MobileGPT

GDPR overview

The site never uses the word GDPR: the term appears nowhere across its six pages, and no compliance claim is made. What it does grant is a Your Rights section listing six rights whose wording matches the regulation, namely access, rectification, erasure, restriction of processing, objection and portability. To exercise them, users are told to contact us and we will respond in accordance with applicable laws and regulations, with no deadline, no dedicated form and no online request path. A European buyer will not find a legal basis for processing, an Article 27 representative, a data processing agreement, a published sub-processor list, any declared hosting country or region, any mention of international transfers or standard contractual clauses, a minimum age, or an effective date on the policy. The rights language is present; the accountability paperwork a European purchasing file usually requires is not.

Who owns the data?

The privacy policy names Skhokho Corporation, 651 N Broad St, Suite 201, Middletown, Delaware 19707, as the party behind the service, with a designated Privacy Compliance Officer reachable at hello@mobile-gpt.io. It states that the company collects your name, contact details, chat history and usage data, meaning how often you use the assistant, for how long and what kinds of requests you make. Sensitive financial or health information is refused and said to be deleted immediately if supplied; location is collected only when volunteered. Neither the terms nor the privacy policy contains any clause on ownership of the content the assistant generates, so that question is simply left unanswered.

Reuse rights

The stated purposes are narrow: running the service, improving its quality and better understanding what users need. The policy explicitly says personal information is not sold, rented or shared with third parties for their marketing purposes, and that disclosure happens only where the law requires it or where the security and integrity of the service is at stake. Free users are shown relevant advertisements inside the application, and only while they are using it, whereas subscribers get an ad-free experience; no cross-site behavioral advertising is described. Stripe is the single named third party, for payments, and the publisher states it has neither access to nor control over the data Stripe collects. On the website itself, no personal data is said to be collected from visitors beyond analytics tags and anonymous pixels. Whether conversations are used to train models is never addressed, neither claimed nor ruled out. No reuse rules are published for the text, images or documents the assistant produces, so the site grants the end user no written permission and imposes no written restriction on what they do with those outputs.

Data retention & training

Hosting summary

The site says nothing about where data is hosted. No country, no region, no data center and no infrastructure provider is declared, and there is no mention of international transfers, standard contractual clauses or hosting sub-processors. The only third party named in the privacy policy is Stripe, for payments, and the publisher states that it has neither access to nor control over the data Stripe collects. The homepage FAQ notes that conversations travel through WhatsApp encrypted messaging, which speaks to transport rather than storage. One technical observation, which comes from our own checks and not from any statement by the publisher: the website itself resolves to an IP address in Dublin, Ireland, on Amazon Web Services (54.76.198.57, AS16509), and its static images are served from an Amazon S3 bucket. That describes where the marketing site is hosted and says nothing about where conversations, uploaded files or account data are stored. A buyer with a data residency requirement will have to ask the publisher directly, because nothing on the site answers the question.