ChatOn

GDPR overview

The word GDPR never appears — not once in the privacy policy, not once in the terms. What exists is the substance without the label. AIBY designates a representative for the European Union, Konrad Gutowski, reachable at privacy@aiby.com for privacy questions, and lists the usual rights: access, portability, rectification, erasure, restriction of processing, objection and opt-out, with a stated 45-day response window and a right to complain to a local supervisory authority. The document is far more developed on United States state laws, which get a dedicated annex covering CCPA/CPRA, TDPSA, VCDPA, CPA and CTDPA. Cross-border transfers to jurisdictions with weaker protection are announced on the basis of user agreement, with no standard contractual clauses cited and no DPA offered. The policy was last modified in July 2026.

Who owns the data?

AIBY Inc. claims no ownership over user content. The terms state in capitals that the user retains all rights to both the text they type (Input Content) and whatever the AI generates (Output Content), and may use it commercially. What AIBY does with it is processing rather than ownership: generation runs through named third parties — OpenAI, L.L.C., Anthropic, PBC, Perplexity AI, Inc., Fireworks AI Inc. and Firecrawl — while support correspondence is stored by Amazon.com, Inc. in the United States. On accounts without a subscription, excerpts of chat context may also reach advertising partner Velocity IO, Inc. AIBY states it will not rent or sell personal data. The user carries the legal risk of using generated content, and warrants holding the rights to anything uploaded.

Reuse rights

Reuse is broad and needs no permission. The terms let the user publish input and output content, incorporate it into other works, print it in any medium, replicate it, distribute it, sell copies of products containing it and profit from a digital version. Two limits sit around that freedom. First, the website itself may only be used for the user's own non-commercial purposes — a clause about the service, not about the generated content. Second, use remains subject to the model providers' own rules: the OpenAI Sharing & Publication Policy, the Anthropic consumer terms and usage policy, the Gemini API terms and section 2 of the Perplexity API terms, together with the territorial restrictions those providers publish. Copyrighted or trademarked material must not be used as input, and AIBY warns that output may be false, incomplete, misleading or out of date, and that identical answers may reach other users.

Data retention & training

Hosting summary

One host is named: Amazon.com, Inc., described as cloud storage provider, located in the U.S.A. No region, availability zone or jurisdiction choice is offered. The wider subprocessor table lists 13 entities with their locations — all in the U.S.A. except Paddle (U.S.A., Ireland and the United Kingdom) and contextual advertising partner Velocity IO, Inc. (Israel). Cross-border transfers to countries whose protection may differ are announced on the basis of the user's agreement. AIBY says it encrypts personal data before sending it to hosting organisations where possible, and works only with hosts that have passed its own security and reliability check; no SOC 2, ISO 27001 or HIPAA certification is claimed. Governing law and forum are the State of Florida. One caveat on reading the network data: the domain resolves to 104.26.9.244, which geolocates to the United States but belongs to Cloudflare — that is a content delivery node, not a storage location, and it should not be read as hosting.