Saveto AI

GDPR overview

The words GDPR and General Data Protection Regulation appear nowhere on the twelve pages collected, in the visible text or in the archived HTML. No Article 27 representative is designated, no data protection officer is named and no legal basis for processing is stated. The privacy policy does list rights that read like GDPR rights, namely access, correction, deletion, restriction, objection and portability, but offers them only "subject to applicable laws", with requests made by email and answered "in accordance with applicable data protection laws". A children's privacy clause rules out knowingly collecting data from under-18s without guardian consent. The terms make governing law that of Saveto AI's place of registration, which the document never names. The publisher identified off-site is SAVETO LTD, a UK company, so UK GDPR would apply, but the site itself never says so: treat compliance as undocumented rather than denied.

Who owns the data?

The terms of service define User Content broadly: everything you submit and everything the service generates from it, outputs included. Section V.3 states that you keep whatever rights you are legally entitled to in that content, but that you grant Saveto AI a worldwide, non-exclusive, royalty-free license to use, host, store, reproduce and process it as reasonably necessary to provide, maintain, protect and improve the service. The platform itself, meaning software, models, algorithms, interfaces, text, graphics and logos, belongs to Saveto AI under section VI.1, User Content excluded. Section V.2 makes you solely responsible for the legality of whatever you upload.

Reuse rights

Nothing in the terms restricts what you do with your own outputs: transcripts, translations and summaries remain yours to reuse, publish or sell without asking permission, provided you held the rights to the source file in the first place, since section V.2 places that responsibility entirely on you. On the publisher's side, the privacy policy describes account data you volunteer (name, email, username, plus billing details where applicable) and automatically collected data (IP address, browser type, device model, access time, pages visited), used to provide and maintain the service, manage accounts, improve features and experience, run security and fraud checks, and meet legal obligations. Service communications are sent, and marketing only with consent where the law requires it. Data is shared with contracted providers described by category alone (cloud providers, analytics tools, payment processors, communication tools) with no vendor named, and may pass to an acquirer in a merger, acquisition or asset sale. Cookies, pixels and tracking technologies are used, refusable through the browser at the cost of degraded features, and section IX.2 has you consent to cross-border transfers. On model training the document is unfinished rather than clear: section V.3 still carries an unedited drafting instruction reading "If you do not want your content used for model training or improvement, the scope of this license should be adjusted accordingly in your final version."

Data retention & training

Hosting summary

Saveto AI publishes nothing about where data is hosted. Across the twelve pages collected there is no country, no region and no data centre named. The privacy policy says the company relies on contracted "cloud providers", but names none and locates none, and section IX.2 of the terms asks you to consent to cross-border transfers necessary to operate the service, again without saying where to. Network observation gives a partial picture that is emphatically not a publisher statement: the domain is served through Cloudflare (AS13335, anycast address 104.21.55.48) and the application's assets come from res.saveto.ai. An anycast CDN edge says nothing about where files are stored or processed and must not be read as a hosting country. The publisher is British, SAVETO LTD, but a country of incorporation is no hosting guarantee either. In short, no conclusion can be drawn about the jurisdiction holding your uploads, which matters more than usual here since there is no DPA, sub-processor list or GDPR reference to fall back on.