Generor

GDPR overview

GDPR implementation is concrete and documented. The privacy policy names the controller as Alexiuz AS (Org.nr 918851933), Gamlegrensa 8A, 3747 Skien, Norway and states a legal basis article by article: contract (Art. 6.1.b), legitimate interest (Art. 6.1.f), consent (Art. 6.1.a). A section headed Your Rights (GDPR Art. 15-22) covers access, rectification, erasure, portability, objection and withdrawal of consent, and deleting the account cascades across every Alexiuz service. Servers are declared in Europe, processors outside the EEA are covered by Standard Contractual Clauses or equivalent safeguards, and those processors are named: ElasticEmail, Stripe, the AI model providers, Google AdSense. Advertising consent runs on a Google-certified IAB TCF v2.2 platform. Missing: no DPO, no Article 27 representative, no published DPA, no SOC 2 or ISO 27001 certification. Policy last updated 1 May 2026.

Who owns the data?

Alexiuz AS claims no ownership of what you generate: the terms state that content you create belongs to you, and the Content Rights page confirms that you retain all rights, title and interest in your creations. In return you grant the publisher a limited, non-exclusive, worldwide, royalty-free permission to host, store, reproduce and display that content, described as display-only and used solely to run the service; it ends when you delete a creation or make it private again, apart from caches and copies kept for legal or operational reasons. Publishing to a public gallery gives viewers no rights at all. Prompts are passed to third-party model providers such as OpenAI, Anthropic and Google to produce the output.

Reuse rights

You can reuse, publish, modify and sell your own creations without asking Generor for permission, and the platform imposes no commercial restriction of its own. The reservations come from the law rather than the publisher. The Content Rights page warns that copyright in AI-generated material is an evolving area of law that varies by jurisdiction, that purely AI-generated output may not be protectable at all, and that Generor makes no representation or warranty about the copyrightability of what you produce. A generation may unintentionally resemble a protected work, echo a trademark or logo, reproduce patterns learned from training data, or depict a real person; where output resembles protected third-party content, you have no right to use it. Checking that before publication, running clearance searches before commercial use and carrying the consequences are entirely your responsibility. The terms also make you warrant that your prompts and uploaded references infringe nobody's rights, while the Owned IP Greenlist lets you lift moderation on trademarks or characters you own by declaring that ownership under penalty of perjury.

Data retention & training

Hosting summary

The controller is Alexiuz AS, Gamlegrensa 8A, 3747 Skien, Norway, so the service sits under Norwegian law, with the court of Skien named as the venue. On location, the privacy policy says only that the servers are located in Europe: no country, no provider, nothing more precise. Third-party processors may handle data outside the EEA under Standard Contractual Clauses or equivalent safeguards. The named processors are ElasticEmail for email, Stripe for payments, the AI model providers (OpenAI, Anthropic, Google and others) for the generations themselves, and Google AdSense for advertising. Security measures are documented: passwords hashed with bcrypt, IP addresses hashed with SHA-256 where possible, 256-bit random session tokens, HTTPS enforced, and no card data stored, since Stripe handles payments end to end. The front end is served behind Cloudflare, whose anycast node resolves to a US IP address; that describes the CDN, not where data is stored. Not published: any data processing agreement, any SOC 2 or ISO 27001 certification, and any named hosting country.