Does Innguma train its AI on our organisation's data?

Why does this question matter in watching?

What an organisation watches reveals its strategy: which competitors it follows, which technologies it studies, which markets it plans to enter. If that data were used to train a shared model, part of that knowledge could influence the answers given to third parties. The question is therefore not only one of privacy, but of competitive confidentiality.

What does European regulation say about training models on data?

• Purpose limitation. The GDPR requires personal data to be collected for specified purposes and not to be processed afterwards in a way incompatible with them (Article 5.1(b))^[1].
• Processor. When a provider processes data on behalf of a customer, it does so under contract and following its documented instructions (Article 28)^[1]. If the provider decides on its own to use the data for other purposes, such as training its models, it is considered a controller for that processing (Article 28.10).
• Models and personal data. The European Data Protection Board, in its Opinion 28/2024 of December 2024, concluded that a model trained on personal data cannot in all cases be considered anonymous, and that anonymity must be assessed case by case^[2].
• Agents’ memory. The AEPD notes, in its February 2026 guidance on agentic AI, that language models have no memory of their own: memory is added as a separate component, and its records can be a protective measure or a risk if they are used for other purposes^[3].

How do the conditions change by provider and plan?

A lot, and from one year to the next. Two examples from official documentation, as of October 2026:

The practical lesson: the answer depends on the plan, not on the brand. Always check the provider’s current documentation, with its date, rather than third-party summaries.

How does this apply at Innguma?

• Innguma does not train AI models on its customers’ data.
• Data processing complies with the GDPR.
• Innguma’s AI filters, groups duplicates and classifies each signal; it does not decide on behalf of your team.
• The systems that support its managed watch services are certified under the National Security Framework at MEDIUM category (certificate 34/5704/24/05039, OCA Global, valid until June 2028), in accordance with Royal Decree 311/2022^[6][7].

And if you connect your assistant through MCP?

Through MCP, ChatGPT, Claude, Microsoft Copilot and Gemini can work with the knowledge and capabilities that Innguma makes available to each integration. That Innguma does not train models on your data does not change the assistant’s conditions: what it receives in the conversation is governed by its provider and by your organisation’s plan. The MCP specification notes that the protocol cannot itself impose privacy principles; they depend on each implementation^[8].

What questions should you ask any AI provider?

1. Is our data used to train or improve models? Where is this recorded in writing, and with what date?
2. Does the provider act as a processor, and is there a contract compliant with Article 28 of the GDPR?
3. How long are conversations and logs retained?
4. What happens to the data when the contract ends?
5. Which certifications back the systems, with what scope and until when?