GlobalGPT

GDPR overview

The site never writes the word GDPR — not in its pages, not in its markup. The framing is American: a dedicated CCPA section, Shine the Light rights, authorised agents. European law is nonetheless acknowledged in places. Section 2 of the privacy policy sets out legal bases — consent, performance of a contract, legitimate interest, legal obligation, vital interests — where European data protection law applies, and section 8 lists access, information, rectification, erasure, objection, restriction, portability, withdrawal of consent and complaint to a local authority. Transfers out of the EEA, Switzerland and the UK rely on the European Commission's standard contractual clauses, and the terms recognise the 14-day statutory withdrawal right for EU, UK and EEA consumers, citing Article 16(m) of Directive 2011/83/EU. Missing: any Article 27 representative, any named DPO, any DPA. A single address, productsupport@glbgpt.com, handles every privacy question.

Who owns the data?

The terms never say that you keep ownership of your prompts or of the outputs you generate; the question is simply not addressed. What they do settle is publication. Under clause 5.3.1, posting User Content grants the publisher a non-exclusive, royalty-free, sublicensable, worldwide licence with no time limit to access, view, use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, copy and display it, together with the right to use your name alongside that content. Clause 4 keeps the software and the site's own content with the publisher, its licensors and its third-party suppliers. Clause 9 then disclaims, in capitals, any responsibility for retaining customer data, while the privacy policy counts your prompts and uploaded files as personal data it collects.

Reuse rights

Section 2 of the privacy policy sets out what the data serves: running the service, managing accounts and payments, marketing by email and phone — third-party products included — targeted advertising, contests and referrals, usage analysis, feature testing, security and fraud prevention, and legal obligations. Section 3 permits sharing with named providers, "such as OpenAI, L.L.C., Google LLC, Anthropic, PBC", for research, analytics, advertising, authentication, payment collection, fraud detection and support, and also with companies under common control, marketing partners and sponsors, public authorities, and any acquirer in a merger, sale or bankruptcy. One line is drawn clearly in section 10: "We do not use user content to train AI models unless explicitly disclosed and permitted." Improvement data is anonymised or aggregated, and human review is confined to security, abuse and legal obligations. Marketing messages can be unsubscribed from, but the policy states that "we do not acknowledge or act upon browser-initiated Do Not Track signals", and a Facebook pixel runs on every page. Card details are not stored, payments being handled by third-party processors. As for reusing what you generate, the terms are silent: no clause assigns you the outputs, and none sets out what you may do with them.

Data retention & training

Hosting summary

GlobalGPT publishes no trust or security page and names no hosting country as such. The only statement on location sits in section 8 of the privacy policy: personal data may be transferred, stored and processed outside the country where it was collected, including in the United States and in other countries outside the EEA, Switzerland and the United Kingdom. For transfers out of those territories, the publisher says it relies on the European Commission's standard contractual clauses. There is no data-residency commitment and no region to choose. Two technical observations sit alongside that declaration, and slightly against it: the site's IP address resolves in Singapore (52.74.70.73, AS16509 Amazon), and static assets are served from s3.ap-southeast-1.amazonaws.com. These are measurements taken on the public website, not statements by the publisher about where accounts and conversations are stored, and they should not be read as such. In practice, anyone with a data-residency requirement will find nothing here that meets it.