AIOProductOS

GDPR overview

GDPR implementation is documented in detail rather than merely asserted. The privacy notice, updated 22 June 2026, maps each processing activity to an Article 6 lawful basis and a retention period, and lists seven data-subject rights by article: access (15), rectification (16), erasure (17), portability (20), restriction (18), objection (21) and withdrawal of consent (7). Requests go to office@aioproductos.com or to in-product settings, with a 30-day response commitment. An Article 28 Data Processing Addendum is published, subprocessors are listed publicly with 30 days' notice before any addition, and transfers outside the EEA rely on Standard Contractual Clauses. Two gaps are stated openly: no Data Protection Officer is designated, the company saying it falls below the Article 37 threshold, and no Article 27 EU representative is named even though the controller is established in Serbia, outside the EEA.

Who owns the data?

Ownership stays with the customer. AIOProductOS Inc. describes itself as controller only for its own users' account, billing, support, marketing and error-monitoring data. For the business data and end-user analytics it processes on behalf of client organisations it acts as processor, the client being the controller, with its duties fixed by an Article 28 Data Processing Addendum published in self-serve form. Customers can export an entire organisation as JSON and CSV on every tier, not only at enterprise level, and import is one-way so the source tools are never written to. At the end of the contract the vendor deletes or returns the data at the customer's choice, subject to legal retention.

Reuse rights

Customers keep full reuse rights over their own data and need no permission to exercise them. An owner or admin can export the whole organisation as JSON and CSV at any time, on any tier, which the vendor frames as a deliberate stance against lock-in and describes as leaving with no exit tax. Connectors read from source systems only, so nothing is written back into the tools the data came from. On the vendor's own side, permitted use is narrower than ownership: the privacy notice states that personal data is not sold, that no third-party advertising trackers run, and that Global Privacy Control signals are honoured automatically. Customer content feeds no model training and no fine-tuning, serving only to produce the immediate response, and where the vendor acts as processor it processes solely on the customer's documented instructions.

Data retention & training

Hosting summary

AIOProductOS runs two separate regions on the same schema: an EU project on eu-central-1 and a US project on us-east-1. The customer picks one at signup, based on where the company is, and the choice is enforced where data enters the system; afterwards it is invisible, appearing in no URL, key or screen. Residency is included on every plan from 199 US dollars a month, and the Enterprise tier adds contractual region pinning. Infrastructure resolves to Amazon (AS16509), with the marketing domain answering from an anycast address geolocated in the United States. Some subprocessors are US-based or process data outside the EEA; the safeguard invoked is the Standard Contractual Clauses, and Serbia, where the controller is established, is itself treated as a third country for transfers out of the EEA. The current subprocessor list, with name, purpose, country and safeguards, is published on the vendor's status subdomain and changes are announced 30 days in advance. Tenants are isolated by an organisation identifier and row-level security, with encryption in transit and at rest.