NBot

GDPR overview

There is no mention of the GDPR anywhere on this site. Searching the full text and the archived HTML of every page collected returns zero occurrences of GDPR, EEA, European Economic Area or Article 27. This is silence rather than a refusal: the company neither claims compliance nor denies it. The framework actually invoked is United States state privacy law, chiefly the California Consumer Privacy Act as amended by the CPRA, with named rights for residents of Colorado, Connecticut, Virginia, Oregon, Utah and Texas covering knowing, accessing, correcting and deleting personal information. Requests go to a single address, compliance@localaiapp.com, under the subject Privacy Law Request, and identity verification comes first. Data is stated to be processed in the United States. No EU representative and no data protection officer is designated. The privacy policy is dated 14 April 2025.

Who owns the data?

Local AI, Inc. operates the service and collects account details, device and usage signals, general location and any content a user posts. Users keep the ability to erase their personal data by deleting their account from the settings, or by writing to the compliance address if that fails. The point deserving most attention is publicity rather than ownership: the policy states that a username, the general location declared at registration, liked content and created content such as posts, comments or video are available to the public. A content provider a user follows can also see that user's account name, general location and profile picture. General location can be excluded from public comments in the settings.

Reuse rights

The published documents describe how Local AI, Inc. uses the information it collects rather than granting users any right to reuse the platform's content. Declared purposes cover operating and improving the service, personalising content and advertisements, marketing, internal research and development, quality control, security and legal compliance. Advertising partners receive device and usage data through embedded SDKs so they can bid on inventory and measure campaigns, and browsing activity may be matched across a user's devices. Aggregated or de-identified data may be used for any purpose and disclosed to third parties, advertisers included. Under the CCPA the company states that it has sold or shared identifiers and network activity information over the past twelve months; that disclosure can be refused through the About setting in the mobile application. Do Not Track signals sent by a browser are explicitly not honoured, although a legally recognised opt-out preference signal is.

Data retention & training

Hosting summary

The privacy policy states plainly that NBot is located in the United States and processes user data there. No alternative country or region is offered, and no residency option appears anywhere in the published material. The company reserves the right to subcontract processing to service providers and business partners in countries other than the user's country of residence, the United States included, without naming them: no subprocessor list is published. Security is described in general terms only — administrative, technical and physical measures — and the policy explicitly declines to guarantee it, noting that no method of transmitting or storing information is completely secure. There is no trust or security page, and no certification such as SOC 2 or ISO 27001 is displayed. As an observation rather than a company statement, a DNS lookup carried out on 11 August 2026 resolved the domain to an address in Amazon's network located in Boardman, Oregon, consistent with the declared United States jurisdiction.