Chunky

GDPR overview

The privacy policy addresses the GDPR at length. The publisher describes its dual role as data controller and data processor, lists its legal bases (consent, performance of a contract, public-interest research and statistics, already public data) and enumerates eight rights for EEA residents: withdrawing consent, access, rectification, objection, restriction, erasure, portability and lodging a complaint with a supervisory authority. Transfers outside the EU are limited to explicit consent or cases provided for by the GDPR, a separate CCPA section covers California, requests go through a DSAR form, and the privacy contact is finance@purplepanda.be. Gaps remain: no Article 27 representative and no DPO are named, though the publisher is established in Belgium so Article 27 does not apply; no DPA is published, no subprocessor is listed and no hosting country is announced. The document is stated as effective 7 March 2023 and never claims compliance outright.

Who owns the data?

Chunky publishes no terms and conditions at all, so the privacy policy is the only contractual document available. The publisher acts as both data controller and data processor depending on context; for the information you submit through the service it is a processor: "We do not own, control, or make decisions about the submitted Personal Information, and such Personal Information is processed only in accordance with your instructions." Signing a data processing agreement makes you the controller. The policy also allows sharing with Service Providers, who are never named, and warns that your account and personal information would likely be transferred in a merger, acquisition or sale of assets.

Reuse rights

Because no terms and conditions are published, no licence clause governs the content you upload, and the question of what the publisher may do with your material is simply left open. What the privacy policy does settle is narrower. You may delete some of your personal information directly from the service, but the publisher keeps an unmodified copy for as long as its own obligations require, and it reserves the right to keep exploiting derivatives afterwards: "We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally." On the other side of the ledger it commits that "We will not share any personally identifiable information with third parties and will not share any information with unaffiliated third parties." Nothing on the site states whether customer data is used to train models, in either direction.

Data retention & training

Hosting summary

No hosting jurisdiction is announced. The site names no country, no region, no cloud provider and no subprocessor: the privacy policy refers to Service Providers without ever listing them, and there are no terms and conditions to fill the gap. What can be established is that the publisher, Purple Panda BV, is established in Belgium and therefore inside the EU, and that the policy frames transfers outside the EU narrowly: "The transfer of your Personal Information to countries outside the European Union will be made only if you have explicitly consented to it or in the cases provided for by the GDPR and will be processed in your interest." On security the commitment stays generic: "We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure", backed by reasonable administrative, technical and physical safeguards, with an explicit statement that no absolute security can be guaranteed. Network-level observations about where the domain resolves are not contractual commitments and must not be read as the place where customer data is stored.