This is a print-friendly report. Click Print and choose “Save as PDF” in the destination dropdown to download.

SaaSGuard Risk Report

Hugging Face

huggingface.co

Generated May 4, 2026

Grade F

Score: 37 / 100

Executive summary

We analyzed Hugging Face’s Terms of Service across 8 risk dimensions and found 13 flagged clauses across 8 categories.

Flagged clauses by category

AI training on your data (2)

  • Severity 5 · egregious

    If you provide us feedback regarding the use, operation, performance, or functionality of our Website, Services, or business (collectively, "Feedback"), you hereby grant us a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive right and license to exploit and commercialize the Feedback, improve the Services, and develop and/or commercialize new offerings, which we will solely and exclusively own.

    Hugging Face can use any feedback you give them about their services to improve their products, develop new ones, and even sell them, and they will own all rights to it.

    You give up all rights to any ideas or suggestions you share, which Hugging Face can then profit from without compensating you.

    Matches Authors Guild v. OpenAI (2023)

  • Severity 5 · egregious

    In addition and subject to our Privacy Policy, we may aggregate, anonymize, or otherwise learn from data relating to your use of the Services, and use the foregoing to improve those Services.

    Hugging Face may collect and use data about how you use their services, anonymizing it to improve their offerings.

    Your usage data may be used to train models that benefit other users, and you have no control over this process.

    Matches The New York Times Co. v. OpenAI & Microsoft (2023)

Auto-renewal traps (1)

  • Severity 3 · notable

    We may change or update the Terms from time to time. Changes will be effective 10 days following posting on the Website. If you continue using the Services 10 days following such posting, that means you accept those changes.

    Hugging Face can change their terms of service with 10 days' notice, and continuing to use their services means you agree to the new terms.

    You could unknowingly agree to new terms that negatively impact your usage or data rights.

Surprise price hikes (1)

  • Severity 3 · notable

    We reserve the right to adjust our pricing from time to time and at our sole discretion. In such event, prices will remain fixed during the term of your initial subscription, and adjusted fees will be applicable only after the term of your new subscription.

    Hugging Face can change their prices at any time, but new prices only apply after your current subscription term ends.

    You could face a price increase on your next renewal, and you won't know the new cost until it's time to pay.

    Matches Netflix Price Hike Class Action (2023)

Data residency (1)

  • Severity 3 · notable

    We may assign or transfer all or part of our rights and obligations under these Terms to an affiliate, successor or any other entity or person without obtaining your prior written consent.

    Hugging Face can transfer your data and obligations to another company without your permission.

    Your data could end up with a different, potentially less secure, vendor without your explicit consent.

    Matches Irish DPC v. Meta Platforms Ireland — settled for $1300M (2023)

Termination friction (2)

  • Severity 3 · notable

    Upon cancellation of your Account, we will use commercially reasonable efforts to delete your information and Content of your own Repositories, whether public or private, within 90 days. We will not delete the Content that you contributed to other Users' Repositories, or copies made by us or other Users.

    When you cancel, Hugging Face will try to delete your data within 90 days, but they won't delete content you contributed to others' projects or copies they made.

    Some of your data may remain on their servers indefinitely, even after you've cancelled your account.

    Matches Bungie / Destiny 2 Account Termination Litigation (2023)

  • Severity 3 · notable

    We also reserve the right to retain your information for legal or regulatory compliance, pursuant to standard archiving, recovery, and back-up processes and practices, and pursuant to our Privacy Policy.

    Hugging Face can keep your information for legal reasons or to follow standard archiving and backup procedures.

    Even after cancellation, Hugging Face may retain your data for compliance or operational reasons.

    Matches Bungie / Destiny 2 Account Termination Litigation (2023)

Liability caps (2)

  • Severity 4 · material

    Neither of us (or any of our affiliates, subsidiaries, contractors, licensors, officers, directors, agents, or employees ("Related Parties")) will be liable for any indirect, incidental, consequential, punitive, special, or other similar damages, including loss of revenue, profits, data, benefits, or savings, whether or not due to the fault or negligence of the company or related parties, and regardless of whether either of us or our related parties have been advised of the possibility of such damages or losses.

