{"name":"AI tools and your data","publisher":"Yardwork","url":"https://yardwork.dev/en/data/ai-tools","method":"https://yardwork.dev/en/data/ai-tools/method","license":"https://creativecommons.org/licenses/by/4.0/","checkedThrough":"2026-10-20","tools":[{"slug":"activecampaign","name":"ActiveCampaign","vendor":"ActiveCampaign","category":"sales-marketing-and-support","plans":[{"id":"T86","plan":"Plus","tier":"business","price":{"label":"$49 / mo","amount":49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: ActiveCampaign may view, copy and internally use marketing content to train and improve its services, and uses contact data to train as part of the services; no opt-out is described","status":"verified","url":"https://www.activecampaign.com/legal/terms-of-service","locator":"Sections on Marketing Content and Contact Data (terms updated 23 Dec 2025)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not described","status":"not_published","url":"https://www.activecampaign.com/legal/terms-of-service","locator":"Section 5.3 'AI Features' and content clauses","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not documented as a customer choice; the EU appears among AWS storage locations","status":"not_published","url":"https://www.activecampaign.com/legal/subprocessors","locator":"Row 'Amazon Web Services'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Storage on AWS in the United States, the EU or Australia; ActiveCampaign does not say which customers are stored where","status":"not_published","url":"https://www.activecampaign.com/legal/subprocessors","locator":"Row 'Amazon Web Services', location 'United States, European Union, Australia' (updated 25 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, by signature: the client signs ActiveCampaign's DPA (updated 10 Apr 2026), which supplements the terms; ActiveCampaign notes not all customers need to sign one","status":"verified","url":"https://www.activecampaign.com/legal/dpa","locator":"Preamble ('between the client signing this Addendum') and note above it","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 8 entries: AWS (storage; US, EU, Australia), Cloudflare, Snowflake, Zendesk, Zight, Twilio, AWS Bedrock and OpenAI for AI features; plus affiliates","status":"verified","url":"https://www.activecampaign.com/legal/subprocessors","locator":"Sub-processors table","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (ActiveCampaign, LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'ActiveCampaign'","url2":"https://www.activecampaign.com/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period stated in the terms or DPA read","status":"not_published","url":"https://www.activecampaign.com/legal/dpa","locator":"DPA (full text)","url2":"https://www.activecampaign.com/legal/terms-of-service","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"No certificate named; ActiveCampaign says it is 'heavily focused on GDPR, SOC 2, and HIPAA compliance'","status":"vendor_statement","url":"https://www.activecampaign.com/security","locator":"Section 'Cutting-edge security protects your data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not described","status":"not_published","url":"https://www.activecampaign.com/legal/terms-of-service","locator":"Section 5.3 'AI Features'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured in EUR: the page opened in USD from Germany, Plus at USD 49 per month billed annually (smallest contact tier); a currency switch exists but EUR could not be selected","status":"not_published","url":"https://www.activecampaign.com/pricing","locator":"Plan card 'Plus'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"activepieces","name":"Activepieces","vendor":"Activepieces","category":"automation","plans":[{"id":"T483","plan":"Team","tier":"business","price":{"label":"$200 / mo","amount":200,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per the vendor's security page: automations, runs, documents and prompts never train a model. Marketing claim only; the privacy policy and terms could not be read.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Adopt with confidence > Never training data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your automations, runs, documents and prompts never train a model, ours or anyone else's."},{"key":"training_opt_out","value":"Nothing to do: the vendor's security page says customer content never trains a model. Marketing claim only.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Adopt with confidence > Never training data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your automations, runs, documents and prompts never train a model, ours or anyone else's."},{"key":"eu_residency_option","value":"Yes on the vendor's cloud (Frankfurt by default, other regions on request); self-hosting is also offered. Not stated whether other regions are open to the Team plan.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Choose where it runs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our cloud, hosted in the EUFrankfurt by default, other regions on request."},{"key":"default_data_location","value":"Germany (Frankfurt) on the vendor's cloud by default.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Choose where it runs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our cloud runs in Frankfurt by default"},{"key":"dpa","value":"Not captured: the privacy policy, terms and trust center could not be read without a browser.","status":"not_captured","url":"https://trust.activepieces.com","locator":"Trust center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not captured: no subprocessor page found; the trust center needs a browser.","status":"not_captured","url":"https://trust.activepieces.com","locator":"Trust center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Activepieces'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Activepieces' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept only as long as you choose, per the security page; no fixed period or post-cancellation deletion period given.