PopAi

GDPR overview

The word GDPR never appears in PopAi's documents, and compliance is nowhere claimed in so many words. The substance is partly there: a dedicated section for EEA, UK and Swiss users sets out three legal bases — performance of the contract, legitimate interests and consent — with a right to withdraw consent, and a rights section covers the right to know, access and portability, deletion and correction, exercised by emailing customerservice@popai.pro, with a right of appeal. A separate section addresses California's CPRA. What is missing matters as much: no Article 27 EU representative, no named data protection officer, no data processing agreement, no named subprocessors, and no transfer mechanism such as standard contractual clauses for the declared transfers to servers in the United States and Singapore. The publisher is established in Singapore, outside the EU.

Who owns the data?

The terms define your inputs and the generated outputs together as Your Content, and state plainly that you retain ownership of it. You are also responsible for it, including holding whatever rights and licences its use requires. PopAi keeps the right to block, remove or permanently delete Your Content if it breaches the terms or its policies. Ownership of the service itself does not transfer: 01.AI PTE. LTD and its providers retain all rights, titles, interests and intellectual property in the platform, and you receive only a personal, non-exclusive right to use it. Nothing in the terms grants you any stake in the underlying models or software.

Reuse rights

Because you keep ownership of both what you upload and what the tool generates, you may reuse your decks, documents and images without asking permission, commercially included, subject to the general requirement that the content be lawful and that you hold the rights to the material you fed in. The terms bar two specific reuses: extracting output to build products or models that compete with PopAi, and scraping or harvesting the service. On PopAi's own side, the privacy policy lists providing and improving the service, research, security, legal compliance and enforcement of the fair-usage rules, and it names affiliates plus categories of providers — LLM vendors, cloud, IT, email and analytics — as recipients. Note a genuine contradiction: the marketing FAQ says personal and business data is never used to train PopAi's models, while the privacy policy counts training its models among the legitimate interests that may process Content.

Data retention & training

Hosting summary

The privacy policy states that personal data may be transferred to PopAi's servers in the United States or Singapore. No EU hosting option is offered and no region can be selected. PopAi commits to a standard of protection comparable to that of the user's own jurisdiction, but names no legal mechanism for the transfer — there is no reference to standard contractual clauses or any equivalent. Uploaded files are described as encrypted and securely stored, and the Google Play data-safety entry confirms encryption in transit; the site nonetheless advises against uploading documents containing highly sensitive personal information. Network checks place the site behind Amazon CloudFront, with assets served from Amazon S3 in the Singapore region. No security certification such as SOC 2 or ISO 27001 is cited anywhere. Third-party processors are described only by category — LLM providers, cloud services, other IT services, email software and analytics — with none named and no subprocessor list published. The publisher is established in Singapore, so EU data protection law applies only through its extraterritorial reach.