Firmware

Firmware states customer data and content are stored and processed in the geographic region specified on the order form or otherwise agreed in writing, and customers may request a separate specific geographic region where supported. However, the public subprocessor list names only US-located subprocessors (AWS, MongoDB, Google Cloud, OpenAI), and the DPA states customers may transfer personal data to Firmware in the United States.

Privacy Policy: personal data is retained as long as necessary for the stated purposes; if a customer has a Customer Agreement, deletion follows that agreement; when no ongoing legitimate business need or legal reason remains, data is deleted or anonymized, or securely isolated until deletion is possible. DPA: on termination of the services or upon reasonable request, Firmware will return or delete DPA data unless retention is legally required.

Firmware says customer data/content received through the services is processed on behalf of customers under the customer agreement. The website states 'Your data stays yours—never used for training.' Firmware separately says it uses publicly available legal information to develop and improve its AI platform.