Chatronix

GDPR overview

GDPR is addressed explicitly, though briefly. The service is operated from Portugal under Portuguese and EU law, so the operator is established inside the Union and no Article 27 representative is required or named. The privacy policy lists four legal bases — consent, contract necessity, legitimate interest and legal obligation — and grants access, rectification, deletion and export, with the right to complain to a national supervisory authority. Transfers may reach the EEA or other countries under adequate safeguards, and no hosting country is named. The FAQ claims servers compliant with GDPR and CCPA, and TLS 1.3 in transit. What is missing is the paperwork a business buyer expects: no DPA, no subprocessor list, no named DPO, and a single shared mailbox for rights requests. The age rules also conflict, 18 in the terms against 13 in the privacy policy.

Who owns the data?

The terms of use split ownership in two. Chatronix keeps its own branding and code, while content generated in a chat normally belongs to the user, subject to the licence of the model provider that produced it. The operator states that it never sells personal data and never uses it to train AI models, and the FAQ repeats that your ideas stay yours. Users can delete individual messages, whole conversations, their entire history, or the account itself by emailing support. Prompts are nevertheless forwarded to third-party providers such as OpenAI and Google, each governed by its own policy.

Reuse rights

Output can be reused without asking Chatronix for permission: the terms state that generated content typically belongs to the user, under the licence of the model provider that produced it, and that users remain responsible for what they publish. The terms add no editorial or commercial restriction of their own. The limits come from two other directions. First, each provider's terms still govern its own output, so a reuse permitted here may be constrained upstream. Second, the acceptable-use clause forbids illegal activity, spam, malware, disinformation, reverse engineering and overloading the providers, and breaches can end in suspension without refund. Chatronix itself says it uses submitted data only to operate, support and improve the service, never to train models.

Data retention & training

Hosting summary

The site says little about where data physically sits. The privacy policy promises secure storage with encryption and access controls, and states that data may be stored or processed in the EEA or in other countries offering adequate safeguards — a permissive formulation that names no country. The FAQ adds that servers comply with GDPR and CCPA, and that TLS 1.3 protects data in transit. No hosting country, no subprocessor list, no DPA and no certification such as SOC 2 or ISO 27001 is published. Third parties are acknowledged only in general terms: OpenAI and Google are cited as examples of the AI platforms that receive user prompts, while the hosting, analytics and email providers remain unnamed. A network check on 09/08/2026 resolved the website to 63.176.8.218, an Amazon address in Frankfurt, Germany; that describes where the web front end is served, not where user data is stored. Inspection of the application also reveals Supabase as the backend, Polar for payments and Cloudflare for the sign-up challenge, none of which is declared in the policy.