Colossyan

GDPR overview

GDPR compliance is claimed explicitly, and the detail is unusually concrete. Colossyan, Inc. is the controller, with two affiliate controllers named and addressed: Colossyan Ltd in London and Colossyan kft in Budapest. Data processing agreements are maintained and available on request, with custom DPAs on Enterprise. The full set of rights is documented — access, rectification, erasure, restriction, portability, objection and no purely automated decisions — exercised by writing to privacy@colossyan.com, with links to the ICO and to the EDPB for complaints. Transfers outside the EU and UK rely on adequacy decisions or standard contractual clauses, and breach notification follows the 72-hour rule. AI practices are said to follow the transparency and risk-management principles of the EU AI Act. One gap: no Article 27 representative and no data protection officer is named.

Who owns the data?

Customers keep ownership. The terms state that you retain all right, title and interest in the materials you upload, and the security pages confirm that documents, scripts, generated videos and course content belong to your organisation, with Colossyan claiming no rights over them. Custom avatars stay inside the account that created them and never appear in the public library, and the owner decides which users may use their likeness. When a contract ends you can export your content and request full deletion. Colossyan, Inc. acts as data controller for its own services; on Enterprise accounts it acts as processor and the client organisation becomes the controller.

Reuse rights

Customers may reuse what they generate without asking permission, within the limits the acceptable use policy sets. Videos can be downloaded as MP4, embedded, shared by link or packaged as SCORM and delivered internally, to partners and to customers. The restrictions bite on the avatars, voices and stock models rather than on the content itself: because these are based on real actors, they may not be used in television broadcasting or advertising, in international TV campaigns for advertisers above one billion dollars of revenue, alongside gambling, alcohol, tobacco or adult services, or in any way that puts opinions on politics, religion, race, gender or sexuality into an actor's mouth. Colossyan's own stock assets may not be redistributed unaltered, nor used to train machine learning systems. In the other direction, Colossyan states it never trains its models on customer content and contractually forbids its AI vendors from doing so, though the privacy notice does reserve the right to use uploaded content with third-party tools to tailor its own sales and marketing outreach.

Data retention & training

Hosting summary

The two published statements do not quite agree. The privacy notice says the services are hosted in Germany and the United Kingdom, and that Colossyan itself is located in the United States. The security page describes infrastructure running on AWS in EU and US regions, monitored continuously and covered by the SOC 2 Type II audit cycle. Enterprise customers can negotiate EU or US data residency during the sales process. Data is encrypted with TLS 1.3 in transit and AES-256 at rest, with a 99.9% uptime commitment and one-hour recovery time and recovery point objectives. Transfers out of the EU and UK rely on adequacy decisions or standard contractual clauses. Anyone with a hard residency requirement should get the exact regions confirmed in writing, since the site names Germany and the UK in one place and broader EU and US regions in another.