NinjaChat

GDPR overview

The privacy policy devotes a section to EEA, UK and Switzerland (GDPR). It grants access, rectification, portability, erasure, restriction and objection rights, and names the legal bases relied on: consent for account creation and for sharing content with the AI providers, and legitimate interests for analytics and product and model improvement. Rights are exercised by writing to team@ninjachat.ai. A separate section covers California residents under the CCPA. What is absent matters as much: the site never states in so many words that it is GDPR compliant, designates no EU representative under Article 27, names no data protection officer, offers no Data Processing Agreement, and discloses no hosting country or region. The policy is dated 31 July 2026.

Who owns the data?

Under the terms of service you keep the rights to the content you create with NinjaChat, provided you comply with those terms and with the underlying model providers' conditions, and you are responsible for holding the rights to anything you upload. The privacy policy states that staff have no routine access to individual conversations, and that a member of the team may look at specific content only in four cases: when you share a conversation link yourself, during an abuse investigation, to meet a legal obligation, or to keep the service secure. Helium Technologies states twice that it does not sell personal information. Conversations, images, videos and mind maps can be exported, and deleting the account removes the associated data within thirty days.

Reuse rights

You may reuse what you produce without asking permission: the intellectual property clause confirms that rights in the content you create stay with you, subject to the terms and to each model provider's own conditions. The reverse does not hold — NinjaChat's brand, software and features may not be reproduced, modified or turned into derivative works without written permission, and you are solely responsible for what you generate and for anything your integrations and automations do. The vendor's own use of your data is broader than the export rights suggest. The privacy policy effective 31 July 2026 says the content of your interactions, including the AI's replies, may be processed and used by NinjaChat and by its AI providers to operate, evaluate and improve their models, explicitly including model training and refinement, and the terms of service repeat this. Data pulled from connected accounts such as Gmail, Google Calendar, Drive or Notion is the stated exception and is not used for training. De-identified and aggregated data may be used for any purpose. Copyright complaints go to team@ninjachat.ai, and the vendor's liability is capped at the amount you have paid.

Data retention & training

Hosting summary

No hosting country or region is disclosed anywhere on the site, which is the most significant point for anyone with data residency obligations. What the privacy policy does describe is the infrastructure: all data, including conversations, account information and uploaded files, is stated to be encrypted at rest and in transit. Chat messages are stored encrypted in the database; files and media are stored encrypted on Cloudflare R2 and reachable only through authenticated requests. Database connections are encrypted, and access controls are said to limit which staff can touch production data. MongoDB, Upstash and Resend are named among the services used, alongside a long list of AI providers that receive interaction content. No Data Processing Agreement is published or offered, and no EU representative is designated. The site's IP address resolves to an anycast CDN node, which says nothing about where data actually rests.