and profiles
-
Not stated The captured policies describe no persistent memory or profile feature. Jev returns per-request decisions; nothing addresses stored context between calls.
- Connected apps Email, calendar, drive
-
Inferred Inferred: the policy mentions you may integrate third-party services but disclaims their privacy practices. It doesn't say what connected-account data TypeSafe stores or deletes on disconnect.
What the policy says
"The Services may contain links to other websites, products, or services that we do not own or operate or permit you to integrate with third-party services. We are not responsible for the privacy practices of these third parties."
Privacy policytypesafe.aicaptured 2026-11-08 - Agent actions Actions taken, browsing, credentials
-
Not stated The captured policies don't describe agent actions, browsing, or stored credentials or tokens.
- Your inputs Who owns them
-
Not stated Not addressed. Product terms are in a separate agreement (the Master Customer Agreement), which isn't among the captured policies; the Terms of Use cover only the website.
- Outputs Who owns them
-
Not stated Not addressed. Output ownership would be in the Master Customer Agreement, which isn't among the captured policies.
- License you grant Scope, and whether it is perpetual
-
Not stated No license over Input or Output appears in the captured policies. The only license shown is a perpetual, irrevocable one over website Feedback (see provider notes).
- Sharing Model providers, subprocessors, ads
-
Stated No sale or ad sharing. Input goes only to service providers; data can reach affiliates, Google Analytics, law enforcement or acquirers. Subprocessors are listed on an uncaptured trust page.
What the policies say (10 quotes)
"We do not “sell” personal data nor “share” personal data for cross-contextual behavioral advertising."
Privacy policytypesafe.aicaptured 2026-11-08"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"Vendors and Service Providers. We may disclose personal data we receive to vendors and service providers that help us provide the Services."
Privacy policytypesafe.aicaptured 2026-11-08"Affiliates. We may disclose personal data we receive to our subsidiaries and affiliates for the purposes described in this Privacy Policy."
Privacy policytypesafe.aicaptured 2026-11-08"Partners. We use analytics services such as Google Analytics to collect and process analytics data."
Privacy policytypesafe.aicaptured 2026-11-08"Notwithstanding anything to the contrary, including in the Agreement, TypeSafe may report any activity that it suspects violates any law or regulation to law enforcement officials, regulators, or other appropriate third parties, and cooperate with them to investigate and prosecute illegal conduct."
Acceptable Use Policytypesafe.aicaptured 2026-11-08"We may transfer your personal data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction"
Privacy policytypesafe.aicaptured 2026-11-08"Customer provides general authorization for Typesafe to engage the following subprocessors as described in **https://trust.typesafe.ai/subprocessors** (“**Subprocessors**”)."
Data processingtypesafe.aicaptured 2026-11-08"Customer may object to the appointment of such new Subprocessor within 15 days of the date of such notice on reasonable privacy or security grounds by providing Typesafe written notice of its objection."
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will not (a) “sell” or “share” (as such terms are defined in the California Consumer Privacy Act (“**CCPA**”)) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than in accordance with the Documented Instructions"
Data processingtypesafe.aicaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Services are hosted in the U.S. The DPA allows continuous transfers to adequate countries or under EU SCCs and the UK Addendum. No storage regions or residency options are stated.
What the policies say (4 quotes)
"The Services are hosted in the United States (“U.S.”)."
Privacy policytypesafe.aicaptured 2026-11-08"then please note that you are transferring your personal data outside of those regions to the U.S. for storage and processing."
Privacy policytypesafe.aicaptured 2026-11-08"Customer authorizes Typesafe to conduct transfers of Customer Personal Data to countries deemed to have an adequate level of data protection by the European Commission or the applicable competent regulatory authority on the basis of adequate safeguards in accordance with Data Protection Law or pursuant to (a) the contractual clauses annexed"
Data processingtypesafe.aicaptured 2026-11-08"On a continuous basis."
Data processingtypesafe.aicaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Inferred Inferred: the DPA forms part of 'the Agreement' (the MCA or another written agreement), so it may cover API customers too. Whether self-serve API accounts get it isn't stated.
What the policies say (2 quotes)
"This Typesafe Data Processing Addendum (“**DPA**”) forms part of the Agreement by and between Customer and Typesafe."
Data processingtypesafe.aicaptured 2026-11-08"or any other written agreement, contract, instrument, or other writing entered into by you and TypeSafe governing the provision of the Services to you (the “**Agreement**”)."
