genei

GDPR overview

The privacy policy is explicitly built on the GDPR. Genie Technology Ltd declares itself the controller of personal data under the regulation as it applies across the European Union and the United Kingdom, lists the legal bases it relies on (consent, contract, legal obligation, legitimate interests), enumerates the full set of data subject rights, describes how to exercise them with proof of identity, and names the UK Information Commissioner's Office as the supervisory authority. It also states that no personal data is transferred outside the EEA. What is missing is just as telling: no effective date, no designated DPO, no Article 27 representative, no Data Processing Agreement, no subprocessor list and no retention period. The terms of use still carry the template placeholder "Privacy Policy available at [insert link]".

Who owns the data?

You stay responsible for the documents and text you upload, and you must hold the rights to them. In exchange, clause 15.4 of the terms grants genei a royalty-free, worldwide, transferable and sublicensable licence to copy, store and use that content, both to run the service and to improve the algorithms behind it. Clause 10.4 goes further: genei and its licensors claim the intellectual property rights in the deliverables produced through the site. Clause 11.2 adds that, personal data aside, the publisher gives no confidentiality guarantee on what you send and reserves an unrestricted, free-of-charge use of it.

Reuse rights

Nothing in the published terms grants the end user any reuse right over the site's own content: clause 10.2 reserves every intellectual property right to genei and its licensors, and clause 10.3 states that you get no legal right beyond what is necessary to access the material. Clause 10.4 assigns the intellectual property in the deliverables created through the site to the publisher as well, which is unusual and deserves attention before you build commercial work on genei's output. Use of the site itself is restricted to personal, non-commercial purposes under clauses 3.1 and 12, unless you go through an Enterprise Subscriber arrangement. Your own uploaded documents remain yours, but you have licensed them broadly, including for algorithm improvement, and no opt-out from that use is documented anywhere on the site.

Data retention & training

Hosting summary

The site names no hosting country and no hosting provider. The only positive statement is in the privacy policy: personal data is not transferred outside the European Economic Area. That places the processing within the EEA and the United Kingdom, under the jurisdiction the publisher claims for itself, but it identifies neither a data centre nor a cloud vendor. There is no trust or security page, no certification such as SOC 2 or ISO 27001, and no mention of encryption. Security is described in general terms only: appropriate measures against accidental loss and unauthorised access, access limited to staff with a genuine business need, a duty of confidentiality, and procedures to handle a suspected breach with notification where the law requires it. For context, the public IP serving the domain resolves to an Amazon anycast node in the United States, but that concerns the marketing site's delivery network and says nothing certain about where user documents are stored.