AiTea

GDPR overview

Implementation is documented rather than merely claimed. A dedicated GDPR page sits alongside a separate privacy policy, both dated 7 July 2026. The publisher commits to full compliance with the GDPR and Slovak data protection law, and publishes a table mapping each purpose to its legal basis (Article 6.1.b contract, 6.1.c legal obligation, 6.1.f legitimate interest, 6.1.a consent). The six data subject rights are listed, requests go to info@aitea.sk with the subject line "GDPR - [your right]", and answers are promised within 30 days. No data is transferred outside the EEA, and standard contractual clauses are announced should that ever change. Compliance with the EU AI Act is claimed as well. Gaps remain: no data protection officer is named, no postal address appears anywhere, and no named subprocessor list is published.

Who owns the data?

The terms and conditions contain no intellectual property clause at all: they never say who owns uploaded files or generated documents, which leaves the question contractually open. What the site does define is the controller role. The privacy policy names a company established in Bratislava, and the GDPR page identifies it as Techguys s.r.o. Personal data processed includes conversation history and uploaded documents. The publisher states it may share data with cloud providers (Microsoft Azure, EU data centres), AI model providers processing within the EU, payment gateways and public authorities where the law requires it, adding that all partners are bound by strict security standards and by the GDPR. No named list of subprocessors is published.

Reuse rights

Nothing in the terms grants or restricts the customer's reuse of what the tool produces. The publisher sells DOCX and PDF export as a paid feature on the Advokat and Enterprise plans, which implies that users are meant to take their documents away and use them freely, but the contract never says so. Two limits are stated instead: outputs are informational and not legally binding, and the user accepts that the AI assistant may produce inaccurate information, with the publisher declining liability for damage caused by incorrect use of those outputs. On the personal-data side, the right to portability is offered, so a user may obtain their data in a structured, commonly used format. Anyone relying on generated filings should therefore treat the absence of an ownership clause as a point to clarify with the publisher before committing client work to the platform.

Data retention & training

Hosting summary

The publisher states that all data is stored in the European Union, on Microsoft Azure in the West Europe region, and that personal data is never transferred outside the European Economic Area. Should a transfer ever become necessary, the privacy documentation announces that European Commission standard contractual clauses would apply. Microsoft Azure is the only hosting provider named; AI model providers are said to process within the EU but none of them is named, and neither are the payment gateways. Security controls declared alongside this are TLS 1.3 in transit, AES-256 at rest, least-privilege access control, 24/7 monitoring, regular encrypted backups, regular audits and staff training. An independent check is consistent with the claim: the domain resolves to a Microsoft address in Amsterdam and the site runs on an Azure App Service instance in the West Europe region. That check only covers the public website, however, and no hosting country is ever named by the publisher, since "West Europe" is an Azure region rather than a country.