Saufter

GDPR overview

The GDPR is named explicitly. The privacy policy states that users based in the European Union or the EEA have their personal information handled in accordance with the GDPR, and that transfers outside the EEA are covered by standard contractual clauses approved by the European Commission. The CCPA is addressed separately for California residents, and a COPPA clause rules out knowingly collecting data from children under 13, while the terms require users to be at least 18. Implementation stops there. No Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is published or offered, no sub-processors are listed, and no retention period is stated. The only contact point for a request is the generic address hello@saufter.io, and the servers are in the United States.

Who owns the data?

The terms of service state that, between the parties, all right, title, and interest in the Customer Data remain owned by the customer or its licensors, while the vendor keeps the rights to its own technology. The privacy policy says account information is not disclosed to third parties except contractors bound by strict confidentiality obligations, none of whom are named. Disclosure is also permitted, without notice, to a successor in a merger or acquisition and to authorities for legal, fraud, safety, or rights-protection reasons. Aggregated, non-identifying data may be shared with prospective customers, partners, advertisers, and funders. Usage information is said not to be linked to individual account records.

Reuse rights

Because the terms leave ownership of the Customer Data with the customer, the segments, campaign copy, and behavioral records produced inside the account can be reused in your own marketing without asking Saufter for permission. What you receive on the product itself is narrower: a limited, non-exclusive, non-transferable right to access and use the service. The terms forbid using it to develop a functionally similar or derivative product and forbid removing proprietary notices. Account information can be edited through the profile tools inside the service, and access, correction, or removal from the database and mailing list can be requested by email after an identity check (at minimum full name, address, and phone number); no account has to be created to make that request, but Saufter may keep archival copies after a removal. Nothing on the retrieved pages documents a bulk export or any portability tooling, so getting your data out in a usable form is undocumented.

Data retention & training

Hosting summary

The privacy policy places jurisdiction in the United States: Saufter and its servers are located there and operate under applicable state and federal law. It adds that information may be processed and stored in the United States and in other countries, without naming any of them, so the United States is the only hosting country actually declared, and no hosting region is specified. For users in the European Economic Area, transfers outside the EEA are said to be covered by standard contractual clauses approved by the European Commission, alongside a general statement of GDPR compliance. No infrastructure provider is named, no sub-processor list exists, and there is no trust or security page: no SOC 2, ISO 27001, or equivalent certification is claimed anywhere on the site. As a network observation rather than a vendor statement, the domain is served behind Cloudflare (anycast IP 162.159.134.42, AS13335), which indicates a CDN edge and says nothing about where the data itself is stored.