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Adopt with confidence > What we keep","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your automations, runs, files, documents and connections, kept only as long as you choose."},{"key":"certifications","value":"One named: SOC 2 Type 2, plus a penetration test from early 2026; reports are in the trust center.","status":"vendor_statement","url":"https://www.activepieces.com/security","locator":"Adopt with confidence > Outside auditors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type 2 and a penetration test from early 2026, with the reports in the trust center."},{"key":"admin_ai_controls","value":"Not stated that an admin can switch AI features off for the organisation; the security page says an agent reaches only the tools it was given and risky actions can wait for approval.","status":"not_published","url":"https://www.activepieces.com/security","locator":"Runs are isolated and audited; pricing governance table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Team $200 flat per month (monthly billing; the annual toggle saves 2 months), 25 users included.","status":"not_published","url":"https://www.activepieces.com/pricing","locator":"Team plan card and compare table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Team For growing teams $200 flat per month"}]}]},{"slug":"adobe-creative-cloud","name":"Adobe Creative Cloud","vendor":"Adobe Inc.","category":"design-images-and-video","plans":[{"id":"T118","plan":"Pro for Teams","tier":"business","price":{"label":"€86.55 / user / mo","amount":86.55,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Adobe says it does not analyse customer content to train generative AI models (unless content is submitted to Adobe Stock), and team and company profiles are automatically opted out of content analysis for product improvement","status":"verified","url":"https://helpx.adobe.com/account/individual/terms-policies-and-regulations/content-analysis-faq.html","locator":"Opening statements and answer for 'Users with a business account or profile' (last updated 4 Jun 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: team and company profiles are automatically opted out of content analysis, and customer content is not used to train generative AI","status":"verified","url":"https://helpx.adobe.com/account/individual/terms-policies-and-regulations/content-analysis-faq.html","locator":"Answer for 'Users with a business account or profile'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not stated for Teams: regional storage in Europe is described for Creative Cloud for enterprise","status":"not_published","url":"https://www.adobe.com/trust/creative-cloud-hosting-locations.html","locator":"Section 'About Creative Cloud for enterprise'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated for Teams: Adobe's hosting page covers Creative Cloud for enterprise, where content is stored in the regional data store (North America, Europe or Japan) assigned when the user is set up in the Admin Console","status":"not_published","url":"https://www.adobe.com/trust/creative-cloud-hosting-locations.html","locator":"Section 'About Creative Cloud for enterprise' (last updated 16 Sep 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Adobe publishes a Data Processing Addendum for business customers and offers a generator for a signed copy","status":"verified","url":"https://www.adobe.com/uk/legal/terms/enterprise-licensing/data-protection.html","locator":"Section 'Data Processing Addendum' (Download, Generate)","url2":"https://www.adobe.com/privacy/sub-processors.html","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 57 third-party entries across Adobe's cloud services, including 11 AI model providers used for Firefly and Creative Cloud (OpenAI, Google, Black Forest Labs, Runway, ElevenLabs, Luma AI, fal.ai, Topaz Labs; Kuaishou and BytePlus in Singapore; Humain in Saudi Arabia)","status":"verified","url":"https://www.adobe.com/privacy/sub-processors.html","locator":"Sections 'Storage and Infrastructure' to 'Customer Support', including 'AI Models' (last updated 28 Sep 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active, re-certification under review (Adobe Inc.; EU-US DPF, Swiss-US DPF, UK Extension; non-HR data)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Adobe'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated on the pages read: the Data Processing Addendum PDF could not be read here","status":"not_captured","url":"https://www.adobe.com/uk/legal/terms/enterprise-licensing/data-protection.html","locator":"Link 'Data Processing Addendum' (PDF)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"Not stated for Teams: Adobe lists SOC 2 Type 2, SOC 3, ISO 9001, ISO/IEC 27001:2022, 27017, 27018, ISO 22301, FedRAMP Tailored and CSA STAR Level 2 for Creative Cloud for enterprise (including Firefly)","status":"not_published","url":"https://www.adobe.com/trust/compliance/compliance-list.html","locator":"Entry 'Adobe Creative Cloud for enterprise' (last updated 21 May 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not published: no Admin Console setting to switch off generative AI for Teams was found on the pages read","status":"not_published","url":"https://www.adobe.com/de/creativecloud/business/teams/plans.html","locator":"Plan card 'Creative Cloud Pro für Teams'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 86.55 per licence/month excl. VAT, annual plan billed monthly","status":"verified","url":"https://www.adobe.com/de/creativecloud/business/teams/plans.html","locator":"Plan