Effie

GDPR overview

Effie claims GDPR compliance in plain words: the privacy policy opens by stating that the publisher abides by the General Data Protection Regulation. Concrete measures are thin, however. Users can consult, update, correct or delete their data, and delete their account, by writing to help@effie.pro. A dedicated cancellation route was added for German consumers in July 2022. Beyond that, the policy names no Article 27 representative, no data protection officer, no legal basis for processing, no hosting country and no retention period, and it offers no DPA. It has not been revised since 25 November 2021, which places it more than four years before the Effie AI module it therefore does not cover. The compliance claim is explicit but lightly evidenced.

Who owns the data?

The terms claim intellectual property over the software, the graphics and the 7S2P branding, but they do not claim ownership of what users write; the EULA likewise covers the software licence rather than user content. The privacy policy states that content is encrypted and stored on the publisher's server, and undertakes not to exploit it for profit, for content-analysis-based recommendation algorithms or for advertising. The Google Play listing goes further, claiming encryption with a key unique to each user so that nobody else can read what is written. Deleting the account deletes the associated data. In practice the user keeps their work, and the publisher's declared role is storage and synchronisation.

Reuse rights

Nothing in the terms or the EULA restricts what users may do with the text they write in Effie: the documents claim no licence over user content, so authors reuse, publish and sell their own work without asking permission. The product is built around that assumption, exporting to PDF, DOCX, Markdown, EffieSheet and JPG and publishing straight to WordPress. On the publisher's side, the privacy policy allows sharing with affiliated companies, authorised partners and courier services for prize deliveries, sharing on legal or governmental request, and transfer of personal data if the company is merged, split, liquidated or sold. Two named third parties process data: Countly for website analytics and MyCommerce for payments. One important gap: the policy predates Effie AI and says nothing about what happens to text sent to the AI module.

Data retention & training

Hosting summary

The publisher does not say where user data is hosted. The privacy policy states only that content is encrypted and stored on its server, without naming a country, a region or an infrastructure provider, and the site has no trust, security or subprocessor page. Two third parties are named in the policy itself: Countly for website analytics and MyCommerce for payment processing, each with a link to its own privacy policy. A pseudonymised subscription identifier is stored in the user's own iCloud account and is said to be accessible only to the app. The marketing site resolves to Amazon Web Services infrastructure in San Jose, United States, but that concerns the website rather than user documents and should not be read as a statement about where writing is stored. The Google Play data safety declaration adds that data is encrypted in transit, that none is shared with third parties, and that deletion can be requested. For anyone with a data residency requirement, there is simply not enough published information to make a decision.