Canonity

GDPR overview

GDPR treatment is explicit rather than implied. The privacy page carries a structured summary naming Canonity SRL, Via Valdemone 31 in Palermo, as controller, with privacy@canonity.com for requests and a thirty-day response commitment. Rights under Articles 15 to 22 are listed individually, and the Italian supervisory authority, the Garante per la Protezione dei Dati Personali at Piazza di Monte Citorio 121 in Rome, is named for complaints. Infrastructure is stated to sit in the EEA, and transfers outside the European Union are framed as a consequence of the model provider you select. The minimum age is 18. Two gaps deserve mention: no Data Processing Agreement is offered or described as available on request, and the publisher claims no security certification of its own. Being established in Italy, it needs no Article 27 representative, and none is named.

Who owns the data?

Canonity presents itself as a technical intermediary rather than an owner of content. Its terms make you the party who decides which provider is used and what is sent to it, and you carry responsibility for copyright and GDPR compliance on those choices. For prompts and outputs routed to a model, Canonity states that it acts as your data processor. For its own account records, including email, name, hashed password, billing data and technical logs, Canonity SRL is the controller, reachable at privacy@canonity.com. Stored content is encrypted at rest with a key derived per user and per file path, and the master key sits on backend infrastructure kept separate from the application servers.

Reuse rights

Canonity claims no ownership over what you produce with it, and nothing in the terms requires you to ask permission before reusing your own output. From the Pro plan onwards you are explicitly invited to sell the execution of a workflow through the u-prompt marketplace without exposing the source prompt. What leaves the platform is narrow: only prompt text and technical parameters reach the model provider, while your IP address, email, payment details and device information do not. Canonity states that it has no model of its own, does not train, does not sell data, does not run behavioural advertising and does not monitor prompt content. The provider you select, however, applies its own rules, and the privacy page records them: DeepSeek, Moonshot AI and Zhipu AI train on submitted data, xAI may use it for improvement, and Anthropic offers an opt-out. Choosing a non-EU provider is presented as accepting that transfer.

Data retention & training

Hosting summary

Canonity states that its own infrastructure sits inside the European Economic Area, at OVH, across France, Germany and Poland; the site's public address resolves to an OVH range in Frankfurt, Germany. Content stored on the platform, meaning chats, executions and uploaded files, is encrypted at rest with a key derived for each individual file from the user identifier and the file path, while the master key is held on backend infrastructure separate from the application servers and never exposed to the browser. Data leaves that perimeter as soon as a prompt is sent to a model, and hosting then follows the provider chosen, which the privacy page maps explicitly: Mistral in France, OpenAI, Anthropic and xAI in the United States, Google in the United States or the European Union, Alibaba in Singapore or China, and DeepSeek, Moonshot AI and Zhipu AI in China. The publisher warns in its own words that data held under Chinese law may be subject to government access. No paid data-residency option exists: the wording appears only on a home page plan grid that cannot be purchased.