aiOS

GDPR overview

aiOS displays a GDPR Ready badge and devotes a dedicated section of its privacy policy to users in the EEA, the United Kingdom and Switzerland. The commitments are concrete: legal bases of contractual necessity, legitimate interest and consent for optional features such as voice recording; transfer of data to United States servers under Standard Contractual Clauses where required; privacy@ai-genesis.ai as the GDPR contact; and an explicit reminder of the right to complain to a local supervisory authority. Access, rectification, erasure, portability, objection and withdrawal of consent are all listed, with a thirty-day response commitment, and the security page advertises data export, deletion and correction endpoints. Two elements are missing: no Article 27 EU representative is designated, and no data processing agreement is published or offered.

Who owns the data?

Under the Terms of Service, you own the content aiOS generates for your account, subject to the usage policies of the underlying model providers. AI Genesis LLC keeps ownership of the Service itself, including its design, code, proprietary models and documentation, along with the aiOS name and logo. The vendor states that conversations, emails and customer data are never used to train a foundation model, its own or anyone else's, and that personal information is not sold. Data is shared only with the named subprocessors, limited to what each needs to deliver its service, while anonymised aggregate usage data may be used to improve the product. Enterprise contracts add a vendor-handoff clause returning your code and data on request.

Reuse rights

You may reuse whatever the assistant produces for your account without asking aiOS for further permission, since the Terms assign ownership of generated content to you. Two reservations apply: the usage policies of the underlying image, video and audio model providers still govern those outputs, and you remain responsible for reviewing and approving every result before it goes out, as AI-generated content is supplied as-is with no accuracy warranty. Acceptable-use limits also bind you, ruling out spam, phishing and deceptive content, impersonation, and any AI voice or likeness imitating a real person without their consent. Your data can be exported in a portable format at any time. The aiOS name and logo may not be used without prior written consent.

Data retention & training

Hosting summary

aiOS processes and stores data in the United States, where the privacy policy states its servers are located, and transfers rely on Standard Contractual Clauses where required. The API runs on DigitalOcean App Platform with auto-scaling between two and twenty instances, backed by managed PostgreSQL with a read replica and automated backups, while Cloudflare sits in front of every production domain for DDoS protection and WAF. Three hosting subprocessors are named: Supabase for authentication and the encrypted database, DigitalOcean for compute, and Vercel for the web application and OAuth callback routes. Tenant separation combines PostgreSQL row-level security with application-layer checks on every query, described as having no bypass policies in production. Personal data is encrypted at field level with AES-256-GCM using versioned keys, and OAuth tokens sit in a KEK-based envelope vault whose keys live only in environment variables. Isolated compute environments per customer are an Enterprise feature. No European hosting region is offered.