Acceptable Use Policytypesafe.aicaptured 2026-11-08
Jev for Enterprise Enterprise
- Default retention How long prompts and chats are kept
-
Stated No fixed period. The privacy policy keeps data as long as reasonably needed for the Services or business purposes; the DPA keeps customer personal data 'as long as necessary'.
What the policies say (3 quotes)
"We retain personal data about you for as long as reasonably necessary to provide you with the Services, or otherwise in support of our business or commercial purposes."
Privacy policytypesafe.aicaptured 2026-11-08"We collect the personal data you provide when you use the Services, including your prompts, data, instructions, and other input (“Input”)."
Privacy policytypesafe.aicaptured 2026-11-08"Customer Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law."
Data processingtypesafe.aicaptured 2026-11-08 - After you delete How long until it is gone
-
Stated You can request deletion; TypeSafe deletes or de-identifies data once no longer needed, unless law requires longer. No timeframe. The DPA has no deletion or return-of-data terms on termination.
What the policy says
"When you request that we do so, we take measures to delete your personal data or keep it in a form that does not permit identifying you when this personal data is no longer reasonably necessary for the purposes for which we process it, unless we are required by law to keep this data for a longer period."
Privacy policytypesafe.aicaptured 2026-11-08 - Kept longer when Safety flags, legal holds, backups
-
Stated Data may be kept longer when law requires, and preserved for legal process, fraud or safety. The DPA adds statute-of-limitations retention. No durations or backup periods are stated.
What the policies say (4 quotes)
"When you request that we do so, we take measures to delete your personal data or keep it in a form that does not permit identifying you when this personal data is no longer reasonably necessary for the purposes for which we process it, unless we are required by law to keep this data for a longer period."
Privacy policytypesafe.aicaptured 2026-11-08"We may access, preserve, and disclose personal data if we believe doing so is required or appropriate to:"
Privacy policytypesafe.aicaptured 2026-11-08"To find and prevent fraud and abuse, resolve disputes, or respond to trust and safety issues;"
Privacy policytypesafe.aicaptured 2026-11-08"Customer Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Law."
Data processingtypesafe.aicaptured 2026-11-08 - Zero data retention Whether it exists and who can get it
-
Stated Zero data retention is available to enterprise customers on request. The enterprise page links it to the DPA, but the DPA never mentions ZDR, so eligibility and scope remain undescribed.
What the policies say (2 quotes)
"Zero data retention is available for enterprise customers. Ask about the setup for your account."
TypeSafe AItypesafe.aicaptured 2026-11-08"[Data Handling & Privacy](./legal/data-processing)"
TypeSafe AItypesafe.aicaptured 2026-11-08 - Trains on your data By default
-
Stated No training. TypeSafe says it won't train or fine-tune models on prompts or other Input; the enterprise FAQ also says outputs aren't used for training.
What the policies say (3 quotes)
"We will not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input."
Privacy policytypesafe.aicaptured 2026-11-08"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"No. We don’t use your inputs or outputs to train our models."
TypeSafe AItypesafe.aicaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Inferred Inferred: no opt-out needed since Input isn't trained on. The privacy policy still allows product development and aggregates; the DPA limits customer personal data to providing the Services.
What the policies say (5 quotes)
"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"To understand your preferences and analyze how you use the Services and develop new products, services, and technology;"
Privacy policytypesafe.aicaptured 2026-11-08"To generate anonymized or aggregated data that we may use for lawful purposes;"
Privacy policytypesafe.aicaptured 2026-11-08"Typesafe will only Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions, which are set forth in this DPA, the Agreement, or otherwise provided by Customer to Typesafe in writing (“**Documented Instructions**”)."
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will not (a) “sell” or “share” (as such terms are defined in the California Consumer Privacy Act (“**CCPA**”)) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than in accordance with the Documented Instructions"
Data processingtypesafe.aicaptured 2026-11-08 - Human review Whether people read conversations
-
Inferred Inferred: TypeSafe may monitor AUP compliance and investigate violations and fraud. The policies don't say whether or when staff read prompts.
What the policies say (2 quotes)
"TypeSafe may monitor compliance with this AUP and investigate any violations."
