greenpt.com privacy policy — score 82/100 (low risk)
Last analyzed
GreenPT BV · greenpt.ai
Report details
low riskGreenPT offers strong EU data sovereignty and minimal tracking, but its policy is suspiciously silent on whether your chat data is used to train AI models, and it relies on a weak safeguard for US-based search transfers.
GreenPT BV demonstrates a strong commitment to EU data sovereignty, hosting data in France with renewable energy and offering robust security certifications. Data minimization is evident in the handling of API payloads and audio input, which are processed in RAM and not persistently stored. However, the policy contains a critical ambiguity regarding AI model training and an inadequate legal mechanism for transferring search data to the US via Brave Search.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
API payloads and audio inputs are processed in RAM and discarded immediately, and ad tracking is strictly limited to specific landing pages.
The policy is clear on data flows and retention, but completely omits any mention of whether user inputs are used for AI model training.
Sharing is limited to essential sub-processors and highly scoped ad attribution pixels, with an explicit statement that data is never sold.
Data is hosted in the EU, but search queries go to Brave Search in the USA with only a privacy policy listed as a safeguard, which is inadequate under GDPR.
The policy is entirely silent on whether user chat content or prompts are used to train, fine-tune, or improve AI models, a critical transparency failure for an AI provider.
Standard GDPR rights are clearly listed with a one-month response time, and account data export is explicitly mentioned before deletion.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Silence on AI Model Training
The policy mentions 'Anonymized research and service improvement' as a purpose for data use, but completely fails to explicitly state whether user chat content or prompts are used to train, fine-tune, or improve AI models, which is a critical transparency requirement for AI services.
Inadequate Safeguard for US Data Transfer
For the Brave Search sub-processor located in the USA, the policy lists 'Brave Search API Privacy Policy' as the safeguard. Under GDPR, a third-party privacy policy is not a valid legal mechanism for international data transfers; Standard Contractual Clauses (SCCs) or similar mechanisms are required.
Narrow and Transparent Ad Tracking
The policy restricts tracking cookies and data sharing with advertising partners (Google and Meta) exclusively to specific landing and thank-you pages for visitors arriving via ads, explicitly stating no other personal data or browsing activity is shared, which is a highly privacy-friendly approach.
Strong Ephemeral Data Processing
The policy explicitly states that API payloads and audio inputs for Speech-to-Text are processed in-memory (RAM) only and not persistently stored, demonstrating strong data minimization for sensitive transient data.
Consumer Takeaway
Your data stays in the EU and is well-protected, but you should assume your chat prompts might be used for AI improvement unless you clarify with the company, as the policy avoids the topic entirely.
Compliance Posture
Largely compliant with GDPR, featuring clear user rights, DPA availability, and strict sub-processor controls, but falls short on explicit AI training disclosures and valid international transfer mechanisms for US sub-processors.
EU Transfers
Data is primarily hosted in France, but search queries are sent to Brave Search in the USA. The policy lists 'Brave Search API Privacy Policy' as the safeguard, which is legally insufficient under GDPR (Schrems II) without Standard Contractual Clauses (SCCs) or another valid transfer mechanism.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
API payloads are processed in-memory only and not stored
voice recordings for Speech-to-Text are processed in RAM and discarded immediately after transcription.
To advertising partners (Google and Meta), but only when you arrive at our website via their ads. In those cases, they learn that you visited a specific landing page and, if applicable, a thank-you page (only those two pages).
Safeguards: Brave Search API Privacy Policy
Missing or Unclear
- Explicit opt-in or opt-out mechanism for AI model training using user chat data
- Valid GDPR transfer mechanism (e.g., Standard Contractual Clauses) for Brave Search in the USA
- Details on how 'Anonymized research' is performed and verification that anonymization is irreversible
Questions to Ask
- Is chat content or audio input used to train, fine-tune, or improve your AI models, and if so, how can users opt out?
- What specific legal mechanism (e.g., Standard Contractual Clauses) is used to authorize the transfer of search queries to Brave Search in the USA?
- How exactly is chat content anonymized for 'Anonymized research and service improvement,' and can you guarantee it cannot be re-identified?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.