GDPR: the facts for your data protection team.
Kyros is hosted in Germany. Whether your deployment meets the GDPR also depends on how you configure it — so here are the facts: from the data processing agreement and legal bases to per-workspace data export and deletion.
Data protection that isn’t bolted on afterwards.
Hosted in Germany
API and database run in Frankfurt am Main. Every message is also processed by the provider of the chosen AI model, not always in Germany.
DPA on request
A data processing agreement (DPA/AVV) under Art. 28 GDPR is available on request.
Legal bases
Processing based on Art. 6(1)(b) GDPR (contract) and (f) (legitimate interest).
In-widget privacy panel
Every widget shows an AI notice and a privacy panel for end users — right inside the chat.
Configurable retention
Retention per assistant: platform default, never store, or a custom inactivity period.
Data export & deletion
Export and delete data per workspace — for access and erasure requests.
Sub-processors
To deliver the service, Kyros uses carefully selected sub-processors, including Google/Firebase (infrastructure & authentication) and Vercel (hosting/delivery). We provide details and the current list as part of the DPA.
GDPR FAQ
Is Kyros GDPR-compliant?
Whether your deployment meets the GDPR also depends on how you configure it. The facts: Kyros is hosted in Germany, with the API and database in Frankfurt am Main. Every message is also processed by the provider of the chosen AI model, not always in Germany. On top come a DPA under Art. 28 GDPR, an in-widget privacy panel, configurable retention and per-workspace data export and deletion.
Can I get a data processing agreement (DPA)?
Yes. A DPA/AVV under Art. 28 GDPR is available on request.
On what legal basis is data processed?
Processing relies in particular on Art. 6(1)(b) GDPR (performance of the contract) and (f) (legitimate interest).
Which sub-processors are used?
Kyros uses Google/Firebase for infrastructure and authentication and Vercel for hosting/delivery, among others. We provide the current list as part of the DPA.
How are end users informed about data protection?
Every widget includes a privacy panel explaining what data is processed, on what legal basis and for how long.
Privacy-conscious AI, hosted in Germany.
Free plan, no credit card. DPA available.