Shortwave

GDPR overview

Shortwave never claims GDPR compliance in writing. Its security guide carries a heading titled "SOC 2 Type II & GDPR compliance", but the text underneath only invites organisations that require either to contact support@shortwave.com. No data processing agreement is published or offered on request, no Article 27 EU representative is designated and no data protection officer is named; the privacy policy simply gives privacy@shortwave.com as its designated request address. Rights of access, knowledge, deletion and opt-out are offered "where provided for by law", framed mainly around California residents. Marketing consent is collected where the law demands it, the EU being cited as the example. International transfer is acknowledged rather than framed: users accept that their data moves to facilities and servers in the United States, with no standard contractual clauses mentioned.

Who owns the data?

Under the Terms of Service, users keep ownership of the content they send through Shortwave: you warrant that you hold all rights in your User Content, and the licence granted to Shortwave is limited to the actions needed to deliver that content to its recipients. Shortwave Communications, Inc. processes Gmail messages, attachments and Google Contacts solely to run the service, never for advertising, and states it does not sell personal data. Employees cannot read customer data without the customer's explicit permission; every access is logged and requires hardware-key multi-factor authentication. Content may still be preserved or disclosed where the law, a legal claim or a safety issue requires it.

Reuse rights

Users keep full, unrestricted use of their own mail: Shortwave sits on top of Gmail and syncs both ways, so archiving, labelling or deleting in one is reflected in the other, and the original message content is never rewritten. Nothing has to be requested from the vendor before exporting or reusing that content, and leaving the product leaves the Gmail mailbox exactly as it was. On Shortwave's side, the data feeds the service itself: search, threading, labelling, the assistant, plus analytics, product improvement and fraud prevention. Named sub-processors are Google Cloud, OpenAI, Anthropic and Pinecone, with Stripe handling payments. The vendor states that no third-party large language model is trained on customer data, and that most AI workloads run on open-source models on hardware it controls. Ghostwriter does learn an individual's writing style from their own sent mail.

Data retention & training

Hosting summary

All Shortwave data is stored in Google Cloud, which the vendor describes as highly secure and compliant data centres. Stored data is encrypted at rest with AES256 and in transit with TLS 1.2+, under a stated defence-in-depth approach covering the network, service and application layers. The privacy policy is explicit about jurisdiction: by using the service, users acknowledge that their personal data is transferred from their own location to Shortwave's facilities and servers in the United States. No alternative region or country is offered and there is no data residency option. Four sub-processors are named, Google Cloud, OpenAI, Anthropic and Pinecone, with Stripe processing payments; the vendor states it keeps both the list and the data sent to them to a minimum. Most AI workloads are said to run on open-source models on hardware Shortwave controls, which limits, without eliminating, exposure to external AI vendors.