The short version: it stays with you. Wherever it is technically possible the system runs on your infrastructure rather than mine. The support-inbox agent I run today sits on the client’s own server, in their own environment. Nothing gets copied onto a machine of mine in order to be processed.
Where a model provider is involved, it is named in the contract before we start, together with what it does and does not do with what it sees. The processing agreement under Art. 28 DSGVO, with standard contractual clauses, is signed before anything touches real data.
I build against sample data you have cleared, not against your production records. If your data cannot leave the EU at all, tell me on the call. It narrows which models I can use, and that is much better to know in week one than in week four.