Trust, data protection and AI

Last updated: 2026-08-15

Most tools in this space answer "is my data safe?" with a compliance badge. There is no GDPR certification for anyone to hold — the scheme the regulation provides for never became operational — so a badge is a company's opinion of itself, and nothing you can check.

This page instead states what is actually in place, names the contract each statement rests on, and sets out plainly what we do not claim.

If you are evaluating ChatURP for a customer site or an employer, this page plus the Privacy Policy is what your data-protection officer needs.

Your programs are never used to train AI models

This is contractual, not a policy we could quietly change: clause 4.2 of the OpenAI Services Agreement our account is on prohibits our model provider from using what we send to develop or improve its models unless we explicitly agree to that use. We have not agreed to it, and there is no setting on our account that opts in.

We do not train models on your data either, and we have licensed no one else to do so.

The model never receives your identity

Program generation runs server-to-server from our own backend. What the model provider receives is the instruction you typed, your program in our internal representation, and configuration read from any installation file you attached. A Diagnostics AI log analysis sends the log rows you selected, the problem description you typed, and the robot's own identity — model, serial number, software versions and installed URCaps — which is what lets it tell a firmware fault from a wiring one. A Performance report sends that same identity, the numbers its own analyzers measured from the recording, the support file's name and the date it was taken, and the program and installation file from inside it, because its AI review reads them. The AI program review sends a program, and the installation beside it, and no logs at all. The support file itself is never uploaded: it is read in your browser, and what leaves it is the material the section you asked for needs — never the whole file, and never the log rows for a report or the program for a log analysis.

What it does not receive:

• your name, email address, user id or account identifier
• your IP address — the connection is from our server, not your browser
• your billing data
• any pseudonymous handle: the API's optional user field is deliberately left empty

That is enforced in the code that builds the request, and covered by tests — not left to a reviewer to remember.

Your account data is stored in the EU

Programs, chats and account records live in a database in Stockholm, Sweden. Fonts are self-hosted. There is no third-party analytics, no advertising, no A/B testing and no session replay anywhere in the product. We keep only a small amount of first-party, aggregate feature-usage counting (which features get used), attributed to your account and deleted when you delete it — never shared or sold.

We set no cookies at all — every browser entry we use is local or session storage, each one strictly necessary, each one listed by name in Privacy § 5.

Every processor, named

• Under a GDPR Art. 28 processing agreement — five of the six. The sixth, Paddle (payments), is an independent controller under its Data Sharing Addendum on the EU Standard Contractual Clauses, not a processor under Art. 28 — the exact position for each is in Privacy § 3.
• Every transfer outside the EU — covered by the EU Standard Contractual Clauses, or by a Commission adequacy decision.
• Transfer impact assessment — carried out and documented for the US model provider, which is the one transfer that rests on the Clauses alone.

The transfer mechanism for each, and the precise contractual position — which agreement, which clause, how it binds — is set out processor by processor in Privacy § 3. We will point you to the current version of any of those agreements on request.

What we do not claim

This section is here because the opposite of each line is what a competitor would put on a badge:

• Not "EU-hosted AI". Model inference runs in the United States, on the EU Standard Contractual Clauses with a documented transfer impact assessment. Until 2 August 2026 it ran in China with no available safeguard at all; moving it is why the assessment exists. Saying "EU-hosted" would be simpler and untrue.
• Not "zero retention". Our provider, OpenAI, holds prompts and outputs for up to 30 days in abuse-monitoring logs before deleting them — its default for API traffic, and not something we can switch off from our side. Repeated context is additionally cached so a long conversation is not re-processed from scratch on every turn. None of it may be used to train or improve a model; retention and training are different questions and we answer them separately.
• Not "anonymous". We strip account identity, but your prompt is free text and your program carries names you chose. If you type a colleague's name or a customer site into a prompt, it is transmitted. Treat prompts the way you would treat any text leaving your network.

Your controls

• Export everything we hold, in a machine-readable format — Account → Profile.
• Delete your account and its data from the same place. The invoices are issued and kept by Paddle, our merchant of record, for the ten years § 147 AO requires; the billing data we hold on your account is deleted along with everything else.
• Full rights under Art. 15-21 GDPR, self-service where possible and by email otherwise: [email protected].

If your own compliance file needs an Art. 28 processing agreement with us, write to the same address and we will sort it out with you.

Operator and contact details: Imprint · Full disclosure: Privacy Policy · Questions: [email protected]