Akiflow

GDPR overview

The word GDPR appears nowhere on Akiflow's site — not in the privacy policy, the terms, the AI addendum or the security page. What the company does claim is certification under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework, self-certified with the U.S. Department of Commerce and verifiable on dataprivacyframework.gov. It names the bodies overseeing that compliance — the EU data protection authorities, the UK Information Commissioner's Office, the Gibraltar Regulatory Authority and the Swiss Federal Data Protection and Information Commissioner — and offers a free independent dispute resolution mechanism. A Data Processing Agreement is available on request. No Article 27 EU representative and no data protection officer is designated, and no European address is published. Framework certification is a transfer mechanism, not a statement of GDPR compliance.

Who owns the data?

Akiflow's terms are explicit: users keep ownership of everything they send through the service. Clause 7 states that any data, information or material originated by the user and transmitted through the platform remains theirs, and the team section repeats it — every member, inside a team or not, owns the data they create, and leaving a team costs neither the account nor its contents. Team administrators cannot reach a member's data unless that member deliberately shares it in the team workspace. Content processed by the AI features stays visible and accessible to the user in the interface where it was produced.

Reuse rights

Because ownership stays with the user, content can be reused, exported or deleted freely, with no permission to ask of Akiflow. Akiflow itself processes that content to run and improve the service, to analyse usage and for marketing, and shares parts of it with twenty named sub-processors covering payments, support, analytics and attribution. The AI features are opt-in: once enabled, text inputs and interaction data may be used to debug and improve the AI systems, but the addendum states this content is never used to train or fine-tune general-purpose models beyond the user's organisation, and never reused across customer environments. Data drawn from Google APIs follows Google's Limited Use requirements. Meeting recordings are a special case: obtaining the participants' consent is the user's responsibility, not Akiflow's.

Data retention & training

Hosting summary

Akiflow's terms state that the service is controlled and operated from its facilities in the United States, which sets the jurisdiction: US law governs, and disputes fall under US courts. The privacy policy describes secure hosting facilities with strict access controls but names neither a country nor a provider in that section; the sub-processor list, however, identifies Alphabet Inc. as the hosting provider. Sensitive items such as API keys and authorisation tokens are protected with 256-bit AES encryption, and the AI addendum states that meeting media and derived content are encrypted in transit and at rest. Transfers of European, UK and Swiss personal data rely on the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework, with self-certification filed with the U.S. Department of Commerce. No European data residency option is announced, and no region can be selected at signup.