Data cleaning for CRM imports
Privacy and GDPR
Is Sift GDPR-compliant?
The honest answer: GDPR is a legal framework, so no tool can hand you a certificate that says "compliant". What a tool can do is remove the risk in the first place. Sift does that by design. The file you clean is processed entirely in your browser and is never uploaded, so Sift never receives the customer data inside it. If we never hold your data, there is nothing on our side to store, transfer across borders, expose in a breach, or hand over. That is the strongest privacy position a data tool can take, and it is verifiable, not just promised.
Open Sift and clean a list, free →
Why the architecture is the whole answer
Most compliance worry with a data tool comes from one fact: you have to upload your list to it. The moment a spreadsheet of names, emails, and phone numbers leaves your device, you have to trust another company to store it safely, delete it when they say they will, keep it in an allowed region, and sign a data processing agreement that makes all of that binding. Sift avoids the entire problem by never receiving the file.
Sift is a static web app with no backend. When you drop in a CSV or Excel file, every step, profiling, cleaning, deduplication, mapping, scoring, and export, runs locally in your browser using your own device's processing. Your rows and cell values are never sent to a server, because there is no server to send them to.
How that maps to GDPR terms
The one place Sift does act as a data controller is the email address you choose to give it, covered below. Everything about the file you are cleaning stays with you.
What Sift actually collects, and what it never does
There are exactly three things Sift collects, and none of them is your file:
- Your email, only if you give it. If you sign up for updates, your email is stored via Supabase and the email tool Loops so we can send occasional updates. You can unsubscribe or ask us to delete it at any time.
- Feedback you send, with the email you send it with. If you use the in-app feedback box, the note and your email go to Supabase, which forwards them to Airtable and a Telegram ping so we can read and reply. Never any part of your file.
- Anonymous, cookieless usage analytics. Which features get used and rough shape, such as how many rows, via PostHog. No cell values, no names, no emails. Your email is deliberately kept out of analytics entirely.
What Sift never does:
- Never uploads, reads, or stores the contents of the files you clean.
- Never sells your data to anyone.
- Never enriches your data from third parties or connects to your CRM's API.
- Never runs AI or machine-learning transforms on your data. Every change is a deterministic rule you can see, approve, and undo, so there is a clear audit trail of what happened.
Cookieless by default
Sift's analytics are configured to write nothing to cookies, local storage, or session storage for tracking. Unique visits are counted by a privacy-preserving server-side hash rather than a client-side identifier. Because no tracking cookie or identifier is ever set, there is no ePrivacy consent banner to show and nothing to opt out of. Your email address is never sent to the analytics tool. The only thing Sift keeps in your browser's local storage is your own saved cleaning pipelines, which stay on your device.
Your GDPR rights, and how to exercise them
Because your file data never reaches us, there is nothing on our side to show, correct, or delete about the spreadsheets you clean. For the email address you may have given us, you have the usual rights: to see what we hold, correct it, or have it deleted. Email privacy@siftdata.app and we will act on it. The full detail is in the privacy policy.
Don't take our word for it
The best part of this design is that you can check it in about two minutes rather than trusting a claim:
- The devtools test. Open your browser's Network tab, clean a file, and confirm no request carries your rows.
- The offline test. Load Sift, disconnect your internet, and clean a file anyway. It still works, which is only possible if the work happens on your device.
- The policy that enforces it. A strict Content-Security-Policy blocks the browser from sending your file to any host. The full walkthrough is on the security page.