Streak

The Data Protection Officer

Contacts and organizations are real, linked objects with team-wide email timelines and custom pipeline columns, which is a credible core. Hygiene is thin: the dedupe and cleanup tooling I can see lives in the import flow, and I found no public information on merge tooling, required fields, or field-level permissions. And the auto-enrichment of contact information with publicly-available data fills records with scraped personal data and no evidenced consent fields or lawful-basis handling — a hygiene problem of a different kind. 3 4 5 12

Report an error

The Data Protection Officer

Multiple custom pipelines with custom stages, seven built-in visualizations, and triggers like a box that hasn't moved are evidenced. I found no public information on stage probabilities, required fields per stage, win/loss capture, or any forecasting, quota or snapshot capability — the reporting on show is canned charts of a single pipeline. 5 6 8

Report an error

The Data Protection Officer

The native automation tool evidences ten triggers and sixteen actions including outbound webhooks, chained multi-step flows, scheduled runs, and four AI action steps whose outputs feed later steps. I found no public information on branching or sequence analytics, the whole feature sits on the Pro+ and Enterprise plans, and every AI run meters a shared credit pool whose price is not published — with no retention or model-training policy evidenced for the inbox data those AI steps read. 7 8

Report an error

The Data Protection Officer

Living inside Gmail gives native two-way email capture (emails auto-log to the relevant box), and there is a documented, actively maintained API plus inbound and outbound webhooks and a modest native directory — Slack, Calendly, Typeform, Google Forms, LinkedIn, Zapier. This is a single-ecosystem story: I found no public information on calendar sync beyond Google, OAuth apps, a marketplace, or API parity with the interface, and the whole architecture rests on Google Workspace processing by default. 6 9 10

Report an error

The Data Protection Officer

Rewardly, Inc. is the only entity named, and the captured pages give no public information on hosting location, EU residency options, a data processing agreement, subprocessors, retention or deletion — the product cannot be evaluated apart from Google Workspace, where personal data lands by default. Automatic email sharing is enabled by default for contacts on import and records are auto-enriched from publicly-available data, with no consent fields or deletion guarantees evidenced. Nothing here is signable by a European controller. 1 2 3 12

Report an error

The Data Protection Officer

Self-serve import takes Google Sheets, CSV and Excel with update-or-create by box name, auto-created stages and dropdowns, and cleanup tools including duplicate-row deletion; export covers boxes, contacts and organizations with optional newsfeed, call logs, meeting notes and tasks, so activity history is not simply dropped. But the export destination is Google Sheets only, scheduled export sits on the top plans, moving data between accounts means contacting support, and I found no public information on export of attachments or files, or on any guided migration from other CRMs. 9 11 12

Report an error

The Data Protection Officer

Two numbers are public — the free tier and the Pro plan at $49/user/month — but the automation and scheduled-export capabilities sit on Pro+ and Enterprise plans that carry no public price at all. AI actions meter a shared team credit pool on every run, and I found no public information on what credits cost, pool sizes, VAT treatment, or billing-period differences, so a buyer cannot compute the real invoice from public pages. 6 7 8 11

Report an error