Privacy, Compliance & Legal Safeguards
AIDG is built for European businesses: GDPR-ready, hosted and processed in the EU, with a complete audit trail.
AI and privacy: what runs where?
Almost everything runs in Europe. Your questions, conversations, speech, searches and files are processed and stored in the EU by default.
There are a few exceptions, for models and features that are better outside the EU (in the US): extra AI models from providers in the US, creating images/video/music, and maps and routes. They are off by default. You decide whether to switch them on, with a single tick box.
Nobody trains AI models on your data. Providers only process it to produce your answer.
| Service | What | Country/region | Default or your choice |
|---|---|---|---|
| Default — in the EU | |||
| AIDG gateway | Routes your question to the model and keeps track of the cost | Netherlands | Default |
| European AI providers | AIDG Auto, Auto Best and the other AIDG models | EU | Default |
| European speech service | Speech to text and read-aloud | EU | Default |
| Own servers | Storing your chats | Finland and Germany (EU) | Default |
| Own compute server | Running code and creating files | EU | Default |
| Own search engine and reader | Searching the web and reading pages | EU | Default |
| Live browser | Opening and operating websites for you | Runs in the EU; only visits the sites you choose | Default |
| Only if you switch it on — outside the EU | |||
| Extra AI models | Extra AI models from providers in the US, including image creation with those models | US | Only with your choice |
| Creating images, video and music | Only your description (and any lyrics) goes to the provider | US | Only with your choice |
| Maps and routes | Maps, routes and finding places | US | Only with your choice |
- Switching on or off: in the AIDG portal under Models outside the EU, or in AIDG Chat under your own settings. It is off by default, and you can always switch it off again.
- If it is off, you cannot choose those models and features. If you ask for them anyway, the chat tells you.
- If you use your own API key with a provider, your questions go to that provider. Providers outside the EU are clearly marked in the chat.
- The list of our (sub)processors is available on request via privacy@aidg.nl (GDPR Art. 28).
- HealthBrain always runs 100% in the EU; models outside the EU cannot be switched on there.
What data do we use?
• Your chats, uploads, and notes (for AI processing only)
• Usage data (for billing & rate limiting)
• Anonymous telemetry (app crashes, performance)
What we do NOT collect
How do we protect your data?
✅ Encrypted connections (TLS 1.3+)
✅ Hosted in the EU (in the Netherlands and elsewhere in the EU)
✅ No third parties (no third-party trackers or analytics on the portal)
✅ Full audit trail (who, what, when)
✅ Annual penetration tests & compliance checks
✅ GDPR Data Processing Agreement available
Your data rights
You have rights to: (1) access your data, (2) correct it, (3) delete it, (4) export it. Deletion is permanent.
How to exercise your rights
- Email privacy@aidg.nl with "GDPR Right: [Access/Deletion/Export]".
- We respond within 30 days.
- Deletion is permanent.
Complaints & escalation
Privacy questions: privacy@aidg.nl GDPR complaint: contact your local authority (e.g., Irish Data Protection Commission)
Data Processing Agreement (DPA)
For businesses requiring contractual data processing oversight we provide a standard GDPR DPA.
Security measures
| Measure | Details |
|---|---|
| Encryption | TLS 1.3+ in transit, AES-256 at rest |
| Hosting | Everything in the EU: website, portal and AI gateway in the Netherlands; chats and compute server on our own servers in the EU. See what runs where. |
| Audit trail | Complete logs of who, what, when |
| Testing | Annual pentests & compliance checks |
| Third parties | No third-party analytics or advertising trackers, no pixels or tracking |
Data retention
- Chats/uploads: until you delete them or close your account.
- Billing data: 7 years (legal requirement).
- Audit logs: 2 years (compliance).
- After deletion: 30-day backups, then permanently removed.
Questions or a complaint?
Privacy questions:
privacy@aidg.nl
GDPR complaint (escalation):
Autoriteit Persoonsgegevens (AP)