Sferal

GDPR overview

GDPR implementation is explicit and unusually detailed. The privacy policy states compliance with Regulation (EU) 2016/679 and maps twenty-two processing activities, each with its purpose, legal basis, Sferal's role as controller or processor, and a retention period. Eight data subject rights are set out, including access, erasure, portability, objection and withdrawal of consent, with a target response time of one month; requests go to contact@sferal.ai. Nine subprocessors are named with their data location and adequacy mechanism, transfers outside the EEA relying on the EU-U.S. Data Privacy Framework or standard contractual clauses. A data processing agreement governs customer content. As the publisher is established in Romania, no Article 27 representative is required. No data protection officer is named, and the policy is published in Romanian only, last updated 10 May 2025.

Who owns the data?

Under the terms and conditions, customers keep their rights over content they lawfully upload, while granting Sferal a licence to use it for the purpose of delivering the service. Everything in the platform itself — software, trademarks, algorithms and interfaces — belongs to SFERAL S.A. or its licensors, and customers receive only a limited, non-exclusive right of use. The privacy policy sets out a dual role: Sferal acts as controller for account, billing and support data, and as processor when it handles documents and workflows on a customer's behalf. Customers remain solely responsible for the lawfulness of any personal data flowing through what they build. The About page claims no vendor lock-in.

Reuse rights

Customers may reuse the systems and outputs they build without asking further permission, subject to a limited, non-exclusive licence over the platform and to an explicit ban on copying, redistributing or reverse-engineering it. Sferal processes inputs and outputs to deliver the AI service, on contractual and legitimate-interest grounds, and applies AI inference to classification, extraction and analysis. Training or improving AI models happens only with the customer's prior, explicit consent, and that consent can be withdrawn at any time. Nine subprocessors are named — Intercom, Hotjar, OpenAI, Anthropic, Mistral AI, TogetherAI, Magnetic IT, Stripe and n8n — and data may also be shared with affiliates and group entities, or transferred in a merger or asset sale. The terms warn that AI results are probabilistic and must be checked by a person before being relied upon, and that customers alone are accountable for the legal and ethical risk of the workflows they create.

Data retention & training

Hosting summary

The homepage states that Sferal is hosted in Germany on secure EU infrastructure, and each customer receives a dedicated environment with separate development and production databases and 50 GB of storage. The privacy policy places six subprocessors inside the European Union — Intercom, Hotjar, Mistral AI, Magnetic IT, Stripe and n8n — and three in the United States: OpenAI, Anthropic and TogetherAI, all covered by the EU-U.S. Data Privacy Framework. Transfers outside the European Economic Area rely on that framework or on European Commission standard contractual clauses, with supplementary measures where appropriate, and are limited to what the service strictly requires. Security measures are described in detail: AES-256 encryption at rest, TLS 1.3 in transit, daily off-site backups plus weekly and monthly copies, least-privilege access control, logging of critical operations, periodic security audits, and isolated infrastructure reachable only by authorised technical staff. The publisher is established in Romania, so processing falls under EU jurisdiction. No hosting or security certification is claimed.