Editby

GDPR overview

The word GDPR appears nowhere on the site — not in the privacy policy, not in the terms, not in the cookie policy. That is a silence rather than a refusal, and it is why this record is marked as non-compliant on the letter of the field. The substance tells a friendlier story: the publisher is established in Milan, names itself as data controller with its VAT and company-register numbers, and lists the familiar rights of access, correction, deletion, portability, restriction, objection and withdrawal of consent. It points EU readers to their national authority and names Italy's Garante. International transfers rely on standard contractual clauses. No DPO is appointed, no Article 27 representative is required, and requests go to a single generic address. All policies are dated 17 January 2025.

Who owns the data?

The terms are unusually clear on ownership. You keep all rights to what you upload — brand guidelines, documents, example posts — and grant The Formula AI S.r.l. only a limited licence to process that material in order to run the service. Original inputs such as prompts and brand rules remain yours. AI-generated output is licensed back to you for business purposes rather than assigned outright, a distinction worth noting. The Milan-based publisher is the declared data controller. If you leave, you can request an export within thirty days of termination, after which the company may delete what remains.

Reuse rights

Generated content is licensed to you for your business purposes, so you can publish, adapt and monetise it without asking again — the terms attach no per-use approval. Two duties travel with that freedom: you must review everything before publication, since the company guarantees neither accuracy nor appropriateness, and you must not use output in ways that infringe third-party intellectual property. You are equally responsible for holding the rights to whatever you feed in. On the vendor's side the picture is less crisp: aggregated, anonymised data may be used to improve its models, while your specific content is said never to train models other users can reach. No opt-out mechanism is documented.

Data retention & training

Hosting summary

No hosting location is published anywhere on the site. The privacy policy, the terms and the cookie policy all stay silent on the country or region where customer data lives. What they do name is the infrastructure: Supabase for the database, authentication and backend services, Upstash for scheduling agent workloads, Cloudflare for security and bot detection, and Stripe for payments. International transfers are explicitly anticipated and covered by standard contractual clauses plus processing agreements with those providers. Technical checks on 12 August 2026 resolved the domain to an edge address geolocated in the United States on an anycast network. That describes where the marketing site is served from, not where customer records are stored, and should not be read as a data-residency answer. The stated safeguards are conventional but specific: TLS/SSL in transit, encryption at rest for sensitive data, row-level security isolating one account from another, access controls, and regular audits and monitoring. Buyers with a residency requirement will have to ask the company directly, because nothing published answers the question.