Why these rules
The goal is simple: help someone in Denmark or elsewhere in the EU pick a generative-AI tool without sending their work into a jurisdiction they can't reason about.
EU / EEA — included
The company is established inside the EU or EEA. GDPR applies directly, and supervision runs through a European data protection authority. No transfer mechanism is needed.
Adequacy countries — included with a note
- Switzerland — clean. Strong domestic privacy law, an adequacy decision, and no exposure to the US CLOUD Act.
- United Kingdom — watch. Adequacy holds today, but UK data law is diverging from GDPR and the decision is reviewed periodically.
- Ukraine — watch, excluded. No adequacy decision, so transfers need their own safeguards.
Out of scope
- United States. The CLOUD Act lets US authorities compel US providers to hand over data they control, wherever it is stored. That's a structural conflict with EU expectations, regardless of the vendor's intentions.
- China. Broad state access to data held by domestic providers, and no adequacy decision.
The three badges
The company behind the tool is headquartered in Europe, so European law governs the entity you contract with.
There is a documented option to have your data processed and stored on European infrastructure.
Model weights are published, so you can run the model on your own hardware — no data leaves your network.
Disclaimer
Independent, informational guide — not legal, security or compliance advice. Classifications describe company location, GDPR transfer status, data-residency options and licensing as of the date shown, from public sources. Adequacy decisions, ownership and offerings change; verify data-processing terms with the provider before use, especially for personal or sensitive data. No affiliation with any vendor.
This site sets functional cookies only — they remember your picker answers and directory filters. There is no analytics, no tracking, and no third-party fonts or scripts.