AI Suggests

GDPR overview

There is no GDPR implementation to report. The word GDPR appears nowhere on the pages collected: no data protection officer, no Article 27 representative, no data processing agreement, no subprocessor list and no description of access, rectification or erasure rights. The link the terms present as a Privacy Policy leads to a generic disclaimer that says nothing about personal data, so the service effectively runs without a published privacy notice. What does exist is jurisdictional rather than regulatory: the terms are governed by French law, name the courts of Paris, declare the service hosted in France, acknowledge the mandatory consumer protections of the user's EU country of residence, and link to the European Commission's online dispute resolution platform. European users should treat the absence of documentation as the finding itself.

Who owns the data?

The terms are explicit on ownership: the publisher asserts no ownership over what users submit, and users retain full ownership of their contributions together with the intellectual property rights attached to them. One carve-out is stated — suggestions and feedback sent to the publisher may be used and shared for any purpose, without compensation. On the operational side, the user data section says the publisher stores what users transmit as well as data about their use of the service, performs routine backups, and accepts no liability for any loss or corruption. No privacy notice defines who else may access this material, because the document the terms call a Privacy Policy contains no personal data clauses at all.

Reuse rights

Users may reuse what they generate without asking permission. The terms state that the publisher claims no ownership over contributions and that users keep full ownership and the associated intellectual property rights, so the output can be published, edited, sold or used commercially. The only exception concerns suggestions and feedback sent to the publisher, which it may use and share for any purpose without compensating the author. The reverse is more restrictive: systematic extraction, scraping, automated access and any reproduction of the service's own content or marks require prior written permission. Nothing in the documents indicates whether prompts or generated texts are used to train models, so no commitment is made on that point either way.

Data retention & training

Hosting summary

The terms make a single explicit statement on the subject: the service is hosted in France. They add that accessing it from any other part of the world amounts to transferring personal data to France, and that continued use counts as consent to that transfer. The same section places the agreement under French law and the non-exclusive jurisdiction of the courts of Paris. Nothing further is documented: no hosting provider is named, no region or datacentre is identified, no secondary location is mentioned, and no security certification such as SOC 2 or ISO 27001 appears anywhere on the site. Network lookups show the domain sitting behind Cloudflare, whose anycast address resolves to the United States; that describes the delivery layer in front of the site, not where user data is stored. In practice a European user has a French jurisdiction and a French hosting claim, but no supporting documentation with which to verify either.