CuServly

GDPR overview

GDPR compliance is claimed explicitly: the privacy policy invokes Regulation (EU) 2016/679, and a data processing agreement is published openly rather than offered on request. Roles are set out properly, controller for account holders and processor for customers of the application. Rights under Articles 15 to 22 are exercised at support@cuservly.com, with a one-month deadline extendable by two. Transfers outside the EEA rely on the European Commission's standard contractual clauses, and Schrems II is acknowledged. Subprocessors are covered by a list shared on request, with 30 days' notice before any change and a right to object. No Article 27 representative is named, which is consistent with an EU-based Croatian publisher. One caveat: the policy cites Greek statutes and the Greek supervisory authority, a template artefact its author never corrected.

Who owns the data?

PiconAI, a sole trader based at Oprić 80a, 51415 Lovran, Croatia, operates CuServly. Its role depends on who you are: it is the controller of your own account details, but only a processor for the content and conversations you run through the application, where you remain the controller. The data processing agreement binds it not to retain, use or disclose that data for any purpose beyond the agreed one, and forbids it from buying or selling it. Content you upload stays yours: you grant nothing more than a non-exclusive, royalty-free licence limited to operating and maintaining the service. A single address, support@cuservly.com, handles every request.

Reuse rights

For its own account data, PiconAI relies on consent, performance of the contract, legal obligation and legitimate interest, and collects name, e-mail, Google sign-in details, billing address and VAT number, plus browser, operating system and IP data. For the chatbot itself the customer decides what goes in, and can add, edit or delete any knowledge base entry at will; nothing in the terms requires you to ask permission before reusing your own content elsewhere. Two flows leave the publisher's systems: Stripe processes payment, and when a visitor's question does not match an entry already stored, relevant chunks are sent to a third-party AI model to compose the answer, with the FAQ pointing to OpenAI's privacy notice for that step. Everything else sits encrypted on Google Cloud, and the publisher states it neither shares nor sells it. Google Analytics is opt-in and switched off by default.

Data retention & training

Hosting summary

Data is stored encrypted on Google Cloud, and that is as precise as the site ever gets: no hosting country and no region is committed to anywhere in the documentation. The privacy policy states that transferring data outside the EU or EEA is not the intention, while conceding that the location or multinational nature of some providers may cause it, in which case the European Commission's standard contractual clauses apply, with Schrems II explicitly acknowledged. The data processing agreement goes further, barring transfers out of the EEA unless an adequacy decision, binding corporate rules or standard contractual clauses are in place, and requiring the publisher to assess the destination country beforehand. Named providers include Stripe for payment, Google Cloud for storage, and Google and Facebook tools for marketing and analytics. For reference, the marketing site itself resolves to 178.218.165.202, hosted in Croatia by Plus Hosting Grupa, though that concerns the website rather than customer data. Buyers with a residency requirement should ask for a written commitment, because the published documents contain none.