Factory

GDPR overview

GDPR implementation is documented rather than merely claimed. The security page carries a GDPR badge beside SOC 2, ISO 42001 and CCPA, and a full data processing agreement is published, dated 15 July 2026, incorporating the EU standard contractual clauses of decision 2021/914 together with the UK Addendum. A Data Protection Officer is designated and reachable by email for UK and European residents. The privacy policy, last updated 29 April 2026, states its legal bases, grants access, portability in CSV or JSON, erasure and complaint rights, and names the CNIL as a supervisory authority. Authorised sub-processors are listed, changes are notified, and customers may object within ten days or audit compliance annually. No Article 27 representative in the Union is named anywhere on the site.

Who owns the data?

The customer keeps every right in its own data and in the outputs the agents produce, and the pricing FAQ is blunt about the code itself: you retain full ownership and may use it commercially. Factory keeps the rights to the service, its software and the intellectual property behind it. Two carve-outs matter. Factory may internally use and modify customer data, without disclosing it, to run the service and to build aggregated de-identified data, which it is then free to use, keep and share for its own business purposes. Feedback sent to Factory is licensed to it worldwide, perpetually and irrevocably. The security page adds that customer code is never used as training data.

Reuse rights

Reuse is unrestricted on the customer side: the code a Droid produces belongs to the customer outright, who may ship it, sell it and build on it commercially without asking Factory for permission. Two duties come with that freedom. The customer alone answers for the accuracy, legality and licensing of whatever it feeds into the service, and the terms state plainly that outputs come out of machine learning processes, are neither tested nor guaranteed, and must be reviewed independently before use. Personal data can be exported in CSV or JSON on request, or erased by writing to the address published in the privacy policy.

Data retention & training

Hosting summary

By default, personal data sits on Amazon Web Services servers in US West and all processing happens in the United States, inside a sandboxed single-tenant environment with its own VPC. Data is encrypted with AES-256 at rest and TLS 1.2 or above in transit. Enterprise customers with European requirements can be provisioned on a dedicated EU deployment, fully isolated from the global one, whose backend, database and inference endpoints all sit in Europe; session content, prompts, assistant messages, tool calls and git AI notes stay there, and LLM requests from EU organisations never transit US infrastructure. Organisation records, user profiles and billing data remain in the global US deployment even then, and carry no user-generated content. Each organisation is pinned to a region at creation and mismatches fail closed. Hybrid and fully airgapped patterns keep all traffic inside the customer's own network. Transfers outside the EEA rely on the EU standard contractual clauses and the UK Addendum.