greenpt.com privacy policy — score 82/100 (low risk)
Laatst geanalyseerd
De rapportinhoud (samenvatting, bevindingen, citaten) is in het Engels gegenereerd en niet gelokaliseerd.
GreenPT BV · greenpt.ai
Rapportdetails
low risicoGreenPT offers strong EU data sovereignty and minimal tracking, but its policy is suspiciously silent on whether your chat data is used to train AI models, and it relies on a weak safeguard for US-based search transfers.
GreenPT BV demonstrates a strong commitment to EU data sovereignty, hosting data in France with renewable energy and offering robust security certifications. Data minimization is evident in the handling of API payloads and audio input, which are processed in RAM and not persistently stored. However, the policy contains a critical ambiguity regarding AI model training and an inadequate legal mechanism for transferring search data to the US via Brave Search.
Beoordeling per categorie
Uitsplitsing van het beleid over belangrijke compliancegebieden. Goed = sterk, redelijk = gemengd, slecht = zorgwekkend.
API payloads and audio inputs are processed in RAM and discarded immediately, and ad tracking is strictly limited to specific landing pages.
The policy is clear on data flows and retention, but completely omits any mention of whether user inputs are used for AI model training.
Sharing is limited to essential sub-processors and highly scoped ad attribution pixels, with an explicit statement that data is never sold.
Data is hosted in the EU, but search queries go to Brave Search in the USA with only a privacy policy listed as a safeguard, which is inadequate under GDPR.
The policy is entirely silent on whether user chat content or prompts are used to train, fine-tune, or improve AI models, a critical transparency failure for an AI provider.
Standard GDPR rights are clearly listed with a one-month response time, and account data export is explicitly mentioned before deletion.
Belangrijkste bevindingen
Opvallende clausules, problemen of positieve praktijken (kritiek eerst)
Silence on AI Model Training
The policy mentions 'Anonymized research and service improvement' as a purpose for data use, but completely fails to explicitly state whether user chat content or prompts are used to train, fine-tune, or improve AI models, which is a critical transparency requirement for AI services.
Inadequate Safeguard for US Data Transfer
For the Brave Search sub-processor located in the USA, the policy lists 'Brave Search API Privacy Policy' as the safeguard. Under GDPR, a third-party privacy policy is not a valid legal mechanism for international data transfers; Standard Contractual Clauses (SCCs) or similar mechanisms are required.
Narrow and Transparent Ad Tracking
The policy restricts tracking cookies and data sharing with advertising partners (Google and Meta) exclusively to specific landing and thank-you pages for visitors arriving via ads, explicitly stating no other personal data or browsing activity is shared, which is a highly privacy-friendly approach.
Strong Ephemeral Data Processing
The policy explicitly states that API payloads and audio inputs for Speech-to-Text are processed in-memory (RAM) only and not persistently stored, demonstrating strong data minimization for sensitive transient data.
Samenvatting voor de gebruiker
Your data stays in the EU and is well-protected, but you should assume your chat prompts might be used for AI improvement unless you clarify with the company, as the policy avoids the topic entirely.
Nalevingshouding
Largely compliant with GDPR, featuring clear user rights, DPA availability, and strict sub-processor controls, but falls short on explicit AI training disclosures and valid international transfer mechanisms for US sub-processors.
EU-overdrachten
Data is primarily hosted in France, but search queries are sent to Brave Search in the USA. The policy lists 'Brave Search API Privacy Policy' as the safeguard, which is legally insufficient under GDPR (Schrems II) without Standard Contractual Clauses (SCCs) or another valid transfer mechanism.
Gedetecteerde signalen
Specifieke gegevens en praktijken geïdentificeerd in de tekst
Bewijsfragmenten
Directe citaten uit het beleid ter ondersteuning van deze bevindingen
API payloads are processed in-memory only and not stored
voice recordings for Speech-to-Text are processed in RAM and discarded immediately after transcription.
To advertising partners (Google and Meta), but only when you arrive at our website via their ads. In those cases, they learn that you visited a specific landing page and, if applicable, a thank-you page (only those two pages).
Safeguards: Brave Search API Privacy Policy
Ontbreekt of onduidelijk
- Explicit opt-in or opt-out mechanism for AI model training using user chat data
- Valid GDPR transfer mechanism (e.g., Standard Contractual Clauses) for Brave Search in the USA
- Details on how 'Anonymized research' is performed and verification that anonymization is irreversible
Vragen om te stellen
- Is chat content or audio input used to train, fine-tune, or improve your AI models, and if so, how can users opt out?
- What specific legal mechanism (e.g., Standard Contractual Clauses) is used to authorize the transfer of search queries to Brave Search in the USA?
- How exactly is chat content anonymized for 'Anonymized research and service improvement,' and can you guarantee it cannot be re-identified?
Deel deze analyse
Iedereen met deze link kan het resultaat hierboven bekijken.
Gebouwd door DentroChat
100% Europese AI-chat voor iedereen
Chat met AI, werk met bestanden, genereer afbeeldingen en zoek op het web. Gegevens blijven in Europa.