folk

GDPR overview

GDPR compliance is claimed in writing and backed by concrete detail. The privacy policy, effective 28 July 2026, opens with a commitment to the Regulation, and the homepage carries a GDPR badge alongside SOC 2 Type I and Google Security. Data subject rights are listed in full: access, rectification, erasure, portability, objection, restriction and withdrawal of consent, exercised at privacy@folk.app with a thirty-day response commitment and a right to complain to a supervisory authority, the CNIL being named for France. Transfers outside the EU rely on the Data Privacy Framework or on standard contractual clauses, and a data protection addendum is mandatory for EU-established customers. Two gaps stand out: no Article 27 EU representative is designated, although the publisher is a Delaware corporation, and no data protection officer is named.

Who owns the data?

folk's terms are explicit: you retain ownership of the content you put into the platform. You grant folk a non-exclusive licence to use and store that content, strictly to operate and feed the service, and you remain solely responsible for its legality, reliability and appropriateness. The privacy policy then splits the roles. Folk Inc. is the data controller for your own account data and that of your users, but acts as your processor, under its data processing agreement, for the contact records you import from Gmail, Outlook, iCloud and the other services you connect. Content already shared with third parties may survive your deletion request.

Reuse rights

Because ownership stays with you, you may reuse, export and redistribute your own records without asking folk for permission: CSV import and export are available on every tier, and a migration service moves data in from another CRM. folk's own use is bounded in writing. The privacy policy states that it neither sells personal data nor uses it to train AI models, and that the Google data it touches is limited to the scopes you authorise: contacts, read-only Gmail metadata, read-only calendar and sending on your behalf. Twenty-five named subprocessors, OpenAI, Perplexity and ElevenLabs among them, process contact data for enrichment, research notes and dictation; some can be opted out of individually, others cannot. The duty to hold a lawful basis for the third-party contacts you import stays with you, and the terms say so.

Data retention & training

Hosting summary

Personal data is hosted by Amazon Web Services in an Aurora database that the privacy policy describes as unreachable from outside folk's own servers, and it states plainly that those AWS services are located in the United States. Traffic between browser, desktop or mobile client and folk's servers is encrypted with TLS 1.2 or higher, and data at rest in the databases and in S3 storage uses AES-256. folk claims technical and organisational measures aligned with Article 32 of the GDPR. No European data residency option is offered. The subprocessor table shows where each vendor operates: the United States for AWS, TurboPuffer, Apollo.io, OpenAI, Perplexity, People Data Labs, Stripe, Intercom and most others, the European Union for Datadog, Dropcontact, Prospeo and Make. Transfers out of the EU rely on the Data Privacy Framework adequacy decision or on standard contractual clauses. One caveat on reading the infrastructure from outside: the IP address the domain resolves to belongs to a Cloudflare anycast node and says nothing about where the data actually sits.