DataGrout

GDPR overview

Implementation is partial, and compliance is never claimed. The privacy policy, effective 27 January 2026, acknowledges that citizens of the European Union hold additional rights under the GDPR and points them to info@datagrout.ai, but nowhere does DataGrout state that it complies with the regulation. Access, correction and deletion are offered by email. No EU representative under Article 27 is designated and no data protection officer is named. Transfers to affiliates and providers in countries with weaker protection are announced without naming any mechanism such as standard contractual clauses. A data processing addendum sits in Exhibit A of the EULA for customers under a purchase order. Governing law is Texas, and US state regimes such as CCPA, CPRA, VCDPA, CPA and CTDPA are covered in noticeably greater detail than the GDPR.

Who owns the data?

Under the EULA the customer keeps all intellectual property rights, title and interest in the Customer Data it exposes to the platform, and equally in the Output Data derived from it. DataGrout takes only a non-exclusive, royalty-free licence, sub-licensable to its affiliates and vendors, to use that data to operate the platform and meet its legal obligations. The agreement states plainly that Customer Data serves that customer alone and is never processed for the benefit of another client. The platform itself is not sold and remains DataGrout's property, as does the anonymised Analytics Information the company derives from usage and of which it declares itself sole owner.

Reuse rights

Customers may reuse the platform's Output Data freely: the EULA leaves all rights, title and interest in it with them. Two limits apply. Output Data may not be used to build models competing with DataGrout or the platform, and the customer alone is responsible for judging its accuracy, the agreement warning against relying on it for decisions with legal or material consequences for an individual. In the other direction DataGrout grants itself far broader rights. Clause 2.5 permits the company to use Customer Data and Output Data to maintain and improve the platform, including for machine learning purposes and to train the platform's AI models, and no opt-out is documented anywhere on the site. Clause 2.6 adds that all data is ultimately processed by a third-party LLM provider operating outside DataGrout's control, which may itself use it for training.

Data retention & training

Hosting summary

The platform runs on AWS with automated releases and health monitoring, and the privacy policy also lists Salesforce and Heroku among hosting and platform providers. Beyond those provider names nothing is disclosed: no country, no region and no data residency option on the standard tiers. The marketing site itself resolves to a Render node in the United States, which should not be mistaken for where platform data lives. Protection is described in far more detail than location. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or above, integration credentials receive an additional application-level layer, runtime secrets sit in AWS Secrets Manager, and the certificate authority signing key is held in an AWS KMS hardware security module validated to FIPS 140-2 Level 2, so that private key material never leaves the hardware. The privacy policy announces cross-border transfers to affiliates and third-party providers, including to countries whose laws do not offer equivalent protection, without naming a transfer mechanism. Enterprise customers can negotiate private cloud or on-premise deployment, and the EULA also contemplates SaaS, vendor-hosted, managed-service and customer-hosted models on public, private or hybrid cloud.