Coefficient

GDPR overview

Coefficient claims GDPR compliance and backs the claim with documents rather than slogans. A Data Processing Addendum, last updated on 25 March 2026, is published on the site and incorporated into the terms; it covers the EU GDPR, the UK GDPR and several US state laws, including the CCPA, CPA, CTDPA, UCPA and VCDPA. International transfers rely on the EU Standard Contractual Clauses of decision 2021/914 and the UK ICO Addendum, with Dutch law and jurisdiction chosen under clauses 17 and 18. Sub-processors are disclosed in a public list under a general authorisation, with change notifications. Deletion and access requests go to support@coefficient.io. Two gaps are worth naming: no Article 27 EU representative and no data protection officer are named anywhere in the privacy policy, terms, DPA or website terms, and hosting stays in the United States with no EU data residency option.

Who owns the data?

The terms draw a clear line. You keep sole ownership of your Customer Data: section 5.1.2 states that you "shall at all times retain sole ownership of your Customer Data". In return you grant Coefficient and its affiliates a non-exclusive, worldwide, fully paid, royalty-free licence to access, use, process, copy, store, modify, create derivative works from, distribute, display and transmit that data, but solely as needed to deliver the service. The privacy policy treats you as the controller and Coefficient as the processor, a role the DPA confirms, adding Service Provider status under the CCPA. The exception is Aggregate Data: anonymised, usage-derived data whose rights belong entirely to Coefficient, for any legitimate commercial purpose, with no time limit.

Reuse rights

Imports land in your own Google Sheet or Excel workbook, so you can reuse the data without asking anyone: filter it, model it, chart it, export it or fold it into another report. Two-Way Sync connectors go further and let you edit rows in the spreadsheet, then write the changes back to systems such as Salesforce, HubSpot, QuickBooks, Snowflake or PostgreSQL. Dashboards can be shared by link with people who hold no licence, and row-level security decides, email address by email address, which slice each viewer sees; unlicensed teammates can read the data behind a share link but cannot edit imports or schedule refreshes. Two limits remain. Section 5.1.1 makes you warrant that you hold the rights and permissions to push the data through, and you answer for its accuracy, quality, content and legality. And section 6 keeps the product itself, interface, code and content included, as Coefficient's intellectual property.

Data retention & training

Hosting summary

Coefficient hosts in the United States and says so plainly: "We are based in the United States, and our Services are hosted there" (privacy policy, section 8). The backend infrastructure runs on AWS, with security groups keeping the components inside the VPC out of public reach, and credentials such as OAuth tokens, API keys and passwords are encrypted end to end. Data imported through the connectors is never stored on Coefficient's servers; only Cloud Datasets require storage, and they are opt-in and can be disabled through the Admin Controls. No EU hosting region and no data residency option are advertised. Transfers out of restricted countries rely on the EU Standard Contractual Clauses and the UK Addendum under section 7.2.1 of the DPA, with Dutch law and jurisdiction chosen for clauses 17 and 18, while the terms and the privacy policy are governed by California law. The vendor claims SOC 2 Type II certification and holds official vendor status on the Google Workspace Marketplace and Microsoft AppSource.