Buzz

GDPR overview

The GDPR is addressed concretely rather than in passing. The privacy policy lists the legal bases relied on (contract, legitimate interests, legal obligation, consent) and the full set of data subject rights for residents of the EEA, the United Kingdom and Switzerland, with a thirty-day response commitment. A Data Protection Officer is designated for GDPR enquiries at dpo@buzz.ai. Transfers out of Europe rely on the European Commission's Standard Contractual Clauses, the UK IDTA or the SCCs with the UK addendum, plus supplementary measures; a copy of the safeguards is available on request. A Data Processing Addendum covering processing descriptions, security measures, subprocessor notification and data subject rights assistance is offered to customers acting as controllers. Two gaps: no Article 27 EU representative is named anywhere, and no security certification is claimed.

Who owns the data?

Section 5.2 of the terms is explicit: the customer retains all ownership rights over the content, data and material uploaded to the service. Buzz Inc. receives a non-exclusive, worldwide, royalty-free, sublicensable and transferable licence over that content, limited to three purposes - operating the service, improving and developing it in aggregated and de-identified form only, and meeting legal obligations. The licence ends when the content or the account is deleted, except for material already shared with others or kept for legal and backup reasons. The platform itself, its AI models, prompts and agent architectures remain the property of Buzz Inc. under section 5.1.

Reuse rights

The customer keeps the right to use, export and reuse their own contact data and campaign content without asking Buzz for permission: export is capped at 10,000 records a month on the Core plan and unlimited above it, and a thirty-day export window follows any termination. Two limits apply. Outputs produced by the AI may not be used to train, fine-tune or build a competing AI product (terms 5.1). And the customer warrants, under section 5.3, that they hold the rights, the lawful basis and the consents covering every person in the data they upload or enrich - the liability for that sits entirely with them. On its own side, Buzz states that it does not sell personal information under the CCPA or CPRA, and neither the privacy policy nor the terms mention using customer data to train AI models.

Data retention & training

Hosting summary

Buzz states in its privacy policy that the company is based in the United States and that its servers and service providers are located primarily in the United States. Data belonging to users outside the country is therefore transferred to, stored and processed in the United States, and in other countries where Buzz or its providers operate. The hosting providers named as categories of subprocessors are AWS, Google Cloud and Microsoft Azure, alongside content delivery networks. No European hosting region and no data residency option is offered. Transfers from the EEA, the United Kingdom and Switzerland rely on the Standard Contractual Clauses, the UK IDTA or the SCCs with the UK addendum, with supplementary technical and contractual measures; a copy of those safeguards is available from the legal team on request. The public site is served through Cloudflare, which says nothing about where the data itself is stored.