Extropic

GDPR overview

Compliance is claimed but barely documented. The privacy policy states, in a single line under Additional Considerations, that Extropic complies with international data protection regulations like GDPR and CCPA. Explicit consent is claimed for collection linked to communications and community activities, and section 5 sets out access, correction and deletion rights. Section 6 mentions that data may be transferred internationally adhering to global data protection standards, without naming a single mechanism: no standard contractual clauses, no adequacy decision. Everything else a documented GDPR programme would show is absent: no data protection officer, no dedicated privacy email address, no Article 27 representative in the EU, no published list of sub-processors, no retention period, and no effective date or last-updated date on the policy itself.

Who owns the data?

Extropic keeps ownership of everything on its side. Section 3 of the terms of service states that Extropic retains all rights to its technology, including but not limited to AI models, algorithms, and software, and grants users only a non-exclusive, non-transferable right of use, with no transfer of ownership. On personal data, the privacy policy lists names, email addresses and contact details, community interaction data, and technical data such as browser and operating system. It states that data is not shared with third parties, apart from service providers bound by confidentiality clauses and legal obligations, and that access is limited to authorised personnel. Note the scope: these documents describe a community and open source relationship, not a SaaS product.

Reuse rights

The terms of service (section 2) require use that is consistent with the intended purpose, respectful and lawful, and prohibit any misuse of Extropic's technological or computing resources. Section 3 grants a non-exclusive, non-transferable right of use with no ownership of the intellectual property, so the technology itself may not be redistributed or passed on without permission. On personal data, the privacy policy (section 5) gives users the right to request access, correction and deletion through the contact channels provided. What the documents do not cover is the reuse of any outputs or results: the case is simply not addressed, so nothing on the site authorises or restricts it. On the code side, THRML is published in a public GitHub repository (github.com/extropic-ai/thrml), but its licence was not collected, and the exact reuse terms of the code should be checked in the repository itself.

Data retention & training

Hosting summary

The site gives no hosting location. No country and no region is named for where user data is stored. The privacy policy (section 6) mentions that data may be transferred internationally while adhering to global data protection standards, but names no destination country and no transfer mechanism. Section 4 announces secure storage and regular audits, with no infrastructure detail whatsoever: no provider, no data centre, no region. No sub-processor is named anywhere on the site. A network lookup places the website itself on an anycast node, with an A record at 75.2.60.5 belonging to AS16509 Amazon.com Inc. and geolocated in Seattle, United States. That describes how the extropic.ai site is delivered, not where user data is hosted, and the two should not be confused. Anyone with a jurisdictional requirement will have to ask contact@extropic.ai directly, because the published documents answer none of it.