Privacy Notice

The controller and operator of Sifti is Kirill Domnin, Fritz Dietrich Kahlenbergstraat, 1087 LL Amsterdam, the Netherlands. For privacy requests or questions, email hello@getsifti.com.

No data protection officer has been appointed because one is not currently required. No separate EU representative is required because the controller is established in the EU.

Sifti is a private beta intended for people aged 16 or older in the Netherlands and the EU/EEA. Please do not use the service if you are under 16.

• Account data: email address, display name, locale and account timestamps.
• Authentication and security data: sign-in metadata and browser session tokens.
• Sift data: the public URL you submit, its domain, extracted public page text, and the generated title, summary, verdict, scores, labels and concerns.
• Your choices: Keep or Discard, Library topics and related timestamps.
• Feedback: quality rating, selected reasons and any optional message you provide.
• Operational data: model/provider identifiers, token or usage counts, estimated cost, latency, safe error codes, limited request identifiers and six server-validated product events for signup, onboarding, Sift completion and first Keep. These events do not contain submitted URLs, page content, prompts or email addresses.
• Basic technical information that hosting, security and email systems ordinarily receive, such as IP address, browser details and delivery metadata.

Do not submit passwords, private or login-only links, confidential documents, or special category personal data. Sifti is designed for publicly accessible web pages.

• To create and operate your account, process links and return results: performance of our contract with you and steps you request before entering it.
• To secure the service, enforce limits, prevent abuse, diagnose errors and improve core reliability: our legitimate interests in operating a safe and useful service.
• To record and act on feedback: our legitimate interest in improving the beta. Providing an optional feedback message is voluntary.
• To comply with applicable law or valid legal requests: legal obligation.

Sifti does not currently send marketing email, sell personal data, or use personal data for targeted advertising.

When you submit a public URL, Sifti validates it, asks Cloudflare Browser Rendering to extract relevant public page content, and sends the source domain plus a limited amount of that text to the OpenAI API. OpenAI returns a structured assessment, which Sifti stores in your account. Passwords, session tokens, email addresses, profile names, Library history and feedback are not sent to Cloudflare or OpenAI for this assessment.

The result is an AI-generated estimate and can be incomplete, outdated or wrong. It does not make decisions that produce legal or similarly significant effects about you. Read our AI use notice and check the original source before relying on a result.

We use the following providers only as needed to run Sifti:

• Supabase for authentication, database, server functions and service infrastructure.
• Cloudflare for application hosting and extracting content from the public URL you submit.
• OpenAI for producing the structured AI assessment.
• Hostinger for sending account confirmation and password-reset email.

GitHub stores application source code but is not used to store live Sifti account or Sift data. We may also disclose information when required by law, to protect the service and its users, or in connection with a business reorganisation subject to appropriate safeguards.

The primary Supabase project region is in Ireland. Some providers or their subprocessors may process data outside the EEA, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and applicable provider data-processing terms.

• Account, profile, saved Sifts, Library items and topics: while your account remains active, until you delete the relevant item or delete the account.
• Feedback linked to an account: up to 12 months, or earlier account deletion.
• Failed or abandoned Sifts: up to 7 days for troubleshooting.
• Detailed analysis and service-usage records: up to 90 days.
• Raw privacy-safe product events: up to 90 days.
• Security and error logs under our control: normally up to 30 days.

Account deletion removes the active account and associated product records. Residual copies may remain temporarily in protected backups until the provider's restore window expires. Providers may retain limited security or abuse-prevention records under their own documented terms. We may retain specific records longer where law requires it or where reasonably necessary to establish, exercise or defend legal claims.

We use access controls, encrypted transport, row-level data isolation, server-side secrets, data minimisation and account-confirmation controls. No online service can promise absolute security. Please use a unique password and contact us promptly if you suspect misuse.

Subject to GDPR conditions and exceptions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting earlier processing. We may ask for information needed to verify your identity before acting on a request.

You can delete your account from Account settings. For other requests, email hello@getsifti.com. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live or work.

We will update the date at the top when this notice changes. If a change materially affects how we use account data, we will provide a prominent in-product or email notice where appropriate.