SightsAI

GDPR overview

There is no mention of the GDPR anywhere on the site. A targeted search across every collected page found no reference to the regulation, no lawful basis, no described procedure for access, erasure or portability, no Article 27 EU representative and no data protection officer. No data processing agreement is offered, and no subprocessor list is published. The only cross-border clause is generic: if personal data is transferred for processing outside the user's jurisdiction, the vendor says it will abide by the applicable data transfer rules. The privacy policy, last updated 19 February 2025, is written for website visitors rather than platform customers. Governing law is the State of California, with exclusive jurisdiction in Los Angeles County. European buyers with compliance obligations should expect to request all of this directly from the vendor.

Who owns the data?

The published documents answer this only for the marketing site. The privacy policy, dated 19 February 2025, covers two sets of data: Inquiry Information submitted through the contact form, meaning name, company, business email, phone number and the subject of the enquiry, and Analytics Information recorded automatically, meaning IP address, date and time of access, browser type, language, links clicked and actions taken. StreamSights Inc. presents itself as responsible for both. The terms of use reserve all intellectual property in the website to the company or its licensors. No clause anywhere states who owns the profiles, prompts, campaign material or simulation outputs handled by the platform itself.

Reuse rights

For the website, the vendor describes its own uses: enquiry data serves to contact the sender and handle the request, while analytics data serves to provide, maintain and improve the site, support quality assurance and development, prevent fraud, resolve disputes, troubleshoot problems, assist investigations and enforce the terms. Sharing is limited to service providers acting only on the vendor's behalf and not for their own promotion, to competent authorities where a user abuses the site or breaks the law, where a judicial or regulatory authority requires it, and to a successor entity in a merger or acquisition. For the end user the terms are restrictive: website content may not be copied, duplicated, distributed, sold, framed, translated or downloaded without prior written consent, automated collection is forbidden, and using the site to build a similar or competing product is prohibited. Nothing is published about reuse rights over the simulation outputs a customer generates.

Data retention & training

Hosting summary

No hosting information is published. The site names no country, no region, no cloud provider and no data centre, and claims no security certification such as SOC 2 or ISO 27001. No subprocessor list is available. The privacy policy's only relevant clause is generic: if personal data is transferred for processing outside the user's jurisdiction, the vendor states it will abide by the applicable data transfer rules, without naming those jurisdictions. The publisher is a US company whose terms are governed by the law of the State of California, with exclusive jurisdiction in Los Angeles County, and that is the closest thing to a stated jurisdiction anywhere on the site. A DNS lookup resolves the marketing domain to an anycast address inside Google's network, but that describes where the brochure site is served, not where customer data is stored, and it should not be read as a hosting location. Buyers with data residency requirements will have to obtain this information directly from the vendor.