CompanyResearch.ai

GDPR overview

There is no mention of the GDPR anywhere in the pages collected: the words GDPR, General Data Protection, CCPA and California do not appear once, in the visible text or in the archived HTML. No Article 27 EU representative is designated and no Data Protection Officer is named; the only privacy contact is an address on a third-party domain. Some rights exist in practice without being tied to any legal basis: access, correction and deletion through a form in the account settings, cookie refusal delegated to browser settings, and a ban on personal data from anyone under sixteen. Nothing is said about legal bases, international transfers or standard contractual clauses. Governing law is the Commonwealth of Massachusetts, with exclusive jurisdiction in Boston. The absence of any GDPR claim should be read as exactly that: an absence, not a denial.

Who owns the data?

The terms split ownership cleanly. Between you and the publisher, you keep whatever rights you have in your Output, and you may use it for any lawful purpose, including selling or publishing it. The publisher keeps everything on its own side: the AI products themselves, their algorithms and models, and the aggregated results of developing them. Two limits matter. Output is not unique, so the same request may return the same text to somebody else and exclusivity cannot be claimed. And neither Input nor Output is treated as confidential information, which leaves you responsible for whatever you feed in.

Reuse rights

Yes, and without asking. The terms grant you the right to use your Output for any lawful purpose, commercial ones included, with sale and publication named explicitly. No prior permission, no licence request and no attribution requirement appears in the document. The constraints come from elsewhere: you must hold the rights to whatever you submitted as Input, your use must comply with the terms and with applicable law, and it must not breach any policy of the third-party AI service providers behind the product. Because identical Output can reach other users, exclusive use of a given report cannot be assumed.

Data retention & training

Hosting summary

Nothing is published. Neither the privacy policy nor the terms of use names a hosting country or region, and there is no trust or security page to consult, both routes returning 404. No certification is claimed, and no subprocessor or infrastructure provider is named anywhere in the pages collected. Two facts sit outside the publisher's own statements and should be read as context rather than commitment. The company behind the tool is established in Cambridge, Massachusetts, in the United States, and governing law is the Commonwealth of Massachusetts with exclusive jurisdiction in Boston. Separately, a network lookup resolves the domain to an anycast address geolocated to the United States. That last point describes where the front end answers from, not where user data is stored, and it carries no weight as a hosting guarantee. Anyone with a data residency requirement will have to ask the publisher directly, because the site does not answer the question.