    Neither you nor Hugging Face are liable for indirect, consequential, or punitive damages like lost profits or data loss.

    If Hugging Face's service causes you significant financial loss, you cannot recover damages beyond what's covered by their limited liability clause.

    Matches Capital One Data Breach Class Action — settled for $190M (2022)

  • Severity 3 · notable

    Either Party’s (and each Related Party’s) aggregate liability to the other Party or any third party in any circumstance will not exceed the amount that you paid us during the 12-month period immediately preceding the last claim (or $50 if relating to a free service).

    If you sue Hugging Face, their total liability to you is capped at the amount you paid them in the last 12 months, or $50 for free services.

    If their service causes you major financial harm, you can only recover a small fraction of your losses.

    Matches Capital One Data Breach Class Action — settled for $190M (2022)

Indemnification (1)

  • Severity 4 · material

    You are solely and exclusively responsible for your use of the Services! In this regard, you agree to indemnify, defend and hold harmless us and Related Parties from all claims, liability, and expenses, including attorney's fees, arising out or in connection with your use of (or inability to use) the Services, including but not limited to your violation of these Terms, applicable law or regulation, any Content or data posted or used by you, or any other party's use of any Service with your credentials, unless arising directly from Hugging Face’s fraud, gross negligence, recklessness, or willful or criminal misconduct, provided that we provide you with (i) a prompt written notice of the claim, demand, suit or proceeding, (ii) sole control of the defense and settlement of the claim, demand, suit or proceeding, and (iii) all reasonable assistance and cooperation in connection with the defense and settlement of the claim, at its own expense.

    You must defend Hugging Face against any claims arising from your use of their services, unless the claim is due to their own fraud or negligence.

    You could be forced to pay legal fees and damages for issues caused by your use of Hugging Face's platform.

    Matches T-Mobile Data Breach Settlement — settled for $350M (2022)

Right to silently change terms (3)

  • Severity 4 · material

    We may change or update the Terms from time to time. Changes will be effective 10 days following posting on the Website. If you continue using the Services 10 days following such posting, that means you accept those changes.

    Hugging Face can change their terms of service with 10 days' notice, and continuing to use their services means you agree to the new terms.

    You could unknowingly agree to new terms that negatively impact your usage or data rights.

    Matches Italian DPA (Garante) v. WhatsApp — settled for $6M (2022)

  • Severity 4 · material

    We may subcontract all or part of our obligations under these Terms at our own discretion, and without notifying you.

    Hugging Face can hire other companies to perform their obligations under the contract without telling you.

    Your data and service experience could be handled by third parties you haven't vetted or approved.

    Matches Italian DPA (Garante) v. WhatsApp — settled for $6M (2022)

  • Severity 4 · material

    We may at any time modify, suspend, or discontinue, temporarily or permanently, the Services (or any part thereof) with or without notice. You agree that we will not be liable to you or to any third party for any modification, suspension or discontinuance of the Services.

    Hugging Face can modify, suspend, or stop offering their services at any time, with or without notice, and they won't be liable for any resulting issues.

    The services you rely on could be changed or discontinued without warning, leaving you without a solution.

    Matches X Corp. Verified User Class Action (2024)

Methodology

SaaSGuard uses an automated pipeline: a daily Playwright crawler captures each vendor’s public Terms of Service, Privacy Policy, and DPA. Google’s Gemini 2.5 Flash classifies each clause into one of 8 risk categories with a severity score (1–5). Clauses are cross-referenced against a curated database of real lawsuits and FTC actions via embedding-based similarity matching. Grades are computed from per-category max severity; full source code is available on request.

Built for educational and informational purposes. Not legal advice. Always have your own counsel review SaaS contracts before signing.

View live page →