Happycapy

GDPR overview

There is no mention of the GDPR anywhere on Happycapy's public pages — not in the Privacy Policy, not in the Terms of Service, not in the AI Additional Terms. No Data Processing Agreement is published or offered on request, no subprocessor is named, no Article 27 representative or data protection officer is designated, and no certification such as SOC 2 or ISO 27001 is displayed. What stands in their place is section 7 of the Privacy Policy, effective 23 July 2026 and last updated 17 August 2026, which lists rights of access, correction, deletion, portability and objection, introduced by the words Depending on your location and exercised by writing to support@happycapy.ai. Section 4 states that data belonging to users outside the United States is transferred there and processed there, without naming any transfer mechanism.

Who owns the data?

Happycapy assigns all rights in Outputs to the user, subject to compliance with its terms, while warning that Outputs may resemble content generated for other customers and are never guaranteed to be unique. The AI Terms add that using the service grants Happycapy no right to use or share Customer Data, Inputs and Outputs alike, in a way inconsistent with its Privacy Policy and Agreement unless the user agrees in writing. Personal information is never sold, traded or rented; it is shared only with service providers for hosting, analysis, email delivery and customer service, where the law requires it, or in a business transfer. OAuth tokens for Google and Canva sit on Happycapy servers until the connector is disconnected, and sandbox capacity, model access and embedded API keys remain the vendor's own Account Resources.

Reuse rights

Because the rights in Outputs are assigned to the user, generated content can be reused, published, adapted or sold without asking further permission. That freedom is conditional rather than absolute: the user must comply with the Terms and the AI Terms, and must review, verify and validate every Output before relying on it. Four uses are ruled out by name — developing a competing AI model, passing AI-generated content off as human-made, producing spam or misleading material, and generating harmful content. Responsibility for the legality of both Inputs and Outputs rests entirely with the user. The licence to the service itself is personal, non-transferable, non-exclusive and limited to internal business or personal purposes, so reselling or redistributing Happycapy requires express written permission.

Data retention & training

Hosting summary

Happycapy names one jurisdiction and only one: the United States. The Privacy Policy states that information may be transferred to and held on computers outside the user's own state, province or country, where data protection law may differ, and that users located outside the United States have their data transferred there and processed there. No alternative region is offered, no data-residency choice exists, and no transfer mechanism is named — neither standard contractual clauses, nor an adequacy decision, nor the Data Privacy Framework. Hosting providers are described only as categories: third-party service providers handling hosting, data analysis, email delivery and customer service. None is identified. OAuth tokens for the Google and Canva connectors are held on the vendor's servers. The work itself runs in an isolated cloud sandbox kept separate from the user's own machine. Security is covered in a single paragraph citing administrative, technical and physical measures, with no detail and no certification. At network level the domain sits behind Cloudflare on an anycast address, which says nothing about where data is actually stored.