Feynn

GDPR overview

GDPR is addressed explicitly and in unusual detail. Feynn AS is established in Norway, inside the EEA, so the regulation applies directly and no Article 27 representative is required or named. The terms state that the company processes personal data in accordance with applicable data protection laws, including the EU/EEA GDPR. The privacy policy names its legal bases by article: contract 6(1)(b), legitimate interests 6(1)(f), consent 6(1)(a) and legal obligation 6(1)(c). It lists the rights of access, rectification, erasure, restriction, portability and objection, withdrawal of consent, and complaint to a local supervisory authority. Transfers outside the EEA rely on Standard Contractual Clauses, adequacy decisions and the EU-U.S. Data Privacy Framework. Requests go to privacy@feynn.ai. Only strictly necessary cookies are used, hence no consent banner. No DPO is named, and Feynn AS claims no certification of its own.

Who owns the data?

The terms are explicit: you retain ownership of your User Content. In return you grant Feynn AS a limited, worldwide, non-exclusive, royalty-free licence to process, store and use that content solely to operate, maintain and improve the service. Rights over the AI Output run the other way and are handed to you: you may use, reproduce, modify and commercially exploit what the platform generates, with a single carve-out, namely that the output may not be used to train competing foundation models. The controller for the personal data attached to your account is Feynn AS, organisation number 936 609 961, Carl Jeppesens Gate 22, 0481 Oslo, Norway.

Reuse rights

You do not need permission to reuse what the platform produces. The terms grant you the right to use, reproduce, modify and commercially exploit the AI Output, the only restriction being that it may not be used to train competing foundation models, and reports export to PDF or Markdown so they can move straight into a deck or a memo. On the input side, Feynn collects your email address and password, the company details you type in, your prompts and research scenarios, and your support messages. It also captures technical data automatically: IP address in short-lived logs, device and browser metadata, authentication events and error logs. Those data serve to run the account, generate the AI results, process payments, diagnose problems, send notifications and meet legal obligations. Text you submit is sent to external AI providers for the sole purpose of producing the output; the publisher states that it does not use customer content to train its own AI models and that, where provider controls exist, it configures them to reduce retention and prevent training on customer content. It also states that it does not sell personal data. Social sign-in through Google, LinkedIn, GitHub or Apple passes only your email, name and account identifier, never a password. The policy has applied since 30 November 2025.

Data retention & training

Hosting summary

The database, authentication, storage and edge functions run on Supabase, on Postgres, with encryption at rest, managed backups and replication capability; the publisher mentions “regional hosting options” without naming a region. The application and front end are hosted by Lovable, a platform certified SOC 2 Type II and ISO 27001:2022, and the publisher states clearly that these certifications belong to Lovable, not to Feynn AS. Encryption in transit uses HTTPS with TLS 1.2 or above, and AES-256 at rest through the underlying infrastructure. Postgres Row Level Security is applied to key tables, service roles are separated, and JSON web tokens are short-lived with refresh tokens. What is not said matters as much: no hosting country and no region are named anywhere. The privacy policy notes only that some subprocessors may process data outside the EEA, framed by Standard Contractual Clauses, adequacy decisions and the EU-U.S. Data Privacy Framework, which is a transfer safeguard, not a hosting location.