PirateDiffusion

GDPR overview

Implementation is thin, and compliance is never claimed. The Terms of Use do two concrete things: they assign roles, with the customer as controller and Graydient as processor, free to engage sub-processors; and they acknowledge that data may be transferred to the United States or other jurisdictions without adequate protection, in which case Standard Contractual Clauses apply "as outlined in our DPA". That DPA is named once and is neither published nor linked. Beyond this there is no designated Article 27 representative in the European Union, no data protection officer, no dedicated privacy mailbox and no sub-processor list. The privacy policy does grant export and deletion rights, but states plainly that a person reviews every deletion request first: "you cannot self-govern your data".

Who owns the data?

Under the Terms of Use, Graydient owns the platform itself: software, interfaces, documentation, look and feel, and all trademarks. Anything you upload or post remains your sole responsibility. For generated images the company grants you a perpetual, worldwide, non-exclusive, royalty-free and irrevocable copyright licence to reproduce, display, distribute and create derivative works. On personal data the roles reverse: you are the controller, Graydient is the processor, it may engage sub-processors, and it is granted the right to cache your content. The publisher states that it neither sells nor shares customer data and does not train its models on uploads, with one exception: anonymous automated audits for illegal material, escalated to law enforcement.

Reuse rights

Outputs can be reused commercially without asking permission and without paying anything. The FAQ states that customers already publish PirateDiffusion images on websites, in books, in video games and on social media, that the company will never request royalties, and that no credit or attribution is required. Two limits follow. First, an AI-generated image cannot be trademarked in the United States and fully computer-generated work is not copyrightable there, so anyone in the community may reuse an image regardless of who prompted it. Second, the underlying models are OpenRail-licensed derivatives trained on public internet data, and the vendor pushes diligence back to the user: keep the prompts that produced your images as evidence, and avoid naming a specific artist in commercial work. Custom LoRAs stay private only when they are trained from a private conversation with the bot.

Data retention & training

Hosting summary

The site never names a hosting country. The only geographic statement sits in the Terms of Use, which warn that data processed through the service may be transferred to the United States or to other locations not considered to offer adequate protection under the GDPR, with Standard Contractual Clauses as the stated transfer mechanism. The publisher is incorporated in Miami, Florida, and the terms mention an office in Japan. On infrastructure, Graydient says it owns or leases its own A100, A6000 and RTX 5090 machines, dedicated entirely to AI rather than rented from third parties, and that it began by contacting data centres with spare capacity in 2023 — without saying where those data centres are. The web front end resolves to a Cloudflare anycast address, which reveals nothing about where computation happens. The privacy policy notes that visitor IP addresses and user agents are logged and may be stored with security providers such as Cloudflare. User files live in Graydient Drive, from 100 GB to 1 TB depending on the plan, with S3 suggested to enterprise customers.