SiteSpeakAI

GDPR overview

GDPR compliance is claimed explicitly rather than implied: the Trust Center states that SiteSpeakAI is GDPR compliant, and concrete instruments sit behind the claim. A signable Data Processing Agreement incorporates the European Commission's Standard Contractual Clauses, Decision (EU) 2021/914, applying Module Two and Module Three, with the UK International Data Transfer Addendum and Swiss amendments where relevant. A subprocessor list is published naming each provider's country and transfer safeguard: EU-US Data Privacy Framework, Standard Contractual Clauses, or an adequacy decision. Data subject rights are covered end to end, personal data breaches are notified to customers within 48 hours at no additional cost, and EEA and UK visitors are asked for cookie consent. UK GDPR, South Africa's POPIA and California's CCPA/CPRA are claimed as well. No Article 27 EU representative is named anywhere on the site.

Who owns the data?

Under the privacy policy, publisher Espresso Dev (Pty) Ltd acts in two distinct roles. It is the controller for account holders and for visitors to its own marketing site. For everything a customer feeds a chatbot, meaning the indexed content and the conversations that chatbot holds with website visitors, the customer remains the controller and Espresso Dev is only a processor acting on the customer's instructions under the published Data Processing Agreement. Customers choose what content is added and can delete it from the dashboard. When the contract ends, the vendor deletes or returns the data at the customer's choice, and confirms in writing on request. The company states that it does not sell personal data.

Reuse rights

Customers keep the right to use their own content and conversation records freely: nothing in the terms or in the Data Processing Agreement transfers ownership to the vendor, and exporting conversation history to CSV is a product feature rather than a favour. The vendor's own permitted uses are enumerated and bounded, each with a stated legal basis: running the service, processing payments, providing support, securing and improving the product, marketing where permitted, and meeting legal obligations. The decisive restriction is that neither customer content nor visitor conversations are used to train the vendor's models or any third party's, and the AI providers generating the answers are contractually barred from training on that data too. Reusing a visitor's personal data remains the customer's own responsibility, since it is the customer, not SiteSpeakAI, who is the controller of it.

Data retention & training

Hosting summary

Hosting, database and storage run on DigitalOcean in the United States; the vector database used for content search is Pinecone and the Redis cache is Upstash, both also in the United States. The publisher, Espresso Dev (Pty) Ltd, is established in South Africa, and the privacy policy states plainly that it and some of its subprocessors sit outside the EEA and the United Kingdom, in South Africa, the United States and Canada. Not every provider is American: Cohere is in Canada under an adequacy decision, Paddle and Pusher are in the United Kingdom, and ScrapingBee is in France. Each subprocessor's transfer safeguard is published individually, being either the EU-US Data Privacy Framework, the Standard Contractual Clauses with the UK Addendum where relevant, or an adequacy decision. Encryption in transit and at rest is claimed. No choice of hosting region is offered to the customer, so a European buyer with a data residency requirement should treat United States hosting as a given rather than a setting.