newsrooms.ai

GDPR overview

Implementation is documented rather than merely declared. The home page states that newsrooms.ai is fully GDPR-compliant. All data is processed and stored according to the strictest European data protection standards. A processing agreement under Article 28 is published as a downloadable PDF, with one annex covering the technical and organisational measures and another naming the AI subprocessors. The privacy policy, dated 24 November 2025 and available in German only, sets out the rights of access, rectification, erasure, portability (Article 20) and objection (Article 21), gives privacy@newsrooms.ai and an Austrian telephone number as contact points, and names the Austrian data protection authority as the competent supervisory body. Consent is handled through Cookiebot/Usercentrics. Compliance with the EU AI Act is claimed as well. Two gaps are worth noting: no data protection officer is named, and no Article 27 representative applies, the publisher being based in Vienna inside the EU.

Who owns the data?

Under the published processing agreement the customer remains the controller of everything it uploads — drafts, notes, research, documents, transcripts and brand-voice samples — while AI Newsrooms Technology GmbH acts only as a processor for that content. The publisher is controller in its own right solely for the website and for the pre-contractual relationship. Customer content is stored on European servers and is never used to train or fine-tune models. Five named AI subprocessors may handle it: Anthropic, Google, Groq, Mistral and OpenAI. When the main contract ends, Article 10 of the processing agreement leaves the choice to the customer: all personal customer data is either returned to it or deleted.

Reuse rights

The material a customer supplies stays under its own control. The security page commits that newsrooms.ai will not use your data to train or fine-tune any AI models, and the home page FAQ adds that data is never shared with external models for training purposes. Generated pieces are handed back as drafts for the customer to edit, approve and publish through its own channels, including a direct push to WordPress, Ghost, Drupal, Contentful or swat.io. Processing itself is carried out with five named AI subprocessors — Anthropic, Google, Groq, Mistral and OpenAI — with Google also supplying cloud infrastructure, transcription and translation services. With the EU-only option, model inference stays inside the European Union; without it, and depending on the feature used, personal data may be processed in or accessed from third countries, notably the United States, under the safeguards of Articles 44 et seq. of the GDPR. Server logs are kept for no more than thirty days.

Data retention & training

Hosting summary

Data is held on European servers only, as stated on the security page and in the home page FAQ, and an EU-only option keeps model inference inside the European Union too, so that both storage and processing can be confined to the bloc. The underlying infrastructure is Google Cloud: Annex 2 of the processing agreement cites EU data centres and gives Frankfurt as an example rather than an exclusive commitment, and the site's own IP address does resolve to Frankfurt, Germany. The firm public undertaking therefore concerns the region — the EU — rather than any single country. Outside the EU-only option, and depending on the feature used, personal data may be processed in or accessed from third countries, notably the United States, under the safeguards of Articles 44 et seq. of the GDPR. Data in transit is encrypted with TLS 1.2 or higher and data at rest with AES-256, with role-based access control, single sign-on and audit logs on top. The engineering team is based in Vienna, Austria, and the home page FAQ mentions that an on-premise deployment is possible.