Acceptable Use Policytypesafe.aicaptured 2026-11-08"To find and prevent fraud and abuse, resolve disputes, or respond to trust and safety issues;"
Privacy policytypesafe.aicaptured 2026-11-08 - Memory Remembered facts and profiles
-
Not stated The captured policies describe no persistent memory or profile feature. Jev returns per-request decisions; nothing addresses stored context between calls.
- Connected apps Email, calendar, drive
-
Inferred Inferred: the policy mentions you may integrate third-party services but disclaims their privacy practices. It doesn't say what connected-account data TypeSafe stores or deletes on disconnect.
What the policy says
"The Services may contain links to other websites, products, or services that we do not own or operate or permit you to integrate with third-party services. We are not responsible for the privacy practices of these third parties."
Privacy policytypesafe.aicaptured 2026-11-08 - Agent actions Actions taken, browsing, credentials
-
Not stated The captured policies don't describe agent actions, browsing, or stored credentials or tokens.
- Your inputs Who owns them
-
Not stated Not addressed. Product terms are in a separate agreement (the Master Customer Agreement), which isn't among the captured policies; the Terms of Use cover only the website.
- Outputs Who owns them
-
Not stated Not addressed. Output ownership would be in the Master Customer Agreement, which isn't among the captured policies.
- License you grant Scope, and whether it is perpetual
-
Not stated No license over Input or Output appears in the captured policies. The only license shown is a perpetual, irrevocable one over website Feedback (see provider notes).
- Sharing Model providers, subprocessors, ads
-
Stated No sale or ad sharing. Input goes only to service providers; data can reach affiliates, Google Analytics, law enforcement or acquirers. Subprocessors are listed on an uncaptured trust page.
What the policies say (10 quotes)
"We do not “sell” personal data nor “share” personal data for cross-contextual behavioral advertising."
Privacy policytypesafe.aicaptured 2026-11-08"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"Vendors and Service Providers. We may disclose personal data we receive to vendors and service providers that help us provide the Services."
Privacy policytypesafe.aicaptured 2026-11-08"Affiliates. We may disclose personal data we receive to our subsidiaries and affiliates for the purposes described in this Privacy Policy."
Privacy policytypesafe.aicaptured 2026-11-08"Partners. We use analytics services such as Google Analytics to collect and process analytics data."
Privacy policytypesafe.aicaptured 2026-11-08"Notwithstanding anything to the contrary, including in the Agreement, TypeSafe may report any activity that it suspects violates any law or regulation to law enforcement officials, regulators, or other appropriate third parties, and cooperate with them to investigate and prosecute illegal conduct."
Acceptable Use Policytypesafe.aicaptured 2026-11-08"We may transfer your personal data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction"
Privacy policytypesafe.aicaptured 2026-11-08"Customer provides general authorization for Typesafe to engage the following subprocessors as described in **https://trust.typesafe.ai/subprocessors** (“**Subprocessors**”)."
Data processingtypesafe.aicaptured 2026-11-08"Customer may object to the appointment of such new Subprocessor within 15 days of the date of such notice on reasonable privacy or security grounds by providing Typesafe written notice of its objection."
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will not (a) “sell” or “share” (as such terms are defined in the California Consumer Privacy Act (“**CCPA**”)) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than in accordance with the Documented Instructions"
Data processingtypesafe.aicaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Services are hosted in the U.S. The DPA allows continuous transfers to adequate countries or under EU SCCs and the UK Addendum. No storage regions or residency options are stated.
What the policies say (4 quotes)
"The Services are hosted in the United States (“U.S.”)."
Privacy policytypesafe.aicaptured 2026-11-08"then please note that you are transferring your personal data outside of those regions to the U.S. for storage and processing."
Privacy policytypesafe.aicaptured 2026-11-08"Customer authorizes Typesafe to conduct transfers of Customer Personal Data to countries deemed to have an adequate level of data protection by the European Commission or the applicable competent regulatory authority on the basis of adequate safeguards in accordance with Data Protection Law or pursuant to (a) the contractual clauses annexed"
Data processingtypesafe.aicaptured 2026-11-08"On a continuous basis."
Data processingtypesafe.aicaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Stated SOC 2 report, ZDR and higher limits. The DPA adds processor-only terms, 72-hour breach notice, annual audits at customer cost and subprocessor objections. SSO, custom retention and BAA aren't described.
What the policies say (7 quotes)
"Visit our Trust Center to request access to the SOC 2 Type II report."
