Booki Brain

GDPR overview

Implementation is described in concrete terms rather than claimed in the abstract. The controller is named as Booki Brain UG (haftungsbeschränkt) i.G. in Wiesbaden, represented by Abdelilah Boukajouj, and the competent supervisory authority is identified as the Hessian Commissioner for Data Protection and Freedom of Information. Rights under Articles 15 to 21 are listed individually, with legal bases split between consent, contract and legitimate interest. A processing agreement under Article 28 is signed before activation and can be folded into the customer's own template; the record of processing activities under Article 30 is generated from audit logs. Erasure under Article 17 is promised within 24 hours across production, backups and training sets, confirmed in writing. The EU AI Act is treated as an architectural anchor, with a DPIA template per tenant. The policy is dated May 2026.

Who owns the data?

The vendor keeps ownership of what it delivers. Section 7 of the general terms states that all supplied digital content remains the intellectual property of Booki Brain, and that the customer receives only a non-transferable, non-exclusive right to use it inside their own company. Passing it to third parties, copying it beyond personal use or reselling it commercially all require written consent. Customer data moves the other way: each installation sits in its own libSQL database rather than a shared tenant, a complete export under Article 20 GDPR is available at any time in open formats, and one is supplied before a contract ends.

Reuse rights

Customers may use the delivered content freely within their own organisation, but not beyond it: onward transfer, reproduction past personal use and commercial resale are barred without written permission from the vendor. Their own data, by contrast, stays portable and exportable in open formats at any moment under Article 20 GDPR. On the vendor's side, the stated rule is that local language models are not trained on customer data and therefore memorise nothing. Any request carrying personal data is routed to those local models automatically; a cloud fallback to Claude or GPT-4 is reached only for complex reasoning, only with an explicit opt-in, and only after personal identifiers have been stripped. Anthropic is engaged under a processing agreement plus the EU-US Data Privacy Framework.

Data retention & training

Hosting summary

Two distinct arrangements should not be confused. Customer workloads are hosted exclusively by Hetzner Online GmbH in Frankfurt am Main, with the Falkenstein data centre park also named, under German jurisdiction and German venue. Each installation has its own libSQL database rather than a shared tenant, backups are encrypted and also held at EU locations, and sensitive material is processed by local language models on the vendor's own hardware with no cloud connection. European cloud options named for non-critical work are Mistral in Frankfurt and Aleph Alpha. Cloudflare acts as the edge CDN, certified under the EU-US Data Privacy Framework with EU endpoints. The public website, by contrast, is hosted by Cloudflare Inc. in San Francisco under that same framework, with IP addresses anonymised after connection and server logs kept between seven and thirty days. The distinction matters: the marketing site sits in the United States, the customer data does not.