Sora by OpenAI

"To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, marketing service providers, and information technology providers."

OpenAI shares personal data with a very broad range of third-party vendors and service providers, including marketing services, web analytics, and search/shopping partners.

"We determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to make your product experience better. In addition, some of our Services allow you to choose to provide more precise location information from your device, such as location information from your device's GPS."

OpenAI collects IP-based geolocation by default and can also collect precise GPS location data when users opt in through certain services.

"If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services. If any of your contacts aren't yet using our Services, we'll update you if they sign up for our Services later."

OpenAI uploads and retains users' entire device address books, including information about non-users, and monitors when those non-users eventually sign up.

"We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law."

OpenAI can change the privacy policy at any time by simply publishing an update on their website, with no requirement for user consent or direct notification.

"In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes. If specific Content, or your account, is banned because of violations of our usage policies, we may retain that data for to protect our services from fraud, abuse, or other violations of our policies."

Even after users delete their data, OpenAI retains personal data indefinitely for broad reasons including security, fraud prevention, and policy violations, with no specified maximum retention period.

"We collect information about your use and activity across the Services, such as the types of content that you view or engage with, the features you use and the actions you take. If you use the Atlas browser we may also collect your browser data according to your controls and use of the service."

OpenAI tracks user activity across their suite of services and products including ChatGPT, Sora, and the Atlas browser, collecting browsing data and usage patterns to build cross-service profiles.

"Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to improve our models."

Deletion takes up to 30 days, and data already used for model training remains as de-identified data permanently. Additional exceptions allow retention beyond 30 days for broad security and legal reasons.