GenOverview

How we reached this

Dutch legal entity: Fedelta Media, KvK 55262937, VAT NL001127824B28, Jipsingboertangerweg 109, 9551 TP Sellingen, from app.genoverview.com/policy (last updated 2026-08-19, read 2026-08-24). COMPLIANT on the evidence the policy carries: the controller is identified, a legal basis is given per purpose, retention periods are specific, data subject rights are set out with the Autoriteit Persoonsgegevens named as the complaint route, sub-processors are named (Mollie, Moneybird, Fedelta Media, Cloudflare incl. Turnstile), hosting and encrypted backups are stated as within the EU on Fedelta Media's own infrastructure, and only strictly necessary cookies are used. No customer-facing DPA is published, and for this tool none is required: section 1.1 states Fedelta Media is the data controller, and GenOverview tracks public domains in AI-generated answers rather than processing personal data on a customer's behalf, so there is no Article 28 controller-to-processor relationship to paper. An earlier version of this listing rated the tool PARTIAL for lacking that document, which was our error. Foreign disclosure exposure is NONE: no US provider physically holds the data. It sits on Fedelta Media's own EU infrastructure, which the vendor states is Hetzner in Germany with backups in Helsinki, and Cloudflare's role is DNS, proxy and Turnstile rather than storage. An earlier version of this listing recorded US CLOUD Act exposure on the basis that Cloudflare is American; that was our error too, since the standard applied here is whether a US provider holds the data, as it does for Rankscale (Google Cloud, Iowa) and Otterly.ai (North Virginia). Schrems II risk is nonetheless MEDIUM, which is a separate question from disclosure exposure: Cloudflare terminates TLS in the request path, and the policy names it among the third parties without documenting what safeguard that transfer relies on. The vendor additionally stated by email that hosting is Hetzner in Germany with backups in Helsinki and that there is no non-EU parent. Neither appears in the published policy, so neither is recorded here as fact; note that Helsinki is within the EU and so does not conflict with the published statement.