WordLift

GDPR overview

WordLift is established in Rome, so no Article 27 representative is required or named. It runs a dedicated GDPR page and a rights request form at wordlift.gdprform.io, names eleven third parties that receive data, and describes its access controls: roughly twenty staff, two-factor authentication and IP-restricted access. It claims PCI DSS compliance and a SecurityMetrics recognition. The wording is a commitment of effort rather than a declaration: "We do our best to be fully compliant with the EU's GDPR for all of our EU users." Two caveats matter. The GDPR page says all data is stored in the EU and UK, while the privacy policy separately permits transfers outside the EEA. And that privacy policy carries a single date, 4 April 2018, so it predates the AI products it is meant to cover. No DPA is published.

Who owns the data?

WordLift is explicit that the customer owns what the platform produces. Its FAQ answers the ownership question with a plain "You do!", and the terms of service describe content managed through the service as the customer's private data, adding that the vendor restricts its own visibility into those files. Structured metadata can be exported at any time as RDF/XML, Turtle, N3 or JSON-LD. Metadata published as linked data under data.wordlift.io, or under a custom domain, is stated to be fully licensed to the customer. Third-party datasets reached through the platform, such as DBpedia, stay governed by their own licences and are not covered by that grant.

Reuse rights

Customers may reuse the metadata they create without asking permission. WordLift invites them to open their datasets publicly under a free or a commercial licence, to feed chat services such as Facebook Messenger or Telegram, and to build content syndication or data-as-a-service models on top of them. Exports are available in RDF/XML, Turtle, N3 and JSON-LD. That freedom stops at third-party Data reached through the platform: the terms forbid publishing it online or passing it to other people beyond what its own licence allows, and make the customer liable for any breach. On the vendor's side, the GDPR page states that WordLift uses only the subscriber's account data and no data from the site where WordLift is active, while the Agent product is marketed as being trained on the customer's own knowledge graph and proprietary SEO data. Nothing published resolves whether customer data can ever feed shared models.

Data retention & training

Hosting summary

WordLift's GDPR page states that all data is currently stored in the EU and the UK, and that the linked metadata it publishes sits on its own servers in Germany. The privacy policy is less restrictive: it warns that collected data may be transferred to and stored at a destination outside the European Economic Area, and processed by staff outside the EEA, with consent taken from the act of submitting the data. Both statements are live on the site at the same time. The hosting infrastructure itself is listed among the third parties that receive data but is never named — visitors are told to contact the company for up-to-date details. No cloud provider or region is identified for the platform. The public website is served behind Cloudflare on an anycast address, which says nothing about where the application actually runs. The company is established in Rome, and its terms place any dispute under Italian law and the courts of Italy.