Do they own your data? Respell Privacy Policy Reviewed.

Listen to this review

0:00

/0

1×

Final Enterprise Readiness Rating: 4/10

⚠️ Partially ready (Reviewed 2026).

⚠️ Recommendation for Enterprises:

Adopt Respell with caution. Be especially careful if you handle:

• Health, financial, or legal data requiring specific compliance
• Trade secrets or confidential IP
• Data subject to strict geographic residency requirements

Instead, consider AI tools that:

• Provide explicit data residency controls
• Disclose AI model usage and offer bring-your-own options
• Implement workspace-level admin controls
• Add configurable retention and third-party restrictions

Better Alternative:

✅ BuildBetter.ai — GDPR, SOC 2 Type 2, and HIPAA compliant

✅ Zero training on customer data

✅ You own your data. Fully opt-in privacy model.

🔍  Respell Privacy Policy – Enterprise Risk Assessment

Audience: Security-conscious enterprise organizations evaluating AI workflow automation and agent building platform for internal use in highly sensitive or regulated environments (e.g. legal, healthcare, finance, tech/IP-heavy orgs).

⚠️ Where Respell Falls Short – Critical Gaps

🔒  1. Data Residency & Storage

Risk: Enterprises in regulated industries need guarantees about where their data is processed and stored. Without explicit data residency controls, companies cannot meet GDPR, financial services, or healthcare compliance requirements.

Enterprise Issue:

• No data residency guarantees
• No on-premises or VPC options mentioned
• Cannot meet geographic compliance requirements

Verdict: ❌ Fails basic compliance checklist

🧠  2. AI Model Use

Quote: "We have workspace AI and technical processes and procedures in place to protect your personal information"

Risk: Enterprises need to know if their sensitive data is being sent to external AI providers like OpenAI or Anthropic. The vague reference to 'workspace AI' provides no assurance about data isolation or model choice.

Enterprise Issue:

• Unknown if data goes to external AI providers
• No bring-your-own-model options disclosed
• Cannot assess AI data processing risks

Verdict: ❌ Zero transparency on AI processing

📊  3. Data Minimization

Quote: "Personal information we collect may include the following: names, email addresses, contact or authentication data"

Risk: While core data collection is reasonable, the automatic collection of location and device data creates unnecessary privacy risks for enterprise users who need minimal data exposure.

Enterprise Issue:

• Location tracking enabled by default
• Device fingerprinting without clear business need
• No workspace-level data minimization controls

Verdict: ⚠️ Reasonable collection scope but lacks enterprise controls

⚙️  4. Privacy Controls

Quote: "You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device"

Risk: Enterprise customers need centralized admin controls to manage privacy settings across their organization. Individual opt-out mechanisms don't scale for enterprise compliance management.

Enterprise Issue:

• No workspace-level admin controls
• Individual-only privacy management
• Cannot enforce organization-wide privacy policies

Verdict: ⚠️ Individual-focused, not enterprise-grade

📦  5. Compliance & Auditability

Quote: "The Respell platform has SOC2 compliance, a recognized standard for data security and privacy"

Risk: SOC2 compliance is a good foundation, but enterprises also need ISO 27001, HIPAA readiness, and detailed audit trail capabilities for comprehensive compliance coverage.

Enterprise Issue:

• No HIPAA compliance mentioned
• No ISO 27001 certification disclosed
• Audit trail capabilities not detailed

Verdict: ✅ Strong compliance foundation

📬  6. Consent Handling

Quote: "If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time"

Risk: Enterprises need automated consent workflows and the ability to act as data controllers for their users. Individual consent management creates compliance gaps in B2B scenarios.

Enterprise Issue:

• No enterprise consent delegation
• No automated consent workflows
• Cannot manage consent at organizational level

Verdict: ❌ Not built for enterprise consent workflows

🔍  7. Model Explainability

Risk: Enterprises need visibility into AI decision-making for compliance, debugging, and risk management. Without explainability features, companies cannot meet algorithmic accountability requirements.

Enterprise Issue:

• No AI decision logging
• No model output tracking
• Cannot audit AI behavior

Verdict: ❌ Complete black box operation

🧼  8. Data Retention & Deletion

Quote: "We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law"

Risk: While basic retention policies exist, enterprises need configurable retention periods, automated deletion schedules, and guarantees about backup deletion for compliance.

Enterprise Issue:

• No configurable retention periods
• Backup deletion timeline unclear
• Cannot set organization-specific retention rules

Verdict: ⚠️ Basic lifecycle management

🤝  9. Third-Party Sharing

Quote: "We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work"

Risk: The broad categories of third-party access (Analytics, Marketing Tools, Cloud Services) create significant data exposure risks. Enterprise customers need explicit control over which third parties can access their data.

Enterprise Issue:

• No explicit data sale prohibition
• Broad third-party sharing categories
• Cannot restrict specific third-party access

Verdict: ⚠️ Broad third-party access with weak controls

✅ What Respell Does Right (Credit Where It's Due)

• SOC2 compliance provides security foundation
• GDPR compliance with proper legal bases
• Clear data subject rights and deletion processes
• Contractual protections with third-party vendors
• Google API data protection commitment

Disclaimer: This evaluation is based solely on publicly available information and documentation. For formal enterprise vetting, always request a vendor's latest DPA, security whitepaper, and third-party audit reports.