TypeSafe AItypesafe.aicaptured 2026-11-08"Zero data retention is available for enterprise customers. Ask about the setup for your account."
TypeSafe AItypesafe.aicaptured 2026-11-08"Talk to us about higher limits, data requirements, or getting started."
TypeSafe AItypesafe.aicaptured 2026-11-08"Customer is the “controller” and “business” (as such terms are defined under applicable Data Protection Law), and Typesafe is the “processor” and “service provider”"
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will notify Customer without undue delay and in any case within 72 hours after becoming aware of any accidental or unauthorized access to, or disclosure or use of, Customer Personal Data (“**Security Incident**”)."
Data processingtypesafe.aicaptured 2026-11-08"Upon Customer’s written request, no more than once every 12 months, Typesafe will permit Customer to audit Typesafe’s controls applicable to its Processing of Customer Personal Data and compliance with this DPA (“**Audit**”)"
Data processingtypesafe.aicaptured 2026-11-08"Customer may object to the appointment of such new Subprocessor within 15 days of the date of such notice on reasonable privacy or security grounds by providing Typesafe written notice of its objection."
Data processingtypesafe.aicaptured 2026-11-08
Notes
-
The privacy policy covers the Playground web interface and the APIs together and doesn't treat them differently, so they're one product here. The captured policies describe no chat app.
What the policies say (2 quotes)
"our web-based interface(s) (the “Playground”), application programming interfaces (“APIs”), and other services that link to this Privacy Policy (collectively, the “Services”)."
Privacy policytypesafe.aicaptured 2026-11-08"Jev returns typed decisions with calibrated probabilities, so your software can account for uncertainty."
Hometypesafe.aicaptured 2026-11-08 -
The Terms of Use cover only the marketing website. Product use is governed by a separate agreement (the Master Customer Agreement), which wasn't captured.
What the policies say (2 quotes)
"If you enter into a separate agreement with TypeSafe for the use of any TypeSafe products or services, including products or services offered through the Site, the terms of that separate agreement will govern your access to and use of those products and service."
Terms of usetypesafe.aicaptured 2026-11-08"Capitalized terms not defined in this AUP have the meanings given in the TypeSafe Master Customer Agreement"
Acceptable Use Policytypesafe.aicaptured 2026-11-08 -
The 'no disclosure of Input except to service providers' promise sits beside clauses allowing disclosure for objectionable content and AUP reports to law enforcement 'notwithstanding anything to the contrary'.
What the policies say (3 quotes)
"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"For the avoidance of doubt, the disclosure of personal data may occur if you input any objectionable content on or through with the Services."
Privacy policytypesafe.aicaptured 2026-11-08"Notwithstanding anything to the contrary, including in the Agreement, TypeSafe may report any activity that it suspects violates any law or regulation to law enforcement officials, regulators, or other appropriate third parties, and cooperate with them to investigate and prosecute illegal conduct."
Acceptable Use Policytypesafe.aicaptured 2026-11-08 -
Feedback about the website is licensed to TypeSafe perpetually and irrevocably, for any purpose.
What the policy says
"you hereby grant TypeSafe an unrestricted, perpetual, irrevocable, non-exclusive, fully paid-up, royalty-free, transferable, sublicensable right to exploit the Feedback in any manner and for any purpose, including to improve the Site and create other products and services."
Terms of usetypesafe.aicaptured 2026-11-08 -
The no-training promise covers model training on Input only. Personal data may still be used to improve the Services and develop new products, and to create anonymized or aggregated data.
What the policies say (3 quotes)
"We (1) will not train or fine tune any artificial intelligence or machine learning models on Input, and (2) will not disclose any Input to a third party other than our service providers."
Privacy policytypesafe.aicaptured 2026-11-08"To understand your preferences and analyze how you use the Services and develop new products, services, and technology;"
Privacy policytypesafe.aicaptured 2026-11-08"To generate anonymized or aggregated data that we may use for lawful purposes;"
Privacy policytypesafe.aicaptured 2026-11-08 -
The DPA makes TypeSafe a processor for customer personal data: it uses that data only to provide the Services per the customer's instructions, and the DPA overrides conflicting Agreement terms.
What the policies say (3 quotes)
"Customer is the “controller” and “business” (as such terms are defined under applicable Data Protection Law), and Typesafe is the “processor” and “service provider”"
Data processingtypesafe.aicaptured 2026-11-08"Typesafe will only Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions, which are set forth in this DPA, the Agreement, or otherwise provided by Customer to Typesafe in writing (“**Documented Instructions**”)."
