AI models and your data

What happens to your data

The AI tools I set up and use in the work run on large language models online, on the servers of the AI provider. Whatever a tool reads to do a task (a mail, a document, a file name, a calendar entry) is sent to those servers and processed there.

The models I work with are run by a US-based provider, so the data is processed outside the European Union. The legal basis for that transfer outside the EU is the one the provider states in its terms; our written agreement names the provider.

How long the provider keeps that data, whether its staff can see it and whether it is used to improve its models is decided by the provider’s own terms. Those terms depend on the account and its plan, and they can change.

The services the tools connect to, such as your own mail, calendar and file storage, keep your data under your own accounts and their terms.

What I do not promise

No guarantee of data safety, no guarantee that data is processed only within the European Union, and no promise that using these tools makes your business compliant with data-protection law. My own duties under data-protection law stay, and our written agreement sets them out.

The tools do not run offline or on your own servers alone: they need the online model to work.

The risks

Data sent to an online provider can be exposed by a breach or a mistake on its side, kept longer than you expect, or reached under the laws of the provider’s country, including requests by its authorities.

A model can misread, mix up or invent things, and it can be misled by instructions hidden in a mail or document it reads. What it produces needs a person’s check before anyone relies on it.

The risk is highest for sensitive data: health, finances, and other people’s personal details.

Who decides what

You choose the AI account and its plan, and you agree to the provider’s terms yourself.

You decide which of your data the tools may see, and you can keep any of it out.

Mails and documents often contain other people’s details: your clients, suppliers, colleagues. Because you decide what the tools may see, you are responsible toward those people for that use, for example in your own privacy notice.

You accept these risks in our written agreement before any work with your data begins.

I set the tools up carefully, tell you in writing what goes where, give each tool only what its task needs, and leave sending, paying and deleting with you. The written agreement also sets out my own duties in handling your data.

Questions

Write to marci@narrativa.dev before any of your data is involved. How this website itself handles data is on the privacy page.