EU Compliance: GDPR and the AI Act

Last updated: 13 July 2026. Claims reflect the product as of this date. The AI Act is being applied progressively through 2026 and 2027, and the underlying infrastructure controls change over time, so reach out for the current state before contracting.

Dispatch is a local-first desktop application. On the free tier it runs entirely on your machine, and your source code, agent transcripts and API keys never reach Ad Astra. The cloud features are opt-in: Pro adds hosted model inference, and Team adds cloud-stored organization metadata. This page sets out, in engineering terms, how that architecture intersects with the EU AI Act and GDPR, and what Dispatch does not deliver on its own.

Not legal advice. This page describes Dispatch's compliance posture in engineering terms. It is not legal advice, does not create a lawyer-client relationship and does not substitute for your own regulatory assessment. Where a specific obligation is in play, consult qualified counsel in the relevant jurisdiction.

What runs where

The data-protection story starts with the architecture. Dispatch keeps the sensitive material on your machine and moves only what a given tier needs to the cloud.

• Free tier (local only). The desktop app and its SQLite database run on your machine. Source code, project files, agent transcripts, goal and spec content, secret-scanning findings and third-party API keys stay in ~/.dispatch/ and are never transmitted to Ad Astra. On this tier Ad Astra processes no personal data on your behalf and is not your processor.
• Pro (opt-in cloud inference). Prompts and tool results for the hosted models are sent to Cloudflare Workers AI for inference only. Prompt content is not logged, cached or retained after the response. Only usage metadata (model name, token counts, latency, cost) is stored, for billing.
• Team (opt-in cloud metadata). Organization metadata moves to the cloud: organization name, member list, role assignments, invitations, settings, usage metrics, billing data and audit-log entries. Source code, agent transcripts, spec content and implementation detail remain local and are never stored in the cloud.

Third-party model providers

Dispatch orchestrates coding agents that you run under your own accounts: Claude Code, OpenAI Codex and Google Gemini. Prompts go directly from your machine to the provider you configured. Dispatch does not proxy, intercept, log or modify that traffic, and has no visibility into what you send to or receive from those services. For those interactions you are the controller and the provider's own terms and privacy policy govern the processing. This matters for regulatory allocation: obligations that attach to a general-purpose AI model rest with the model provider, not with Dispatch as the downstream tool that calls it.

GDPR (Regulation 2016/679)

Controller and processor roles

The roles follow the tiers. For the free, local-only tier, Ad Astra receives no personal data and is neither controller nor processor for your work. For Team cloud-stored organization data, and for Pro hosted inference where Ad Astra processes the prompt content to provide the inference service, the customer is the Controller and Ad Astra Computing Inc. is the Processor, processing personal data only on the customer's documented instructions, as set out in the Data Processing Agreement. Ad Astra is the controller for billing, account, support and other data it collects directly. Confirm the role for your specific deployment before contracting.

Data subject rights (Articles 12 to 22)

For cloud-stored organization data, rights are exercised through the account or by writing to [email protected]. Organization admins can export audit logs at any time, correct organization fields in settings and request deletion. On cancellation, cloud personal data is deleted within thirty days. Rights apply where the conditions in the relevant article are met; we may need to verify identity before acting. Free-tier local data is under your sole control, so access, correction and deletion happen on your own machine without involving Ad Astra.

International transfers (Chapter V)

Where personal data of EU residents is processed outside the European Economic Area, the transfer mechanism is the EU Standard Contractual Clauses, reflected in the DPA. The subprocessor list is published at withdispatch.dev/subprocessors, with changes dated there.

Retention

Free-tier data lives on your machine for as long as you keep it; uninstalling the app does not delete the ~/.dispatch/ directory, so you remove it yourself. For Team cloud data, organization records are retained during the active subscription and deleted within thirty days of cancellation. Audit-log retention is configurable. Team BYOK model keys are encrypted at rest, never returned after submission and deleted when removed or when the organization is cancelled.

EU AI Act (Regulation 2024/1689)

What Dispatch is under the Act

Dispatch is a development tool that orchestrates general-purpose AI models under mandatory human review. It does not train, fine-tune or deploy models of its own. In its standard use, assisting a developer with coding tasks, it is not a high-risk AI system under Annex III, which covers uses such as employment decisions, biometric identification and critical-infrastructure management. A customer who configured Dispatch inside an Annex III workflow would take on the provider obligations for that classification; there is no self-serve path to such a configuration.

Article 50 transparency

Article 50 requires that a natural person interacting with an AI system is informed of that fact. In Dispatch the person interacting with the agents is the developer who invokes them, so the interaction should be obvious from the product context and interface. Dispatch does not use agents to contact third parties on a user's behalf, and it should not be used to present AI output to third parties without appropriate disclosure.

Human oversight is structural

Dispatch is spec-first and review-gated. An agent proposes a plan and a change; a human approves before anything is applied. Agent runs execute in worktree isolation, destructive commands such as rm -rf, force pushes and sudo are blocked, and files are scanned for secrets on write. The oversight the AI Act expects for higher-risk automation is built into the normal workflow rather than added as an afterthought.

Telemetry

Product telemetry is anonymous and carries no source code, prompt content or agent output. It covers app version, operating system, feature-usage counts and error stack traces. It is off by default; a user turns it on in Settings under Privacy, and can turn it back off at any time. See the privacy policy for the full event list.

Data residency

Free-tier data stays on your machine. The cloud services (Team metadata, Pro inference, account, billing) run on Cloudflare's edge and other subprocessors listed on the subprocessors page, spanning EU and US regions. An EU-region processing configuration for Team deployments is available subject to a scoped implementation review and the subprocessors' own product limits; it is not the default deployment.

Claim matrix

Procurement

European procurement enquiries (DPA discussions, subprocessor questions, security questionnaires, regulated-use scoping):

• Data processing, DPA, subprocessor questions: [email protected]
• Legal, licensing, contract artefacts: [email protected]
• Security questionnaires and threat-model questions: the security category on the support form
• Team plans, volume pricing, regulated-use scoping: [email protected]

Contract artefacts (data processing addendum, standard contractual clauses where applicable, subprocessor list, security questionnaire responses) are available on request through the addresses above.

Ad Astra Computing, Inc. is a Delaware corporation. We do not currently operate an EU legal establishment, appoint a GDPR Article 27 representative or appoint an AI Act Article 22 authorised representative, because the standard Dispatch deployment falls outside the scope that triggers either appointment. Customers whose deployment or processing footprint requires any of these should reach out before contracting. For Ad Astra's lab-level EU positioning across the rest of the stack, see adastracomputing.com/eu.