Gojiberry AI

GDPR overview

GDPR compliance is asserted explicitly: the legal notice states that the website collects personal data in compliance with the GDPR, and French law applies. The privacy policy, updated 18 April 2026, lists access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. US state rights (California, Colorado, Virginia, Connecticut, Texas, Oregon) are covered too, including opt-out of sale and sharing. A dedicated opt-out page and privacy@gojiberry.ai handle requests, with announced deadlines of 30 days under the GDPR and 45 days under US state laws. EU and EEA visitors see a cookie consent banner, transfers to US processors rely on standard contractual clauses or equivalent safeguards, and breaches are notified without undue delay. Gaps: no DPA is published, the subprocessor list is available on request only, and no Article 27 representative is named, the publisher being established in France.

Who owns the data?

Under the general terms, the customer is the data controller for any personal data processed through the service, and the publisher acts as a data processor under applicable data protection laws. That split covers the lead records handled inside the platform. The publisher states that it does not sell personal data, and that no employee accesses account data except where support requires it or the customer explicitly permits it. The operator is SUPERFRUITS, a French SAS registered at 60 rue Francois Ier, 75008 Paris, SIREN 988 586 111, RCS Paris. Worth noting: no data processing agreement is published anywhere on the site, even though the publisher describes itself as a processor.

Reuse rights

Account data is collected at sign-up: name, email, company, job title and password. Lead data comes from publicly accessible sources, enriched by third-party providers: social engagement such as likes, comments, job changes and event registrations, public job titles, company names, websites, LinkedIn URLs, and published professional emails and phone numbers. The legal bases claimed are contractual necessity, legitimate interest and consent, depending on the processing. Usage data feeds performance reporting, campaign recommendations and anomaly or abuse detection, while aggregated and anonymised data is used for internal research, benchmarking and statistics. Billing runs through Stripe, with no card data stored by the publisher; the site also uses Google Analytics, Meta Pixel and LinkedIn Ads. Data is shared with subprocessors (Stripe, Supabase and OpenAI are named as examples), with the integrations a customer authorises (Slack, HubSpot), and with authorities on lawful request. As controller, the customer is free to act on the lead data the service produces, but the terms state that accuracy, completeness and timeliness are not guaranteed and that verification, together with regulatory compliance when contacting those leads, remains the customer's sole responsibility. Training AI models on customer data is never mentioned in the published documents.

Data retention & training

Hosting summary

The footer claims Made and Hosted in the EU, and the privacy policy states that Gojiberry.ai is operated from Europe. No hosting country for customer data is ever named: only the EU region is claimed. The host declared in the legal notice, Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, concerns the website itself and not customer data; the two should not be confused. For EU and UK users, the privacy policy states that data may be transferred to third-party processors in the United States or other countries, under standard contractual clauses or equivalent safeguards. Three subprocessors are named as examples, Stripe, Supabase and OpenAI, with the complete list available on request only. Announced security measures include encryption in transit and at rest, firewalls, access controls, monitoring and anomaly detection. The publisher is a French company and the terms apply French law under Paris jurisdiction, so the contractual forum is French even where processing may reach outside the EU.