「 Legal · GDPR 」

We Manufacture Attention.
Not Data Scandals.

Bernays believed in the power of trust. So do we. PRAI is fully GDPR compliant — by design, not by afterthought.

Last updated: March 16, 2026 · Applies to all prai.press services

Our GDPR Commitment

The General Data Protection Regulation (GDPR) gives EU residents control over their personal data. As a company registered in Brussels, Belgium, PRAI complies fully with all GDPR requirements.

  • • Legal basis: Contract performance (to deliver our service) and legitimate interest (to improve our platform).
  • • Data sales: We never sell your data. To anyone. Ever.
  • • Sub-processors: We only share data with GDPR-compliant processors bound by DPAs.
  • • AI training: Your content is never used to train third-party AI models.
  • • Data location: Primary data storage in EU (Belgium). US transfers via Standard Contractual Clauses.

Data Subject Rights

Your Rights. Non-Negotiable.

Right of Access

Request a complete copy of all personal data we hold about you. We respond within 30 days.

Right to Rectification

Correct inaccurate or incomplete personal data at any time.

Right to Erasure

Request deletion of your data ("right to be forgotten"). We comply within 30 days.

Right to Portability

Receive your data in machine-readable format (JSON/CSV) for transfer to another service.

Right to Object

Object to processing based on legitimate interests or for direct marketing purposes.

Right to Restriction

Request we pause processing while a dispute is being resolved.

Data Processors & Transfer Mechanisms

All processors are bound by Data Processing Agreements. Cross-border transfers use Standard Contractual Clauses (SCCs).

ProcessorPurposeLocationDPA
SupabaseHosting, database, authenticationEU✅
StripePayment processingEU / US (SCCs)✅
ResendTransactional email deliveryUS (SCCs)✅
AnthropicAI press release generationUS (SCCs)✅
OpenAIAI content optimisationUS (SCCs)✅
DeepSeekAI draft generationUS/EU (SCCs)✅
LovablePlatform hosting & cloudEU✅

Data Breach Protocol

In the unlikely event of a data breach affecting your personal data, PRAI will:

  • • Notify the Belgian DPA within 72 hours of becoming aware of the breach (as required by Art. 33 GDPR).
  • • Notify affected users without undue delay if the breach poses a high risk to their rights and freedoms (Art. 34 GDPR).
  • • Document the breach including facts, effects, and remedial actions taken.
  • • Implement corrective measures to prevent recurrence.

Exercise Your Rights

Access, correct, export, or delete your data. We respond within 30 days — usually much faster.

privacy@prai.press

Complaints: Belgian Data Protection Authority · PRAI · Brussels, Belgium