Serif

GDPR overview

Serif claims compliance in plain words: the footer of every page reads SOC 2 Type 2, GDPR and HIPAA compliant. The privacy notice grants users in the EEA, the United Kingdom, Switzerland and Canada rights of access, rectification, erasure, restriction, portability and objection, freedom from automated decision-making, the right to complain to a national authority or the UK regulator, and the right to withdraw consent at any time. Privacy requests go to support@serif.ai. The paperwork behind the claim is thinner: no Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is published, and third parties are described by category rather than by name. Hosting is declared in the United States and continued use counts as consent to that transfer. A Vanta trust centre is linked from the security page.

Who owns the data?

Serif.ai inc. publishes its terms and privacy notice through Termly, both last updated on 1 February 2024. The security page states plainly that your emails, data and assistant are yours alone, that Serif has never sold customer data and never will, and that emails are not stored on its servers. Access is scoped to the account holder, so not even teammates can read another user's assistant. The terms nonetheless take an unrestricted, perpetual and worldwide licence over any Contributions a user posts to the service, which places published material on a different footing from mailbox content. Account deletion is documented in the help centre.

Reuse rights

The terms grant the end user no reuse rights over Serif's own content or marks: reproducing or publicly displaying any part of them outside normal use requires written permission, requested at support@serif.ai. The flow is far more generous in the other direction. Anything posted as a Contribution is licensed to Serif on an unrestricted, irrevocable, perpetual, worldwide and royalty-free basis, including the right to copy, translate, sublicense and exploit it commercially. Mailbox content is governed separately: section 15 of the privacy notice states that user data, including Google user data, serves only the user's own assistant and is never used in a generalised or non-personalised way. The Enterprise tier is the exception that proves the rule, offering custom models trained on the customer's own organisation.

Data retention & training

Hosting summary

The terms state plainly that the services are hosted in the United States, and that reaching them from another region means transferring data there. No European data residency option is offered and no other hosting country is named. The privacy notice describes its providers by category, data storage providers and website hosting providers, without naming any of them, so the infrastructure operator is not disclosed. The domain resolves to 216.150.16.1, a United States address on Amazon's AS16509, although that record is an anycast CDN node and says nothing about where mailbox data itself sits. The security page adds two claims that matter more than the jurisdiction: emails are never stored on Serif's servers, and everything the assistant learns is encrypted at rest. Enterprise customers can negotiate custom retention policies. For a European buyer, the practical position is that data leaves the European Economic Area by design, with consent obtained through continued use rather than a documented transfer mechanism.