GDPR does not prohibit AI. It requires you to know what personal data goes where, on what basis, and to be able to honour a subject's rights afterwards — which is where LLM systems get interesting.
This is an engineering summary of how GDPR obligations shape the design of an AI system, not legal advice. Lawful basis, transfer mechanisms and the processor question depend on your specific configuration and contracts. Treat it as a guide to what to ask your counsel and your DPO, and check the date above.
Yes, with an appropriate transfer mechanism — the EU-US Data Privacy Framework where the provider is certified (in force at the time of writing, though subject to ongoing legal challenge), or standard contractual clauses with a transfer impact assessment. Many organisations prefer to avoid the question entirely by using EU-region endpoints, which most major providers now offer on at least one path. That is usually less work than defending a transfer.
It is a significant one, which is why the enterprise API paths of the major providers exclude it at the time of writing, and why we configure zero retention explicitly and confirm the provider's current terms per engagement. If personal data were absorbed into model weights, deletion becomes effectively impossible — there is no reliable way to remove a person from a trained model. Confirm the specific configuration rather than relying on a general policy statement.
The same bases as any processing — usually legitimate interests or contractual necessity for internal operational systems. Using a model does not create a new category. What it does add is the transparency obligation: your privacy notice should reflect that automated processing occurs and name the processors involved. Where a decision has legal or similarly significant effects, Article 22 brings additional requirements around human involvement.
Design for it: store conversations with a subject identifier so they are retrievable and deletable as a set. Systems that log to unstructured files with no subject linkage cannot answer an SAR without a manual search, which is both expensive and unreliable. This is a one-line decision at build time and a project to retrofit.
That constrains the architecture in ways worth settling in week one.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
