greenpt.com privacy policy — score 82/100 (low risk)
Sidst analyseret
Rapportindholdet (resumé, fund, citater) er genereret på engelsk og er ikke lokaliseret.
GreenPT BV · greenpt.ai
Rapportdetaljer
low risikoGreenPT offers strong EU data sovereignty and minimal tracking, but its policy is suspiciously silent on whether your chat data is used to train AI models, and it relies on a weak safeguard for US-based search transfers.
GreenPT BV demonstrates a strong commitment to EU data sovereignty, hosting data in France with renewable energy and offering robust security certifications. Data minimization is evident in the handling of API payloads and audio input, which are processed in RAM and not persistently stored. However, the policy contains a critical ambiguity regarding AI model training and an inadequate legal mechanism for transferring search data to the US via Brave Search.
Vurdering pr. kategori
Opdeling af politikken på vigtige compliance-områder. God = stærk, rimelig = blandet, dårlig = bekymrende.
API payloads and audio inputs are processed in RAM and discarded immediately, and ad tracking is strictly limited to specific landing pages.
The policy is clear on data flows and retention, but completely omits any mention of whether user inputs are used for AI model training.
Sharing is limited to essential sub-processors and highly scoped ad attribution pixels, with an explicit statement that data is never sold.
Data is hosted in the EU, but search queries go to Brave Search in the USA with only a privacy policy listed as a safeguard, which is inadequate under GDPR.
The policy is entirely silent on whether user chat content or prompts are used to train, fine-tune, or improve AI models, a critical transparency failure for an AI provider.
Standard GDPR rights are clearly listed with a one-month response time, and account data export is explicitly mentioned before deletion.
Vigtige fund
Bemærkelsesværdige klausuler, problemer eller gode praksisser (kritiske først)
Silence on AI Model Training
The policy mentions 'Anonymized research and service improvement' as a purpose for data use, but completely fails to explicitly state whether user chat content or prompts are used to train, fine-tune, or improve AI models, which is a critical transparency requirement for AI services.
Inadequate Safeguard for US Data Transfer
For the Brave Search sub-processor located in the USA, the policy lists 'Brave Search API Privacy Policy' as the safeguard. Under GDPR, a third-party privacy policy is not a valid legal mechanism for international data transfers; Standard Contractual Clauses (SCCs) or similar mechanisms are required.
Narrow and Transparent Ad Tracking
The policy restricts tracking cookies and data sharing with advertising partners (Google and Meta) exclusively to specific landing and thank-you pages for visitors arriving via ads, explicitly stating no other personal data or browsing activity is shared, which is a highly privacy-friendly approach.
Strong Ephemeral Data Processing
The policy explicitly states that API payloads and audio inputs for Speech-to-Text are processed in-memory (RAM) only and not persistently stored, demonstrating strong data minimization for sensitive transient data.
Resumé til brugeren
Your data stays in the EU and is well-protected, but you should assume your chat prompts might be used for AI improvement unless you clarify with the company, as the policy avoids the topic entirely.
Compliance-stilling
Largely compliant with GDPR, featuring clear user rights, DPA availability, and strict sub-processor controls, but falls short on explicit AI training disclosures and valid international transfer mechanisms for US sub-processors.
EU-overførsler
Data is primarily hosted in France, but search queries are sent to Brave Search in the USA. The policy lists 'Brave Search API Privacy Policy' as the safeguard, which is legally insufficient under GDPR (Schrems II) without Standard Contractual Clauses (SCCs) or another valid transfer mechanism.
Registrerede signaler
Specifikke datapunkter og praksisser identificeret i teksten
Bevisuddrag
Direkte citater fra politikken, der understøtter disse fund
API payloads are processed in-memory only and not stored
voice recordings for Speech-to-Text are processed in RAM and discarded immediately after transcription.
To advertising partners (Google and Meta), but only when you arrive at our website via their ads. In those cases, they learn that you visited a specific landing page and, if applicable, a thank-you page (only those two pages).
Safeguards: Brave Search API Privacy Policy
Mangler eller uklart
- Explicit opt-in or opt-out mechanism for AI model training using user chat data
- Valid GDPR transfer mechanism (e.g., Standard Contractual Clauses) for Brave Search in the USA
- Details on how 'Anonymized research' is performed and verification that anonymization is irreversible
Spørgsmål at stille
- Is chat content or audio input used to train, fine-tune, or improve your AI models, and if so, how can users opt out?
- What specific legal mechanism (e.g., Standard Contractual Clauses) is used to authorize the transfer of search queries to Brave Search in the USA?
- How exactly is chat content anonymized for 'Anonymized research and service improvement,' and can you guarantee it cannot be re-identified?
Del denne analyse
Alle med dette link kan se resultatet ovenfor.
Bygget af DentroChat
100 % europæisk AI-chat for alle
Chat med AI, arbejd med filer, generer billeder og søg på nettet. Data forbliver i Europa.