DomoAI

GDPR overview

DomoAI never states, in so many words, that it complies with the GDPR — which is why this record marks the compliance flag as No. What it does publish is more substantial than silence: a privacy policy dated 3 April 2026 granting access, portability, rectification, erasure, restriction, objection and consent withdrawal; standard contractual clauses and adequacy decisions for international transfers; a reminder that EU users may complain to their local supervisory authority; and a named subprocessor list in the API documentation. The gaps are equally clear. Those rights are introduced with "depending on your location" rather than granted outright, no Article 27 EU representative is designated, no data protection officer is named, no customer-facing DPA is offered, and the only reference to the GDPR itself concerns obligations imposed on subprocessors. Governing law is Singapore.

Who owns the data?

DomoAI's terms draw a clean line. You keep ownership of everything you upload, and you keep ownership of everything the models generate from it; uploading grants DomoAI only the licence it needs to process your files and return an output. Generated content carries your copyright and may be exploited commercially, provided you respect applicable law and third-party rights, and the homepage FAQ restates that in plainer words. One reservation sits beside that grant: DomoAI keeps the right to use anonymised and aggregated data to improve its services. The ownership promise therefore covers your identifiable material, not the statistics derived from how you use the platform.

Reuse rights

End users may reuse what they generate without asking DomoAI for anything: the terms assign the output to the person who created it and explicitly permit commercial use, including advertising, client work and monetised social content. The only conditions are legal ones — you must hold the rights to whatever you upload, you must not depict real people without consent, and you carry sole responsibility for the lawfulness of what you publish. On DomoAI's own side, the privacy policy lists account details, uploaded content, usage data, device identifiers and payment tokens among the information collected, used for delivering and improving the service, billing, fraud prevention, analytics and targeted advertising. Individual content is not used to train the models without explicit consent; anonymised, aggregated data may be, and DomoAI does not sell or rent personal information.

Data retention & training

Hosting summary

DomoAI publishes no hosting page; the substance sits in the subprocessor list of its API documentation, which names three providers and their locations. Cloudflare handles content delivery, DDoS protection and web security across the United States and a global edge network, processing API requests, responses and IP addresses. Tencent Cloud supplies computing and storage in the United States, and handles generated video files and user content — so the material users actually care about rests there. OpenAI, also in the United States, processes text prompts, generation parameters and content submitted for moderation. Every declared location is therefore American, and nothing on the site offers European residency or a choice of region. International transfers are covered by standard contractual clauses, adequacy decisions and other recognised mechanisms. The security measures claimed are encryption in transit and at rest, regular assessments and audits, access controls, staff training and incident response procedures, alongside the usual caveat that no transmission method is entirely secure.