Opinly

GDPR overview

Opinly publishes a substantial GDPR framework rather than a bare privacy notice: a privacy policy updated 20 July 2026, terms of service dated 30 April 2026, and a full Article 28 data processing agreement dated 15 June 2026. It names itself as controller, states that it is established in Northern Ireland, cites the ICO as lead supervisory authority, and sets out rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The DPA incorporates the EU Standard Contractual Clauses and the UK IDTA Addendum, commits to breach notification within 72 hours and grants an annual audit right. Two gaps are stated openly: no EU representative has been appointed under Article 27, the policy saying only that details will appear if one ever is, and there is no in-product cookie control, browser settings being the sole option offered.

Who owns the data?

You keep ownership of what you upload. Section 6.2 of the terms gives Opinly a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, modify and display your content, limited to operating, providing and improving the service. AI output generated for your account is delivered to you and is not shared with other customers. Opinly acts as data controller for account information and as processor for the customer data its pixel collects; when you are an agency working for your own clients, it becomes a sub-processor. Once the contract ends you choose, by written notice within thirty days, whether your data is deleted or returned.

Reuse rights

Opinly states that it does not use your content or the AI output it generates to train its own foundation models, and it contractually forbids its model providers, named as OpenAI, Anthropic, Amazon Bedrock and xAI, from training on customer data. It does reserve the right to use aggregated, anonymised or de-identified data for analytics, benchmarking and product improvement. The terms also warn that prompts sent to third-party providers may be stored transiently under those providers' own retention policies, which Opinly does not control. No opt-out switch is offered, since exclusion from training is the default rather than a setting. Personal data is not sold and is not shared for cross-context behavioural advertising. You may reuse the AI output you generate without asking permission, but you are solely responsible for reviewing, fact-checking and labelling it before publishing, and Opinly guarantees neither its accuracy nor its originality.

Data retention & training

Hosting summary

Hosting rests on Amazon Web Services, in the United States and in EU regions when the customer is based in the EEA or the United Kingdom. The application database is managed by PlanetScale in the United States, product analytics by PostHog in either the United States or the EU depending on configuration, and authentication, payments, messaging and error monitoring by Clerk, Stripe, Klaviyo and Sentry, mostly in the United States. Model inference runs with OpenAI, Anthropic, Amazon Bedrock and xAI in the United States. Transfers out of the UK and the EEA rely on the EU Standard Contractual Clauses and the UK IDTA Addendum, with supplementary measures where needed. Opinly documents TLS 1.2 or higher in transit, AES-256 at rest, multi-factor authentication on production access, segregated environments, encrypted backups and a documented incident response process; the analytics pixel hashes IP addresses before storage and collects no precise location. The publisher holds no security certification of its own and points instead to those of its sub-processors.