AI Chat

GDPR overview

The site contains no mention of the GDPR whatsoever. A search across all thirteen collected pages, in both the extracted text and the archived HTML, returns no occurrence of GDPR, CCPA, DPA, sub-processor, SOC 2, ISO 27001 or HIPAA. There is no trust or security page, no legal notice, no sub-processor register, no named data protection officer and no Article 27 representative. No legal basis, retention period or international transfer mechanism is described. The only concrete commitments actually written down are these: the right to review and correct account data through the settings, the ability to permanently delete the account and its data, a stated refusal to sell or transfer personal data without explicit consent, and encryption of conversation content. The publisher is an EU-established company, which makes the absence of any GDPR language more surprising, not less.

Who owns the data?

The publisher collects only basic contact details when an account is created, for billing and communication, and states that the service can be used without registering under a real identity. Conversation content is described as encrypted and accessible solely to the company's natural language processing algorithms, in order to improve responses; human staff are said to have no access to it. Personal data is not sold, traded or transferred to third parties without explicit consent, and third-party providers used for payment and infrastructure are contractually limited to that purpose. Users may review, modify or permanently delete their account and its associated data. Notably, the terms of use say nothing at all about who owns the content generated through the tool.

Reuse rights

The terms of use contain no assignment of rights and no restriction on commercial reuse, so nothing in the published documents prevents a user from reusing what the assistant produces — but nothing confirms it either, and that silence is itself a risk for professional work. What the terms do state is that outputs come with no warranty, do not constitute professional advice in any field, and must be verified by the user before being relied upon. A separate licence page covers only the publisher's own editorial content, blog posts and educational articles, released under Creative Commons CC BY-SA 4.0 with attribution and share-alike; that licence does not extend to assistant outputs.

Data retention & training

Hosting summary

No hosting jurisdiction is published. The privacy policy refers only to deletion of data from "our servers" and names no country, no region and no infrastructure provider. Third-party providers are mentioned generically, for payment processing and infrastructure, without a list. There is no reference to international transfers, standard contractual clauses or data residency options. What can be observed from outside the site is not a hosting declaration: the domain resolves to an address geolocated in Amsterdam, in the Netherlands, on an Amazon network flagged as anycast — that is a delivery node, not evidence of where user data is stored. The marketing site itself is served by Framer, and the application runs on a separate subdomain. The publisher is established in Poland, judging by the legal form in the footer copyright, so an EU jurisdiction is plausible but nowhere confirmed. Anyone with a data residency requirement should treat this as unanswered and ask directly.