Samsa

GDPR overview

Concrete and unusually well documented. As a Swiss company, Samsa Labs AG applies the Swiss FADP and, where applicable, the GDPR, noting the European Commission's adequacy recognition for Switzerland. The privacy policy, version 1.3 effective 1 August 2026, lists its legal bases under Article 6(1)(a) to (f) and enumerates data subject rights including access, rectification, erasure, restriction, portability and objection, naming the Swiss FDPIC as supervisory authority. A data protection officer is designated by name. A 15-page data processing addendum is published openly as a PDF, drafted against Article 28(3) and (4) GDPR, with a 48-hour breach notification commitment and standard contractual clauses under Article 46(2) for transfers outside the EEA. Compliance with Article 50(2) of the EU AI Act is implemented through machine-readable content marking. One gap: no Article 27 representative is named, although the company is established outside the EU.

Who owns the data?

Under the general terms, intellectual property in the prompts and datasets a customer uploads (the Input) stays with that customer, and the images and videos produced (the Output) belong to the customer as between the parties. Two reservations narrow this considerably. Samsa Labs AG may use both Input and Output without restriction and irrevocably for internal purposes such as research, development and improvement of the service, and may use them externally only in anonymised, aggregated form. Separately, all rights in the service itself, expressly including the algorithms trained on the basis of Input and Output, remain the property of Samsa. Ownership of the files is therefore the customer's; ownership of what the vendor learns from them is not.

Reuse rights

Customers receive commercial usage rights over everything they generate, with no separate permission required: images and videos can be used in campaigns, advertising, packaging and any business context. That grant is conditional. The customer must hold the appropriate copyright or intellectual property licences for every image in the training set, and must have obtained the consents of any employees or third parties depicted; without those, the commercial grant does not apply. On the vendor side, the pricing FAQ states that uploaded assets serve only the customer's own model training, that they are never used to train or optimise other users' models, and that strict isolation is maintained between accounts. The binding terms are broader than that promise, permitting unrestricted internal reuse. Inference itself is carried out by named third parties, so prompts and results are transmitted to them temporarily. No opt-out mechanism is offered to the user.

Data retention & training

Hosting summary

Customer data, account information and generated content are stored in data centres in the European Union, principally in Frankfurt, Germany. Object storage, server infrastructure, the database and authentication layer, and the C2PA signing service all report Frankfurt as their server location. Additional infrastructure providers are named for storage and hosting. The publisher is established in Switzerland, so processing falls under Swiss data protection law and, where applicable, the GDPR, with the European Commission's adequacy recognition for Switzerland cited explicitly. One nuance matters. AI inference is partly performed outside the EU, notably in the United States. During inference, prompts, input media and generated results are transmitted to those providers and processed temporarily, with final storage returning to the EU infrastructure. Cross-border transfers rely on standard contractual clauses under Article 46(2) GDPR, and the addendum limits transfers to countries where the processor or an approved subprocessor is registered. The public content detector processes submissions only transiently in memory, with zero retention and no logging of IP address, user agent or file name.