Prio

GDPR overview

GDPR compliance is claimed explicitly and repeatedly. The privacy policy names the legal bases used under Article 6 (consent, performance of a contract, legitimate interest, legal obligation) and details the full set of data subject rights: access, rectification, erasure, restriction, portability and objection. Rights are exercised at privacy@prio.sh, which is also given as the contact for a data protection officer, though no individual is named. The Dutch authority, Autoriteit Persoonsgegevens, is cited as the supervisory body, and breach notification is promised within 72 hours. A data processing agreement is offered on request, alongside a security questionnaire. No Article 27 representative is designated, which is consistent with a vendor established inside the EU. One caveat matters: the homepage and security page promise no data transfers outside the EEA, while the privacy policy explicitly allows processing outside the EU/EEA under standard contractual clauses.

Who owns the data?

The customer keeps ownership of everything brought into the product. The terms of service state that the vendor claims no ownership of user content, and the security page repeats that emails, calendar events, documents and conversations remain the customer's. In exchange the customer grants the vendor an operating licence, limited to running and providing the service. The data controller is Prio, a trade name of No Nasties V.O.F., registered in the Netherlands. Users can export their conversations, tasks, contacts and activity logs from the settings at any time, and delete the account themselves: deletion is immediate on the surface and permanent within thirty days.

Reuse rights

Customers can reuse their own data freely and without asking: export of conversations, tasks, contacts and activity logs is self-service from the settings, and the vendor presents this as data sovereignty with no lock-in. On the vendor's side, use is presented as narrow. Email and calendar access is limited to the messages needed for the task requested, and email content is said to be processed in memory rather than stored beyond what is necessary. The vendor states that customer data is never used to train AI models and describes this as a contractual guarantee; the AI providers it relies on, Anthropic for reasoning and Mistral for voice transcription, are used through APIs whose terms forbid training on inputs and outputs. Google data is additionally covered by the Limited Use requirements of the Google API Services User Data Policy. The vendor states it does not sell personal data and does not carry out automated decision-making or profiling with significant effects.

Data retention & training

Hosting summary

The security page states that all data is stored in EU data centres in Frankfurt, region eu-central-1, on a Supabase backend with row-level security and Vercel Edge hosting, with no replication outside the European Economic Area. Traffic is encrypted with TLS 1.3, data at rest with AES-256, and OAuth tokens are encrypted before being written to the database. Four subprocessors are named: Supabase for the database in the EU, Vercel for hosting, Anthropic for AI processing through its API only, and Resend for transactional email, all bound by data processing agreements. Voice transcription is handled by Mistral, presented as a European provider. Two qualifications are needed. The privacy policy names AWS and Google Cloud as cloud hosting providers and explicitly permits processing outside the EU/EEA under adequacy decisions and standard contractual clauses, which sits awkwardly with the no-transfer claim. The site's own llms.txt file gives the Netherlands rather than Germany as the hosting country.