Cloud server host Vultr rips user data licensing clause from ToS amid web 'confusion'

We know the average customer doesn't have a law degree, CEO tells us

Updated Cloud server provider Vultr has rapidly revised its terms-of-service after some netizens were alarmed by clauses that broadly demanded the "perpetual, irrevocable, royalty-free" rights to customer "content."

The red tape was updated in January, as captured by the Internet Archive, and this month users were asked to agree to the changes by a pop-up that appeared when using their web-based Vultr control panel.

That prompted folks to look through the terms, and there they found clauses that granted the US outfit a "worldwide license ... to use, reproduce, process, adapt ... modify, prepare derivative works, publish, transmit, and distribute" user content.

It turned out these demands have been in place since before the January update; customers have only just noticed them now. Given Vultr hosts servers and storage in the cloud for its subscribers, some feared the biz was giving itself way too much ownership over their stuff, all in this age of AI training data being put up for sale by platforms.

We do not use user data. We never have, and we never will

In response to online outcry, largely stemming from Reddit, Vultr in the past few hours rewrote its ToS to delete those asserted content rights.

Vultr CEO J.J. Kardwell told The Register earlier today it's a simple case of standard legal boilerplate being taken out of context.

"We do not use user data," Kardwell stressed to us. "We never have, and we never will. We take privacy and security very seriously. It's at the core of what we do globally."

The controversial wording appeared under section 12 of the ToS, which up until now read like this:

You hereby grant to Vultr a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide license (including the right to sublicense through multiple tiers) to use, reproduce, process, adapt, publicly perform, publicly display, modify, prepare derivative works, publish, transmit and distribute each of your User Content, or any portion thereof, in any form, medium or distribution method now known or hereafter existing, known or developed, and otherwise use and commercialize the User Content in any way that Vultr deems appropriate, without any further consent, notice and/or compensation to you or to any third parties, for purposes of providing the services to you.

User content was defined as "the information, text, opinions, messages, comments, audio visual works, motion pictures, photographs, animation, videos, graphics, sounds, music, software, apps, and any other content or material that you or your end users submit, upload, post, host, store, or otherwise make available" using Vultr's resources.

According to Kardwell, the content clauses were supposed to cover things like support forum posts and one's use of the Vultr website, rather than private user data deployed in its cloud. He emphasized the last line of the relevant fine print: "... for purposes of providing the services to you."

He also pointed out that the wording had been that way for some time, and added the prompt asking users to agree to an updated ToS was actually spurred by unrelated Microsoft licensing changes.

In light of the controversy, Vultr vowed to remove the above section to "simplify and further clarify" its ToS, and has indeed done so. In a separate statement, the biz told The Register the removal will be followed by a full review and update to its terms of service.

"It's clearly causing confusion for some portion of users. We recognize that the average user doesn't have a law degree," Kardwell said.

"We're very focused on being responsive to the community and the concerns people have and we believe the strongest thing we can do to demonstrate that there is no bad intent here is to remove it." ®

Updated to add on March 29

Vultr has popped a detailed notice on its website stating its position in this whole affair, which it summarized thus:

A Reddit post incorrectly took portions of our Terms of Service out of context, which only pertain to content provided to Vultr on our public mediums (community-related content on public forums, as an example) for purposes of rendering the needed services – eg, publishing comments, posts, or ratings. This is separate from a user’s own, private content that is deployed on Vultr services.

"Vultr has never claimed any rights to, used, accessed, nor allowed access to or shared your content, other than as may be required by law or for security purposes," it added.