AllyHub

GDPR overview

GDPR is addressed concretely, through a dedicated EEA+ Addendum covering the EEA, the United Kingdom and Switzerland, which prevails over the main policy where the two diverge. AllyHub, Inc. is named as data controller at its Bellevue address. Lawful bases are cited article by article: 6(1)(b) for contract, 6(1)(c) for legal obligations, 6(1)(f) for legitimate interests, and 6(1)(a) for consent to non-essential cookies. Legitimate interest assessments are available on request. Access, erasure, rectification, portability, restriction, consent withdrawal and complaint rights are listed, along with a right to object to model training, all exercised by email with identity verification and a stated fifteen-business-day response. Transfers reach jurisdictions including the United States under unspecified safeguards. No Article 27 EU representative is named, and no DPA is published.

Who owns the data?

The Terms of Service state that users keep ownership of both their Input and the Output, and that AllyHub claims no ownership over either, except where its own intellectual property is embedded. The practical picture is narrower than that headline. By accepting the Terms, users grant AllyHub a fully paid, royalty-free, perpetual, irrevocable, worldwide, non-exclusive and fully sublicensable licence to host, use, licence, distribute, reproduce, modify, adapt, publicly perform and publicly display that Input and Output, in order to operate the service for the user and for other registered users. AllyHub may also derive data, statistics and insights from the same material for service improvement and other lawful purposes. Ownership therefore stays with the user; control does not.

Reuse rights

Users may reuse their own Input and Output without asking permission, but the Terms contradict themselves on the scope. Clause 4.2 states that commercial use of the Output is not restricted provided the user is on a paid plan, while clause 1.2 states that output must not be used for professional advice or for commercial purposes without explicit permission. The safe reading is that commercial reuse is intended for paying subscribers. Three duties travel with that reuse: verify the accuracy of anything republished, disclose clearly that the content is AI-generated, and publish nothing that breaches the acceptable-use rules. Users are also solely responsible for the lawfulness of their Input and are told not to submit personal data, credentials or confidential material. Anything posted into public areas of the service becomes visible to, and reusable by, other registered users.

Data retention & training

Hosting summary

AllyHub names no hosting region, no data centre and no infrastructure provider. The only geographical statement in the privacy policy is a transfer clause in the EEA+ Addendum, which says personal data may be transferred and disclosed to third parties in jurisdictions including the United States, under appropriate safeguards and transfer mechanisms that are never specified. Hosting appears only as one category among the business partners listed in the sharing section, with no vendor named. Independently, the domain resolves to an IP address geolocated in the United States on Render's infrastructure, which is consistent with the transfer clause but is not a statement by the publisher. There is no data residency option, no choice of region, and no published security certification such as SOC 2 or ISO 27001. Security measures are described only in generic terms, as commercially reasonable technical, administrative and organisational safeguards. A buyer with a data localisation requirement will find nothing here to satisfy it.