ChatGOT

GDPR overview

The GDPR is never named. Searching every page collected returns no occurrence of GDPR, CCPA, SOC 2 or ISO 27001, and there is no trust or security page. The privacy policy of 29 May 2024 still covers adjacent ground without citing the regulation: users may access, update or delete their information, retention is tied to the purpose of collection, and the service is closed to children under 13. International transfers are acknowledged, since data may be held on computers outside the user's country, but consent inferred from use is the only basis offered and no standard contractual clauses or adequacy decision are named. There is no DPO, no Article 27 representative, no data processing agreement and no subprocessor list. The one explicit nod to EU law is commercial: a 14-day cancellation right for customers in the EU and Turkey.

Who owns the data?

The privacy policy states that conversation content is encrypted and stored on ChatGOT's own servers, that it will not be shared with any third party, and that only the user can view it, with access limited to authorised personnel. Where a Google account is used to sign in, the email address is held for authentication alone. Nothing in the terms claims ownership of, or a licence over, what users type or generate. Liability travels the other way: the company disclaims responsibility for content produced through the service and makes the account holder solely answerable for everything done under their account. Deletion happens on request rather than automatically.

Reuse rights

The terms say nothing about who owns the output. No clause grants users a licence and none reserves rights to the vendor, so reuse is neither expressly permitted nor expressly forbidden. The only affirmative statement sits on the homepage, where generated images are presented as watermark-free and free of copyright problems, ready for projects, presentations and publications: a commercial claim, not a contractual warranty. What the terms do constrain is the content itself. Unlawful, defamatory, discriminatory, infringing and impersonating material is prohibited, as are spam, automated article spinning and bulk machine-generated content. Users must comply with intellectual property, data protection and cybersecurity law, and may not copy, redistribute, modify or reverse engineer the underlying models.

Data retention & training

Hosting summary

ChatGOT says only that conversation content is encrypted and stored on its own servers. No country, region or data centre is named, and there is no trust or security page. The privacy policy claims encryption and secure access protocols, and expressly reserves the right to transfer information to computers outside the user's state, province or country, where data protection law may differ; consent inferred from continued use is the only basis offered, with no safeguard mechanism named. No subprocessor list and no data processing agreement are published, although Google Analytics, Microsoft Clarity, Microsoft Advertising and Google account sign-in are named as third parties in the policy itself. Network lookups, which are an observation rather than a vendor commitment, resolve the domain to an Amazon address in Ashburn, United States, behind Cloudflare name servers. An edge node shows where traffic is served, not where data is stored, so it should not be read as a hosting guarantee.