Data processingtypesafe.aicaptured 2026-11-08"If there is any inconsistency or conflict between terms of this DPA and the other terms of the Agreement, the terms of this DPA will control to the extent of such inconsistency or conflict."
Data processingtypesafe.aicaptured 2026-11-08 -
The DPA's processor limits look narrower than the privacy policy, which allows retention for business purposes and use to develop new products. The captured policies don't say which governs customer data.
What the policies say (3 quotes)
"Typesafe will not (a) “sell” or “share” (as such terms are defined in the California Consumer Privacy Act (“**CCPA**”)) Customer Personal Data, (b) retain, use, or disclose Customer Personal Data for any purpose other than in accordance with the Documented Instructions"
Data processingtypesafe.aicaptured 2026-11-08"We retain personal data about you for as long as reasonably necessary to provide you with the Services, or otherwise in support of our business or commercial purposes."
Privacy policytypesafe.aicaptured 2026-11-08"To understand your preferences and analyze how you use the Services and develop new products, services, and technology;"
Privacy policytypesafe.aicaptured 2026-11-08 -
The enterprise page links its zero-data-retention claim to the data-processing page, but that page (the DPA) says nothing about ZDR.
What the policies say (2 quotes)
"Zero data retention is available for enterprise customers. Ask about the setup for your account."
TypeSafe AItypesafe.aicaptured 2026-11-08"[Data Handling & Privacy](./legal/data-processing)"
TypeSafe AItypesafe.aicaptured 2026-11-08 -
The DPA gives a 72-hour breach notice and lets customers object to new subprocessors within 15 days, but objections only lead to good-faith talks, with no stated right to terminate.
What the policies say (2 quotes)
"Typesafe will notify Customer without undue delay and in any case within 72 hours after becoming aware of any accidental or unauthorized access to, or disclosure or use of, Customer Personal Data (“**Security Incident**”)."
Data processingtypesafe.aicaptured 2026-11-08"In the event that Customer objects to Typesafe’s appointment of a new Subprocessor, Customer and Typesafe will work together in good faith to address any such objection."
Data processingtypesafe.aicaptured 2026-11-08
Open questions
Questions the captured policies leave unanswered, and where the answer probably lives.
Concrete retention period for API Input and Output, plus logs: neither the privacy policy nor the DPA gives one; likely in the Master Customer Agreement (typesafe.ai/legal/mca, still not captured) or API docs (docs.typesafe.ai).
Input/Output ownership and the license granted to TypeSafe over customer content: not in the DPA; likely in the Master Customer Agreement (typesafe.ai/legal/mca), which is still not captured.
What ZDR covers, who qualifies and how it's configured: the DPA, which the enterprise page links for this, is silent. Possibly the MCA, an order form, or the Trust Center (trust.typesafe.ai).
The subprocessor list (trust.typesafe.ai/subprocessors) and Security Measures (trust.typesafe.ai) are referenced by the DPA but not captured; SSO, audit logs, and BAA availability also remain unaddressed.
Deletion or return of customer data at termination, deletion timeframes, and backup retention: not in the DPA or privacy policy; likely in the MCA.
Whether the DPA applies automatically to self-serve API and Playground accounts, or only to customers with a signed agreement: depends on the MCA's definition of 'Agreement'.
Answers to the enterprise FAQ (ZDR, where data is processed, VPC/on-prem deployment, BAA) were collapsed and not captured in the enterprise captured policy.
Whether humans review API Input for abuse or safety: the DPA is silent; possibly the MCA.
Provenance: the data-processing captured policy is a user-saved MHTML capture with an empty page title, not a direct fetch; worth re-fetching to confirm it matches the live page.
Documents read
-
Acceptable Use Policy
typesafe.ai captured 2026-11-08 sha256 2d7510eff31f -
Data processing
typesafe.ai captured 2026-11-08 sha256 b9f47b8c3726 -
Home
typesafe.ai captured 2026-11-08 sha256 b153b5decd67 -
Privacy policy
typesafe.ai captured 2026-11-08 sha256 ef41e3905165 -
Terms of use
typesafe.ai captured 2026-11-08 sha256 c9a83b8dab2c -
TypeSafe AI
typesafe.ai captured 2026-11-08 sha256 b6f3992336d5