Eulex

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, effective 5 June 2026, names its Article 6 legal bases: contract 6(1)(b), legitimate interest 6(1)(f), consent 6(1)(a) and legal obligation 6(1)(c). Section 2 separates the two roles, controller for the publisher's own purposes and processor for customer tenant data. Rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent are exercised at dpo@augment.hr, with a 30-day target response extendable to 60 days for complex cases, plus the right to complain to a supervisory authority. Storage and processing are intended to remain in the EEA, otherwise standard contractual clauses, an adequacy decision or supplementary measures apply. Security measures include encryption in transit and at rest, MFA for administrator access, environment segregation, access controls and logging. A public DPA dated 26 January 2026 gives 30 days' notice of new subprocessors. Established in Croatia, the publisher needs no Article 27 representative.

Who owns the data?

The customer keeps ownership of inputs and outputs. Clause 5.1 of the terms states that, as between the parties, you retain all rights you have in Customer Content, and clause 6.1 lets you use the Output for your internal professional purposes. The licence granted to Augment d.o.o. is narrow: hosting, storing, reproducing, transmitting and processing content only as needed to run the service, plus quality assurance and troubleshooting, the latter only if prompt logging is on. Augment retains the service, its documentation and the underlying technology (6.2) and takes a perpetual, irrevocable licence over feedback (6.3). Under the DPA, the customer is controller and Eulex processor.

Reuse rights

You may reuse your own material and the generated output for internal professional purposes without asking further permission, subject to the terms' professional-use restriction and to the publisher's warning that output is not legal advice and must be checked. On the publisher's side, the privacy policy lists the purposes in section 5: providing and operating the service, administering invitation and beta access, security and abuse prevention, improvement and diagnostics, support, and legal obligations. It states that personal data is neither sold nor used for consumer advertising profiling. Section 8.1 confirms that external AI providers generate answers and analyse documents, with minimisation and pseudonymisation where possible and contractual and technical controls limiting provider-side retention and training. Section 8.2 covers the Prompt Navigator: the service decides whether a web search is useful, the user sees a switch and can turn it off, and when it is on only an AI-rewritten, summarised query is sent. Section 8.3 states that prompt logging is off by default and only stores prompt and output logs once the user enables it. Clause 5.2 of the terms rules out training general-purpose models on Customer Content unless the customer expressly agrees in writing.

Data retention & training

Hosting summary

The publisher states that infrastructure runs on EU-region cloud services and that data does not leave the EU, a claim repeated on the homepage and the MCP connector page. Section 9 of the privacy policy is more nuanced: storage and processing are intended to take place in the EEA, but some providers may process outside it depending on their own infrastructure, notably for web search, analytics, monitoring and security. The published subprocessor list, dated 5 June 2026, names Google Cloud Platform, Brevo and Simple Analytics as core providers in the EU, and OpenAI with an EU endpoint, plus Exa and Tavily, as optional ones that may involve locations outside the EEA. Sections 6 and 12 of the DPA go further: Vertex AI inference on customer content is configured on an EU region endpoint, currently europe-west1 or europe-west4 or a successor EU region, and Google's global endpoint is excluded, with limited derogations for security, customer configuration or legal requirements. No individual hosting country is named, only the EU region.