GDPR summary.

ErmisAI acts as a controller for website, account, billing, and direct business operations. For newsroom content and user data processed on behalf of customer organizations, ErmisAI may also act as a processor under the customer's instructions.

Depending on the activity, ErmisAI may rely on:

• contract performance for account access and subscription delivery,
• legitimate interests for service security and operational integrity,
• legal obligations for billing or compliance records,
• consent where required for optional communications or future tracking features.

Data subjects may have rights to:

• access their personal data,
• correct inaccurate data,
• request deletion where no overriding basis exists,
• restrict or object to certain processing,
• receive portable copies where applicable,
• complain to a supervisory authority.

ErmisAI uses third-party providers for authentication, billing, AI processing, object storage, and operational infrastructure. Where those providers act as subprocessors or importers, the relevant provider terms and customer contract govern the transfer safeguards.

ErmisAI applies data minimization and retains data according to the role each record plays in account management, billing, security, support, and newsroom workflow operations.

When ErmisAI acts only as a processor for a customer organization, requests involving newsroom workspace data may need to be handled with that customer. ErmisAI supports that process through tenant-scoped access controls, audit records, and customer-specific contract terms.