AffinityBots

GDPR overview

There is no GDPR implementation to report. The word GDPR appears nowhere on the site: a check across every collected page, in text and in archived HTML, returned nothing. No Article 27 EU representative is designated, no data protection officer is named and no dedicated privacy address is published. There is no data processing agreement, published or offered on request, and no sub-processor list. The policy never mentions the rights of access, rectification, erasure, portability or objection. It promises appropriate security measures and limits internal access to those with a business need to know, but describes neither. No retention period, hosting country or transfer mechanism is given, and no certification such as SOC 2 or ISO 27001 is claimed. The legal pages point to a contact address on affinitybots.click, a domain that does not resolve.

Who owns the data?

The terms of use cover only the website itself, granting a licence to consult it, and say nothing about the ownership of the content, documents or conversations customers bring to the platform. No clause claims ownership of customer material, and none grants the publisher a licence over it: the question is simply never addressed. The privacy policy stays on personal data, listing identity data (name, username or similar identifier), contact data (email address), technical data (IP address, browser type and version, time zone, operating system) and usage data. No data processing agreement is offered and no sub-processor is named, so the contractual position on data ownership remains undefined and would have to be settled with the publisher directly.

Reuse rights

The privacy policy lists six purposes: delivering and maintaining the service, notifying users of changes, providing support, producing analysis that improves the product, monitoring usage, and detecting and fixing technical problems. The legal basis is described only in generic terms, the publisher stating that it uses personal data only when the law allows us to, without further detail. The cookie policy goes further: alongside functional, analytics and preference cookies, it declares cookies used to enable ad delivery and behavioral targeting. Payments run through Stripe and card details are not stored on the publisher's servers. Two silences matter. Nothing states whether customer data is used to train models, in either direction, and no document says what users may or may not do with the outputs their agents generate, which leaves reuse rights to be clarified before any commercial use.

Data retention & training

Hosting summary

The publisher declares nothing about where data is hosted. No country and no region is named anywhere on the site, and the privacy policy mentions neither international transfers, nor standard contractual clauses, nor server locations. The only technical clue lies outside anything the publisher states: the domain resolves to 216.198.79.1, an Amazon anycast address on AS16509, which identifies a content delivery node and says nothing about where customer data is actually stored. On-premise deployment exists but is reserved for the Enterprise plan. In practice a prospective customer has no way of knowing which jurisdiction governs their data, and no contractual document fills the gap, since neither a data processing agreement nor a sub-processor list is published. Anyone with data residency requirements should treat the question as unanswered and raise it with the publisher before uploading anything sensitive to a knowledge base.