sykik.ai — 78/100 (Medium privacy risk)
Last analyzed
Sykik · sykik.ai
Report details
Medium privacy riskSykik offers EU-hosted AI agents with strong data localization and GDPR-aligned practices, but lacks explicit details on data minimization, AI training opt-outs, and third-party sharing controls.
Sykik positions itself as a GDPR-compliant AI agent platform with EU-based hosting (Google Cloud in europe-west) and published subprocessors/DPA. It emphasizes user control over autonomy levels (ask first, draft, autopilot) and audit trails. However, the policy is silent on critical details like data retention periods, specific third-party recipients beyond subprocessors, AI model training opt-outs, and granular data minimization practices. The integration with third-party tools (e.g., Gmail, Slack, Stripe) raises questions about data flows and user consent mechanisms.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Claims to collect only necessary data but lacks explicit details on what is collected, retained, or deleted, and how minimization is enforced across integrated tools.
Policy is clear about EU hosting and autonomy controls but omits critical details like data retention, third-party recipients, and AI training practices.
Integrates with numerous third-party tools (e.g., Gmail, Slack, Stripe) but does not specify which data is shared, for what purposes, or under what legal bases.
Explicitly states EU hosting (Google Cloud europe-west) and allows users to restrict AI model calls to EU infrastructure, reducing transfer risks.
No explicit statement on whether user data is used for AI training or if opt-outs are available. The policy is silent on this critical issue.
Mentions audit trails and user control but does not explicitly describe GDPR rights (access, deletion, portability, objection) or how to exercise them.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Lack of clarity on AI training opt-outs
The policy and landing page do not address whether user data (e.g., emails, documents, chat logs) is used to train Sykik’s or third-party AI models. This is a critical gap under GDPR Article 22 and transparency requirements. The absence of an opt-out mechanism for training is a significant compliance risk.
Ambiguous third-party sharing with integrated tools
Sykik integrates with numerous third-party services (Gmail, Slack, Stripe, QuickBooks, etc.) but does not specify what data is shared with these tools, the legal basis for sharing, or whether users can control or limit these flows. The policy states 'No migration, no data export' but does not clarify how data is processed within these integrations.
Incomplete transparency on data retention and deletion
The policy does not specify retention periods for user data, logs, or audit trails. It also lacks details on how users can request deletion of their data or whether data is automatically purged after a certain period. This is a gap in GDPR compliance (Article 5(1)(e), Article 17).
DPA and subprocessor list referenced but not detailed
Sykik mentions a DPA and published subprocessors but does not provide the actual DPA text or subprocessor list in the provided content. Without reviewing these, it is impossible to assess the adequacy of safeguards for international transfers or data processing agreements.
Strong EU hosting and infrastructure controls
Sykik explicitly states it runs on Google Cloud in the EU (europe-west) with AES-256 encryption and allows users to restrict AI model calls to EU infrastructure. This is a strong GDPR-aligned practice, as it minimizes international transfer risks. The workspace settings show options to switch to the 'European Union' region, ensuring model calls (e.g., Claude Sonnet 4.5EU, Gemini 3 ProEU) run on EU servers.
Consumer Takeaway
Sykik’s EU hosting and DPA are strong privacy signals, but users should verify how their data is shared with integrated tools and whether AI training uses their data. The lack of explicit opt-outs for training and unclear third-party sharing scope are notable gaps.
Compliance Posture
Partially compliant with GDPR: EU hosting, DPA, and encryption are positive, but missing transparency on data retention, third-party transfers, and AI training practices. The policy does not explicitly address all GDPR rights (e.g., portability, objection) or special category data handling.
EU Transfers
Low risk for EU-to-EU transfers: Sykik runs on Google Cloud in the EU (europe-west) and allows users to restrict AI model calls to EU infrastructure. However, the policy does not explicitly rule out transfers to non-EU subprocessors or parent companies, and the DPA’s specifics are not detailed in the provided text.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
Sykik runs on Google Cloud in the EU. Switch your workspace to the EU region and every model call runs on EU infrastructure too — chats, reviews and scheduled runs alike.
Built for GDPR, with a DPA and every sub-processor published.
Runs on Google Cloud in europe-west, encrypted with AES‑256.
No migration, no data export. Sykik signs in to the accounts your team already uses.
You set the autonomy: ask first, draft or autopilot. Anything he doesn't recognise, he asks about — in every tier. Every decision lands in the audit trail.
Missing or Unclear
- Data retention periods
- Explicit opt-out for AI training
- Legal basis for third-party sharing
- Special category data handling
- Detailed DPA and subprocessor list
- User rights (access, deletion, portability, objection) procedures
- Data minimization specifics
- Encryption in transit details
- Incident response procedures
Questions to Ask
- Does Sykik use customer data (e.g., emails, documents, chat logs) to train its own or third-party AI models, and if so, how can users opt out?
- What specific data is shared with integrated third-party tools (e.g., Gmail, Slack, Stripe), and under what legal bases (e.g., consent, contract necessity)?
- What are the data retention periods for user data, logs, and audit trails, and how can users request deletion?
- Can you provide the full DPA and subprocessor list for review, including details on international transfers and safeguards?
- How does Sykik ensure data minimization when processing user data across integrated tools?
- Are GDPR rights (access, deletion, portability, objection) explicitly described in the privacy policy, and how can users exercise them?
- Does Sykik process any special category data (e.g., health, biometric), and if so, what safeguards are in place?
- What encryption standards are used for data in transit, and how is data secured during OAuth authentication?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.
Other analysed privacy policies
View alleuropealternatives.com
78/100
Low privacy riskEurope Alternatives is a privacy-friendly directory that collects almost no personal data, but clicking partner links can send your data to third parties—including potentially outside the EU—with no clear safeguards described.
View report →langdock.com
78/100
Low privacy riskLangdock is a privacy-conscious EU-based AI platform that explicitly bans using your content to train AI models and keeps data in the EU, though it relies on some US sub-processors and has vague retention periods in places.
View report →berlin.de
80/100
Low privacy riskThe Berlin Senate Chancellery's privacy policy is generally strong, using two-click consent for third-party media and anonymizing IPs, though it relies on standard contractual clauses for some sub-processors outside the EEA and lacks clarity on AI training.
View report →swipesign.io
75/100
Medium privacy riskswipesign collects a lot of your data and shares it with many third parties (like Stripe and Twilio), but stores most of it in the EU and lets you exercise GDPR rights.
View report →