Pictory's 2026 privacy policy rewrite materially broadened training-use rights (now 'without limitation...for commercial purposes' on aggregated data) while simultaneously removing the 12-month account-deletion timeline and replacing it with discretionary 'as long as needed' retention. Legal terms impose mandatory arbitration with liability capped at the greater of $100 or 6 months of fees, effectively preventing class actions and leaving consumers with minimal recourse for systemic data-handling violations.

Request explicit opt-out from aggregated commercial-data use if Pictory offers enterprise plans with carve-outs (check separately); review the Terms of Service carefully before agreeing, as the binding-arbitration clause is the primary lever for disputes. SOC 2 Type II and ISO 27001 certifications provide some assurance on operational security; request a Data Processing Addendum (DPA) if using Pictory for any sensitive customer data, and verify deletion timelines contractually rather than relying on the vague policy language.