Perso AI

GDPR overview

Chapter IX, Article 34 of the terms (in force since 2 June 2026) claims full GDPR compliance for EU residents. Legal bases cited are contract performance, legal obligations, legitimate interests and explicit consent for marketing. Rights covered include portability, erasure, restriction of processing and objection to automated decision-making, profiling included. Transfers outside the EU/EEA rely on Standard Contractual Clauses or adequacy decisions, and breaches are notified to the supervisory authority within 72 hours, with individual notice where the risk is significant. Article 35 adds CCPA terms for California residents: no sale of data, a 45-day response window extendable by 45, and two free requests per 12 months. Two gaps stand out: the privacy policy (in force since 26 June 2026) rests on Korea's Personal Information Protection Act rather than the GDPR, and no Article 27 EU representative is published. Privacy contact: privacy@estsoft.com; appointed DPO: Gwon Taek-sun, CTO.

Who owns the data?

Article 4.2 of the terms of service splits ownership three ways: original content supplied by the member stays the member's, results generated by the AI are owned by the member, and the AI model itself belongs to the company. Members retain the copyright on the content they create, and remain liable for any infringement it causes. In return, the member grants ESTsoft a limited license on AI outputs, for the sole purpose of improving the service. The pricing FAQ confirms full commercial usage rights with no revenue sharing, and white-label, watermark-free delivery for agencies. Private content is not accessible to the company or to third parties, except under a judicial or administrative order or another legal obligation.

Reuse rights

Members can reuse what they generate without asking permission: commercial usage rights are full, with no revenue sharing, provided they hold the rights on the source material. On the company's side, the privacy policy states that user input may be used to improve services or train models, and Article 4.1 of the terms lets ESTsoft use member data for AI learning. Members may refuse that consent, but the refusal may restrict access to certain services. Data processed covers text, voice, scripts, images, video, biometric data and the metadata of the input. Inputs are also screened to prevent malicious, fraudulent or illegal activity and the creation of deepfakes. Secondary purposes include account management, payment, marketing with consent, usage statistics and security. The pricing FAQ adds that all uploads are encrypted and that only the account holder can access their files.

Data retention & training

Hosting summary

Section 6 of the privacy policy names MS Azure as the subprocessor handling data storage and system operation, without stating any region or country. Section 7 lists cross-border transfers to the United States: Google LLC for usage analytics, ESTsoft Inc. and Stripe Inc. for payment, and Microsoft for account verification. Other named subprocessors are Hotjar for behavioral analytics, Slashpage for the community and Amplitude for usage statistics, alongside Google LLC for account and analytics. As a Korean company, ESTsoft anchors its policy in the Personal Information Protection Act and in Korean authorities such as KISA and KOPICO, while Article 34.4 of the terms frames transfers outside the EU/EEA with Standard Contractual Clauses or adequacy decisions. Declared security measures include an internal management plan, staff training, access control, encryption, updated security programs and physical access control to server rooms; the pricing FAQ adds that uploads are encrypted and only the account holder can reach their files. The gap is plain: subprocessors are named one by one, yet no hosting country or region is published anywhere on the pages reviewed.