Is XICBOT GDPR-compliant?

Yes, XICBOT is designed for GDPR-compliant use, and data protection is part of the implementation from the start. Hosting is located in Germany and the answers are generated by a specialised model provider, also outside the EU on the basis of standard contractual clauses; there is a data processing agreement, a deletion concept and full data sovereignty on your side. Data is neither passed on nor sold.

Which data is processed how and how the assistant fits cleanly into your privacy policy is described on the privacy and hosting page. European or self-hosted language models are possible as a separate project by arrangement; they are not included in standard operation.

In operation this means concretely: a visitor's IP address is not stored in plain text but as a checksum with a fixed addition, and for IPv6 it is shortened as well. Eight object types carry their own deletion period, seven of which you set yourself. Without a set period nothing is deleted: an empty field expressly means no period and is something other than a zero.

The data processing agreement exists as text and can be retrieved in the account; the register of subprocessors lists the self-operated gateway for language models, behind which a specialised model provider generates the answers, also outside the EU on the basis of standard contractual clauses. Deleting an account requires a written-out confirmation word, writes the log line before the deletion and aborts if the deletion catalogue is incomplete. There is no certification; what was reviewed and what was not is stated on the privacy page.