GDPR & compliance
GDPR and AI – where SovrGPT stores and processes data, which service providers are involved, when data leaves the EU and how to get a DPA.
This page describes where SovrGPT stores and processes your data, which service providers are involved and in which cases data leaves the EU. The provider and contracting party is rooom AG (Jena, Germany). The privacy policy applies in addition.
In short
| Question | Answer |
|---|---|
| Where is data stored? | Accounts, chats, attachments and the knowledge base are stored encrypted in a data centre in Frankfurt. |
| Where does the application run? | Its server functions run in a data centre in Frankfurt. |
| Where do the AI models run? | In data centres in the EU and the EEA: self-operated models on rented GPU servers (France, the Netherlands, Romania, Sweden, Czechia, plus Iceland and Norway), partner models in a European partner data centre (Ireland/Finland) and at STACKIT (Germany). New chats start with Auto by default: a model at STACKIT reads the beginning of the first message and then picks a model in the partner data centre or at STACKIT. |
| Does data leave the EU? | Storage and processing happen in the EU. Self-operated models may also run in Iceland or Norway; both belong to the EEA, where the GDPR applies directly. The exceptions are web search (USA), fetching web pages (servers anywhere in the world), and connectors or own models that your organisation sets up itself. |
| Where are the service providers based? | Several outside the EU, mostly in the USA, even where their data centres are in the EU. Details in the table below. |
| Are large cloud providers used? | Indirectly, yes. Several service providers run their services on AWS or Google Cloud infrastructure in the EU. |
| Who is responsible? | Your organisation, for the content; rooom AG processes it on your behalf. For user accounts and running the platform, rooom AG is itself the controller. |
| Is data used for training? | We do not use your inputs or outputs for training. By contract, the European partner data centre does not store them. |
Data processing agreement (DPA)
A data processing agreement under Art. 28 GDPR with rooom AG is available on request. The contact details are in the privacy policy. eNetworkers GmbH (Jena) supports rooom AG with development and technical operations on rooom AG's behalf.
Service providers and data flows
The table lists the categories of recipients (Art. 13(1)(e) GDPR). You can get the full list with legal entity, address, processing location and contractual basis on written request to dsb@landgraf-datenschutz.de.
| Category | When | Data centre | Provider based in |
|---|---|---|---|
| Hosting of the web application and the APIs | always | Frankfurt | USA |
| Sign-in, database, file storage | always | Frankfurt | Singapore |
Self-operated AI models; also images, video, special voices, designing your own voices and, through the API, reranking with bge-reranker-base (POST /v1/rerank) | depending on model and feature | France, the Netherlands, Romania, Sweden, Czechia, Iceland, Norway | USA |
| AI models in the European partner data centre | default with Auto for reasoning tasks, programming and interactive apps, otherwise depending on model; also reranking the hits from the knowledge base in the chat when Gemma 4 31B · STACKIT is busy, faulty or unreachable, or is hidden in your organisation – in each case only if “Qwen 3.8 27B · Irland/Finnland” is visible in your organisation | Ireland, Finland | Ireland |
| AI models at STACKIT | default with Auto for everyday questions and questions about images, otherwise depending on model; in addition, a model reads the beginning of your message to pick a suitable model with Auto and to recognise whether you want a file (Word, Excel, PDF, slides) to be created; also embedding for the knowledge base (documents on upload, questions on search), reranking its hits in the chat and, through the API, embedding with stackit-qwen3-vl-embedding-8b or stackit-e5-mistral-7b | Germany | Germany |
| Dictation, reading aloud with the default voice, voices from the voice catalogue, storage of designed voices (Mistral AI) | when dictating, reading aloud, designing a voice | EU endpoint | France |
Reading aloud in languages that neither Mistral nor the special voices speak (e.g. Turkish, Ukrainian, Polish, Romanian), and with an explicitly chosen Supertonic voice (M1–M5, F1–F5) | only in these cases | Netherlands | USA; according to the provider's contract, processing takes place mainly in the USA |
| GovBridge (connection to specialist procedures) | GovBridge customers only | Netherlands | USA |
| Transactional e-mail (sign-in codes, invitations, system notifications) | sign-in, invitations | Ireland | USA |
| Error analysis | on errors; load times for roughly every tenth request | Germany | USA |
| Web search (Brave Software, Inc.) | only with web search switched on | USA | USA |
| Fetching web pages | only with web search switched on | wherever the page is hosted | operator of the page |
| Connectors and own models of your organisation | only once your organisation sets them up | depends on the provider | depends on the provider |
| Development and technical operations (eNetworkers GmbH) | ongoing | – | Germany |
Several service providers are based outside the EU, even where their data centres are in the EU. Companies based in the USA may be obliged under US law to give authorities access to data, even if that data is stored in the EU.
For every model operator, subcontractors that use the infrastructure of large cloud providers may be involved. The transfer safeguards that apply to each service provider are included in the list you can request.
Web search and fetching web pages
Web search sends search queries to the Brave Search API of Brave Software, Inc. (USA). When it is switched on:
- Chat: per conversation via the switch, off by default. It is also on whenever the knowledge source "Web" or "Knowledge base + web" applies, including as your organisation's default.
- Agents: per agent, off by default.
- Scheduled tasks: per task; it is preselected when you create one.
- Excel add-in: on by default, can be switched off with the "Web search" switch.
- MCP interface: programs to which your organisation has given an API key with MCP permission can call it directly. The program then writes the query.
Only the search query and technical parameters are sent, from our server, not from your device. Your conversation, your attachments and your workbook are not sent. The model does derive the query from the conversation or the spreadsheet, though, so it can contain terms from them. If you have to rule that out, leave web search off.
According to Brave, it keeps logs of search queries for up to 90 days in the USA. Brave takes the position that search query data falls outside the material scope of the GDPR and excludes it from its data processing agreement. That assessment is Brave's own, not ours; it does not replace a transfer mechanism.
When web search is on in a chat or a scheduled task, the model may also fetch public web pages there, for example an address you pasted into the chat. The operator of the page sees the fetched address and the address of our server. The page can be hosted in any country.
Which data is processed?
- Account data: e-mail address and profile details such as the display name.
- Chat content: your inputs, the models' answers, attachments.
- Connectors: only what the respective connector explicitly loads, e.g. Notion pages or GitHub issues.
- Excel add-in: with every instruction, a description of the workbook (sheets, column headings, formula patterns, the selection and, by default, up to five sample rows per sheet). The model can read further cell ranges. The task pane loads the library from Microsoft that every Office add-in needs. More under Excel add-in.
- Error analysis: on errors, the error message, code location, browser and requested address; for roughly every tenth request, load-time measurements. We redact access codes in addresses before sending. We do not send a user ID.
- Server logs: technical details of requests, e.g. method, path, status code and duration.
Deletion
- Chats you delete yourself at any time. Decks (crafts) from a chat are kept when you do; you find them under "Crafts" in the sidebar. Deleted crafts are marked as deleted and can no longer be opened, not even through shared links.
- Organisations are deleted on request, together with their chats, connectors and API keys.
- Accounts are deleted on request, together with the profile and memberships.
Rights of the data subject
You can request access, rectification, erasure and data portability (Art. 15–20 GDPR) informally from rooom AG; the contact details are in the privacy policy. You can change your display name yourself in your profile. We respond within one month.