Security & Privacy
GDPRchat is built by FRITS AI ApS in Denmark and runs on a European stack. Your data is processed in Europe, under EU law — every supplier we hand it to is a European company, no tracking, no advertising, and we never train AI models on your data.
Where your data is processed
Provider by provider, this is who handles your data:
- Mistral AI (France)AI language model, embeddings, and voice transcription
- Scaleway (France)AI language model, embeddings, and voice transcription
- Hetzner (Germany)Servers, database (PostgreSQL / pgvector), and file storage
- IONOS (Germany)AI image generation
- Linkup (France)Web search for current information — query text only, stripped of every identifier (no account data, no IP address), sent from our EU servers
No analytics, no tracking pixels, no fingerprinting, and no third-party advertising.
Sub-processors (GDPR Article 28)
These companies process personal data on our behalf to deliver the service. With each one we have a data processing agreement imposing equivalent GDPR obligations, or are in the process of concluding one; the current status for each is shown on our transparency page.
| Sub-processor | Purpose | Country / region |
|---|---|---|
| Mistral AI | AI language model processing, text embeddings, and voice transcription | Paris, France |
| Scaleway | AI language model processing (currently code generation, and chat overflow when the primary provider is at capacity) | Paris, France |
| Hetzner Online GmbH | Infrastructure hosting (servers, database, file storage) | Germany |
| IONOS Cloud GmbH | AI image generation and image editing | Berlin, Germany (EU/EEA under the AVV) |
| Mollie B.V. | Payment processing | Netherlands (EEA — no third-country transfer) |
| Scaleway (Transactional Email) | Transactional email delivery | Paris, France |
How we notify you of changes
Before we add or replace a sub-processor we notify subscribers in advance, and you have 30 days to object, as set out in our Data Processing Agreement.
Linkup (a French company) receives the search query text only — composed by the AI and sent from our servers with no user identifiers or IP address attached. Linkup runs its search infrastructure in the EU, the United States, Canada and Asia-Pacific and does not guarantee that a given query is processed locally, so a search may be handled outside the EU. OpenStreetMap, Open-Meteo, Wikipedia, and Frankfurter.dev receive only non-personal query parameters. Google, Microsoft, and Apple act as independent controllers when you sign in with them — as does Apple for App Store purchases — and are not our sub-processors.
Business customers who enter an EU VAT number to claim a reverse-charge exemption have that number sent to the European Commission’s VIES service (ec.europa.eu) to confirm its validity. VIES receives only the VAT number, only when voluntarily provided, and is operated by the European Commission — not as a sub-processor of FRITS AI ApS.
Data Processing Agreement
Read our pre-signed Data Processing Agreement online, or download it as a PDF to share with your legal team. No account required.
Data protection contact
We are not required to appoint a Data Protection Officer under Article 37 GDPR, but we treat data-protection enquiries as a first priority. For DPA counter-signing, sub-processor questions, or any GDPR request, contact:
Frits Lyneborg
Founder, FRITS AI ApS
support@frits.aiFRITS AI ApSCVR: 45733785
Nyhavn 38, 1051 København K, Denmark
You may also contact our lead supervisory authority, Datatilsynet (the Danish Data Protection Agency), at datatilsynet.dk