CommandBar

GDPR overview

GDPR implementation was concrete and documented. The security documentation states that regardless of configuration, CommandBar is compliant with GDPR; the pricing page advertises GDPR Ready and the footer a GDPR & HIPAA badge. A Data Processing Addendum is publicly readable and incorporated into the terms, with a European exhibit relying on the 2021 EU Standard Contractual Clauses (modules two and three) and the UK Addendum for British transfers. It commits to notifying security incidents without undue delay, to 15 days' notice before engaging a new sub-processor with a right to object, and to an annual audit. Three weaknesses temper this: no Article 27 EU representative and no data protection officer are named, assistance with data subject requests and audits is billed to the customer, and the privacy policy itself is dated 13 October 2020, more than three years older than the terms.

Who owns the data?

The customer owns its data. The AI Addendum states that, as between the parties, the customer owns all Inputs and Outputs, both folded into the definition of Customer Content, and is responsible for them. Under the Data Processing Addendum the customer is the controller (or processor) and Foobar the processor (or sub-processor). The California exhibit makes the vendor a service provider forbidden from selling personal information. Two limits apply: the customer has no rights over similar results third parties may generate, and the privacy policy allows personal data to transfer with the business in a merger or acquisition, a clause that has since become relevant.

Reuse rights

Customers could reuse their own Inputs and Outputs freely without asking permission, subject only to applicable law and to the addendum's restrictions on illegal use, electoral content, competing model development and passing machine output off as human-written. On the vendor's side, use was narrowly framed: the company and its LLM providers could use Customer Content only as necessary to deliver the AI products, comply with the law and enforce their policies. Training was excluded twice over. The documentation states the company trains no models of its own and does not let its vendors do so, and the addendum contractually bars third-party LLM providers from using Customer Content to train or improve their general-purpose services. Customer content was never shared between customers.

Data retention & training

Hosting summary

Servers and databases were hosted in the United States, in facilities certified to SOC 2 and ISO 27001. The Data Processing Addendum broadened this, allowing processing in the United States or anywhere the provider and its sub-processors maintain facilities. Transfers out of Europe relied on the 2021 EU Standard Contractual Clauses, modules two and three depending on the customer's role, together with the UK Addendum. Protection measures included TLS on all API traffic, encryption at rest with full disk encryption required by the DPA, detailed audit logs and regular third-party penetration tests whose results Enterprise customers could request. Enterprise buyers could also self-host in air-gapped environments with no outbound network requests. The underlying cloud provider was never named on the site. One caution: the domain's public IP now resolves to a content delivery network edge node located in Switzerland, which is a point of presence and not a data hosting location.