AdaL

GDPR overview

The acronym GDPR appears nowhere on the site or in the three legal documents. Part of the machinery is nevertheless in place: SylphAI distinguishes acting as data controller for consumer products from acting as processor under enterprise accounts, lists rights of access, portability, correction, deletion, objection and restriction "depending on your jurisdiction", routes requests to contact@sylph.ai with possible identity verification, and incorporates a Data Processing Addendum into the Terms by reference. Customers in the EEA, Switzerland and the United Kingdom fall under Irish law with arbitration in Dublin. What is missing is just as clear: no Article 27 EU representative is designated, no data protection officer is named, no EU address is given and no subprocessor list is published. Both documents are dated 7 October 2025.

Who owns the data?

SylphAI's Commercial Terms of Service state that the customer retains all rights to its Inputs and owns its Outputs, and that SylphAI assigns to the customer any interest it might hold in those Outputs. Customer Content is treated as the customer's confidential information, and the same section says SylphAI may not train models on Customer Content from the Services. A later section is markedly less protective: it allows SylphAI to use Materials to improve the Services and develop other products, including training its models, unless the user opts out in account settings. Consumer use places SylphAI as data controller; enterprise access makes it a processor, governed by the customer's own agreements. Feedback submitted to SylphAI may be reused freely.

Reuse rights

Outputs belong to the customer, who can reuse and redistribute them without asking SylphAI for further permission. In exchange, the customer warrants that it holds every right, licence and permission needed for the Inputs it submits, and that neither those Inputs nor the Actions it triggers breach the Terms, the Acceptable Use Policy or applicable law. SylphAI states plainly that Outputs may be inaccurate even when they look authoritative, and that nothing should be relied upon without independent verification; judging whether human review is appropriate is left to the customer. Two limits apply: the Services may not be used to build a competing product or to reverse engineer them, and SylphAI may cite the customer's name and logo as a public reference unless the customer objects through a request form.

Data retention & training

Hosting summary

SylphAI does not name a single country or region where user data is stored. The privacy policy commits to administrative, technical and physical safeguards without locating them, and acknowledges sharing data with affiliates and service providers covering hosting, storage, payments, analytics, security and support, none of which is listed by name. A Data Processing Addendum is incorporated into the Terms by reference, and Zero Data Retention is offered on the Teams & Enterprise plan. Jurisdiction surfaces only through governing law: Irish law with arbitration in Dublin for customers in the EEA, Switzerland and the United Kingdom, Californian law with arbitration in San Francisco elsewhere. One technical indication, which is not a vendor statement: the domain's A record resolves to 216.24.57.15, an address operated by Render and geolocated in the United States. A web infrastructure node is not proof of where data is stored and must not be read as a hosting commitment. The footer claims SOC 2 certification without naming an auditor, a report or a date.