greenpt.com privacy policy — score 82/100 (low risk)
Última análise
O conteúdo do relatório (resumo, conclusões, citações) foi gerado em inglês e não está localizado.
GreenPT BV · greenpt.ai
Detalhes do relatório
low riscoGreenPT offers strong EU data sovereignty and minimal tracking, but its policy is suspiciously silent on whether your chat data is used to train AI models, and it relies on a weak safeguard for US-based search transfers.
GreenPT BV demonstrates a strong commitment to EU data sovereignty, hosting data in France with renewable energy and offering robust security certifications. Data minimization is evident in the handling of API payloads and audio input, which are processed in RAM and not persistently stored. However, the policy contains a critical ambiguity regarding AI model training and an inadequate legal mechanism for transferring search data to the US via Brave Search.
Avaliação por categoria
Repartição da política pelas principais áreas de conformidade. Bom = sólido, razoável = misto, fraco = preocupante.
API payloads and audio inputs are processed in RAM and discarded immediately, and ad tracking is strictly limited to specific landing pages.
The policy is clear on data flows and retention, but completely omits any mention of whether user inputs are used for AI model training.
Sharing is limited to essential sub-processors and highly scoped ad attribution pixels, with an explicit statement that data is never sold.
Data is hosted in the EU, but search queries go to Brave Search in the USA with only a privacy policy listed as a safeguard, which is inadequate under GDPR.
The policy is entirely silent on whether user chat content or prompts are used to train, fine-tune, or improve AI models, a critical transparency failure for an AI provider.
Standard GDPR rights are clearly listed with a one-month response time, and account data export is explicitly mentioned before deletion.
Conclusões principais
Cláusulas relevantes, problemas ou boas práticas identificadas (críticas primeiro)
Silence on AI Model Training
The policy mentions 'Anonymized research and service improvement' as a purpose for data use, but completely fails to explicitly state whether user chat content or prompts are used to train, fine-tune, or improve AI models, which is a critical transparency requirement for AI services.
Inadequate Safeguard for US Data Transfer
For the Brave Search sub-processor located in the USA, the policy lists 'Brave Search API Privacy Policy' as the safeguard. Under GDPR, a third-party privacy policy is not a valid legal mechanism for international data transfers; Standard Contractual Clauses (SCCs) or similar mechanisms are required.
Narrow and Transparent Ad Tracking
The policy restricts tracking cookies and data sharing with advertising partners (Google and Meta) exclusively to specific landing and thank-you pages for visitors arriving via ads, explicitly stating no other personal data or browsing activity is shared, which is a highly privacy-friendly approach.
Strong Ephemeral Data Processing
The policy explicitly states that API payloads and audio inputs for Speech-to-Text are processed in-memory (RAM) only and not persistently stored, demonstrating strong data minimization for sensitive transient data.
Resumo para o utilizador
Your data stays in the EU and is well-protected, but you should assume your chat prompts might be used for AI improvement unless you clarify with the company, as the policy avoids the topic entirely.
Postura de conformidade
Largely compliant with GDPR, featuring clear user rights, DPA availability, and strict sub-processor controls, but falls short on explicit AI training disclosures and valid international transfer mechanisms for US sub-processors.
Transferências UE
Data is primarily hosted in France, but search queries are sent to Brave Search in the USA. The policy lists 'Brave Search API Privacy Policy' as the safeguard, which is legally insufficient under GDPR (Schrems II) without Standard Contractual Clauses (SCCs) or another valid transfer mechanism.
Sinais detetados
Dados e práticas específicas identificadas no texto
Fragmentos de evidência
Citações diretas da política que suportam estas conclusões
API payloads are processed in-memory only and not stored
voice recordings for Speech-to-Text are processed in RAM and discarded immediately after transcription.
To advertising partners (Google and Meta), but only when you arrive at our website via their ads. In those cases, they learn that you visited a specific landing page and, if applicable, a thank-you page (only those two pages).
Safeguards: Brave Search API Privacy Policy
Em falta ou pouco claro
- Explicit opt-in or opt-out mechanism for AI model training using user chat data
- Valid GDPR transfer mechanism (e.g., Standard Contractual Clauses) for Brave Search in the USA
- Details on how 'Anonymized research' is performed and verification that anonymization is irreversible
Perguntas a fazer
- Is chat content or audio input used to train, fine-tune, or improve your AI models, and if so, how can users opt out?
- What specific legal mechanism (e.g., Standard Contractual Clauses) is used to authorize the transfer of search queries to Brave Search in the USA?
- How exactly is chat content anonymized for 'Anonymized research and service improvement,' and can you guarantee it cannot be re-identified?
Partilhar esta análise
Qualquer pessoa com esta ligação pode ver o resultado acima.
Criado pela DentroChat
Chat de IA 100% europeu para todos
Converse com IA, trabalhe com ficheiros, gere imagens e pesquise na web. Os dados permanecem na Europa.