Procurement, answered in advance

Who is the supplier?

FRITS AI ApS, Nyhavn 38, 1051 København K, Denmark. Company registration (CVR) 45733785, VAT DK45733785.

What is the supplier's role under the GDPR?

Processor. You are the data controller; we process personal data solely on your documented instructions, under an Article 28 data processing agreement.

Is there a data processing agreement, and must we negotiate it?

Yes, and no. It is pre-signed and downloadable at gdprchat.eu/dpa. You do not have to ask for it and you do not have to wait for us to sign.

Which AI models are used, and where do they run?

Chat answers: Mistral Large (Mistral AI, Paris, France (EU)); Understanding your request: Mistral Large (Mistral AI, Paris, France (EU)); Reading images you share: Mistral Medium (Mistral AI, Paris, France (EU)); Writing code, diagrams & interactive apps: Qwen 3.5 (Scaleway Generative APIs, Paris, France (EU)); Analysing documents: Mistral Large (Mistral AI, Paris, France (EU)); Everyday assistance (titles, summaries, suggestions): Mistral Small (Mistral AI, Paris, France (EU)); Searching your knowledge & the help centre: Mistral Embed (Mistral AI, Paris, France (EU)); Voice input: Voxtral Mini (Mistral AI, Paris, France (EU)); Generating images: FLUX.2 [klein] (IONOS, Germany (EU))

Where is personal data processed?

Every function above runs on European infrastructure, operated by European providers, under EU data-protection law. We run the best self-hostable AI models in the world for each task — never one only reachable through a single company's own service. Your data is processed and stored only in the EU. "Best" is measured, not asserted: every candidate model is tested against the one already running — same tasks, same day — and must match or beat it on tool use, on all 27 languages, and on values before it serves anyone. The full method is published research, linked from gdprchat.eu/transparency.

How do you know these are the "best" models? Who decides, and how?

Every candidate model is measured against the model already in production — same tasks, same day — and must match or beat it on tool use, on all 27 languages we ship, and on values (censorship and political bias) before it serves a single request. A model that wins the headline benchmark but regresses in one language does not ship. The full method, including candidates we rejected and the transcripts, is published: https://frits.ai/research/how-to-pick-the-best-language-model/ The censorship and bias testing is documented separately: https://frits.ai/research/language-dependent-political-bias/

Are there transfers outside the EU/EEA?

Two, each with a stated legal basis, and neither involving your stored content. (1) Sign in with Apple and iOS App Store purchases involve Apple Inc. (United States), under the EU-US Data Privacy Framework adequacy decision (Art. 45), to which Apple is certified. (2) Map tiles and reverse geocoding involve the OpenStreetMap Foundation (United Kingdom), under the UK adequacy decision. Web search is not a transfer: query text goes to Linkup, in France, with no user identifier and no IP address attached, so a query cannot be tied to a person. Everything else — all storage, and all model inference — stays in the EU/EEA. The full clause is in the data processing agreement at gdprchat.eu/dpa.

Where do web searches go?

To Linkup, in France. A search index is handed a query and returns links — no user, no account and no company travels with it, and no identifier or IP is attached, so a search cannot be tied to a person. The selection is still ours: we decide which sources are quoted and which propaganda outlets are not. Because the index is in the EU, web search is not one of the transfers above.

Who are the sub-processors?

Mistral AI SAS — AI language model processing, text embeddings, and voice transcription — Paris, France (EU); Scaleway SAS — AI language model processing (currently code generation, and chat overflow when the primary provider is at capacity) — Paris, France (EU); Hetzner Online GmbH — Infrastructure hosting (servers, database, file storage) — Gunzenhausen, Germany (EU); IONOS Cloud GmbH — AI image generation and image editing — Berlin, Germany (EU); Mollie B.V. — Payment processing — Amsterdam, Netherlands (EU); Scaleway SAS — Transactional email delivery — Paris, France (EU). Those are the Article 28 processors. Three further recipients are not processors: Linkup (France, EU — web-search query text), Apple Inc. (sign-in and iOS purchases) and the OpenStreetMap Foundation (map tiles). The last two are the transfers answered above; Linkup is inside the EU and is therefore not one.

Is our content used to train models?

No. Your content is never used to train models, ours or anyone else's.

Can an administrator read an employee's conversations?

No. An administrator manages people, spending and limits. Conversations are not visible to them.

May we process sensitive personal data (Art. 9)?

Yes, on your lawful basis as controller. Processing personal data on your documented instructions is exactly what a processor is for — for Danish social work, for example, that is ordinary and well-trodden. Identifiers are additionally masked in the browser before anything is sent.

What happens when an employee leaves?

You remove them and their access to company data ends immediately. They keep their own personal account; the company keeps the work.

How do we exercise data subject rights (Art. 15–20)?

Every person can export or delete their own data from inside the product, without contacting anyone. Controller-side requests go to support@frits.ai.