Procurement, answered in advance

Who is the supplier?

FRITS AI ApS, Nyhavn 38, 1051 København K, Denmark. Company registration (CVR) 45733785, VAT DK45733785.

What is the supplier's role under the GDPR?

Processor. You are the data controller; we process personal data solely on your documented instructions, under an Article 28 data processing agreement.

Is there a data processing agreement, and must we negotiate it?

Yes, and no. It is pre-signed and downloadable at gdprchat.eu/dpa.

Which AI models are used, and where do they run?

Chat answers: Mistral Large (Mistral AI, Paris, France (EU)); Understanding your request: Mistral Large (Mistral AI, Paris, France (EU)); Reading images you share: Mistral Medium (Mistral AI, Paris, France (EU)); Writing code, diagrams & interactive apps: Qwen 3.5 (Scaleway Generative APIs, Paris, France (EU)); Analysing documents: Mistral Large (Mistral AI, Paris, France (EU)); Everyday assistance (titles, summaries, suggestions): Mistral Small (Mistral AI, Paris, France (EU)); Searching your knowledge & the help centre: Mistral Embed (Mistral AI, Paris, France (EU)); Voice input: Voxtral Mini (Mistral AI, Paris, France (EU)); Generating images: FLUX.2 [klein] (IONOS, Germany (EU))

Where is personal data processed?

Every function above runs on European infrastructure, operated by European providers, under EU data-protection law. We run the best self-hostable AI models in the world for each task — never one only reachable through a single company's own service. Your data is processed and stored in Europe, and every company we hand it to is a European company. "Best" is measured, not asserted: every candidate model is tested against the one already running — same tasks, same day — and must match or beat it on tool use, on all 27 languages, and on values before it serves anyone. The full method is published research, linked from gdprchat.eu/transparency.

How do you know these are the "best" models?

Every candidate model is measured against the model already in production — same tasks, same day — and must match or beat it on tool use, on all 27 languages we ship, and on values (censorship and political bias) before it serves a single request. The full method, including candidates we rejected and the transcripts, is published: https://frits.ai/research/how-to-pick-the-best-language-model/ The censorship and bias testing is documented separately: https://frits.ai/research/language-dependent-political-bias/

Are there transfers outside the EU/EEA?

Two, neither of them involving your stored content. (1) Sign in with Apple and iOS App Store purchases involve Apple Inc. (United States), under the EU-US Data Privacy Framework adequacy decision (Art. 45), to which Apple is certified. (2) Map tiles and reverse geocoding involve the OpenStreetMap Foundation (United Kingdom), under the UK adequacy decision. Web search is not one. The query text goes to Linkup, a French company that runs its search infrastructure in the EU, the United States, Canada and Asia-Pacific, so a query may be answered from any of them — but what leaves our servers is a query the assistant composed, with no account, no user identifier and no IP address attached, and never your stored content. Nothing in it points to a person, so no personal data leaves the EU when a search runs. All storage and all model inference stay in the EU/EEA. The full clause is in the data processing agreement at gdprchat.eu/dpa.

Where do web searches go?

To Linkup, in France. A search index is handed a query and returns links — no user, no account and no company travels with it, and no identifier or IP is attached, so a search cannot be tied to a person. The selection is still ours: we decide which sources are quoted and which propaganda outlets are not. Linkup is a French company and operates its search infrastructure in the EU, the United States, Canada and Asia-Pacific, so a query may be answered from any of them. It is our own outbound request and carries nothing that identifies anyone, so no personal data leaves the EU when a search runs — which is why it is not among the transfers above.

Who are the sub-processors?

Mistral AI SAS — AI language model processing, text embeddings, and voice transcription — Paris, France (EU); Scaleway SAS — AI language model processing (currently code generation, and chat overflow when the primary provider is at capacity) — Paris, France (EU); Hetzner Online GmbH — Infrastructure hosting (servers, database, file storage) — Gunzenhausen, Germany (EU); IONOS Cloud GmbH — AI image generation and image editing — Berlin, Germany (EU); Mollie B.V. — Payment processing — Amsterdam, Netherlands (EU); Scaleway SAS — Transactional email delivery — Paris, France (EU). Those are the Article 28 processors. Three further companies receive something without being processors: Linkup (a French company — web-search query text), Apple Inc. (sign-in and iOS purchases) and the OpenStreetMap Foundation (map tiles). Apple and the OpenStreetMap Foundation appear among the transfers answered above. Linkup does not: the query carries no account, no user identifier and no IP address, so no personal data goes with it.

Is our content used to train models?

No. Your content is never used to train models, ours or anyone else's.

Can an administrator read an employee's conversations?

No. An administrator manages people, spending and limits. Conversations are not visible to them.

May we process sensitive personal data (Art. 9)?

Yes, on your lawful basis as controller, and on your documented instructions. Identifiers are additionally masked in the browser before anything is sent.

What happens when an employee leaves?

You remove them and their access to company data ends immediately. They keep their own personal account; the company keeps the work.

How do we exercise data subject rights (Art. 15–20)?

Every person can export or delete their own data from inside the product, without contacting anyone. Controller-side requests go to support@frits.ai.