card 'Creative Cloud Pro für Teams'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"agicap","name":"Agicap","vendor":"AGICAP SAS","category":"documents-hr-and-finance","plans":[{"id":"T608","plan":"individual quote","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Agicap states that customer data is not used to create, train or improve a machine-learning model or a generalised AI tool, including when it uses the OpenAI API.","status":"verified","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, section on AI tools and OpenAI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"die Daten seiner Kunden nicht zum Erstellen, Trainieren oder Verbessern eines maschinellen Lernmodells oder eines verallgemeinerten Tools für künstliche Intelligenz verwendet werden"},{"key":"training_opt_out","value":"Nothing to do: Agicap states that customer data is not used to create, train or improve machine-learning models or generalised AI tools.","status":"verified","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, section on AI tools and OpenAI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"die Daten seiner Kunden nicht zum Erstellen, Trainieren oder Verbessern eines maschinellen Lernmodells oder eines verallgemeinerten Tools für künstliche Intelligenz verwendet werden"},{"key":"eu_residency_option","value":"No separate option is needed or offered: hosting is already in Belgium in the EU, and no region setting is described.","status":"not_published","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Hosting section; Preise and imprint pages checked for a region option","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"Belgium, on Google Cloud Platform.","status":"verified","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, section on hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Alle erhobenen personenbezogenen Daten werden in den Belgien gehostet, bei Google Cloud Platform"},{"key":"dpa","value":"Yes. Agicap says it has a data processing agreement (AVV/DPA) covering roles, sub-processor management, retention and deletion after contract end. The document itself was not found on public pages.","status":"vendor_statement","url":"https://agicap.com/de/sicherheit/","locator":"Security page, \"Ein umfassender Datenverarbeitungsvertrag\"","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unser Auftragsverarbeitungsvertrag (AVV) legt fest, wie Ihre Daten in strikter Übereinstimmung mit den geltenden Datenschutzvorschriften erhoben, verarbeitet, gespeichert und geschützt werden."},{"key":"subprocessor_list","value":"Not published as a list. The policy names categories of processors, including providers of AI tools, but gives no entries, addresses or count.","status":"not_published","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, 'Externer Empfänger: Auftragsverarbeiter'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, AGICAP SAS, Lyon)","status":"verified","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, section 2 Verantwortlicher","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AGICAP, Vereinfachte Aktiengesellschaft mit 22.463,70 € Kapital und Sitz in 57-59, Rue de St Cyr, 69009 Lyon"},{"key":"data_retention","value":"Kept in the active database for as long as the purpose needs or the law requires, with no fixed period published for customer data.","status":"verified","url":"https://agicap.com/de/datenschutzerklarung/","locator":"Datenschutzerklärung, section 6 'Welche Aufbewahrungsfristen gelten?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Personenbezogene Daten werden in der aktiven Datenbank von Fall zu Fall für den Zeitraum aufbewahrt, der für den Zweck der Verarbeitung, für die sie erhoben und verarbeitet wurden, erforderlich ist"},{"key":"certifications","value":"ISO 27001:2022 (certified since 2024). The trust centre also lists a penetration-test certification and a SOC 2 Type 2 report shown as \"in progress\".","status":"verified","url":"https://agicap.com/de/sicherheit/","locator":"Security page, section ISO 27001; trust.agicap.com Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Agicap ist seit 2024 nach ISO 27001:2022 zertifiziert."},{"key":"admin_ai_controls","value":"Not published. AI features are described, but no administrator switch to disable AI for the organisation is documented.","status":"not_published","url":"https://agicap.com/de/datenschutzerklarung/","locator":"AI section; Preise page (no AI control found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"No price published. Agicap sells through individual quotes; the pricing page is titled 'Individual offers for every company' and shows no amounts.","status":"not_published","url":"https://agicap.com/de/preise/","locator":"Preise page title and FAQ (pricing content loads dynamically)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Individuelle Angebote für jedes Unternehmen"}]}]},{"slug":"ahrefs","name":"Ahrefs","vendor":"Ahrefs Pte Ltd (Singapore)","category":"sales-marketing-and-support","plans":[{"id":"T525","plan":"Advanced","tier":"business","price":{"label":"€419 / mo","amount":419,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: Ahrefs' Terms (13.3) say you agree it may use your User Content, including content you give its AI tools, to train its machine learning models; no opt-out is described.","status":"verified","url":"https://ahrefs.com/terms","locator":"13. Data Privacy, 13.3","url2":"https://ahrefs.com/legal/privacy-policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You agree that we may use User Content, including any content you provide to us in connection with your use of AI Tools, to train our machine learning models"},{"key":"training_opt_out","value":"Not stated; the Terms (13.3) give no way to stop training on your content, and the privacy policy only mentions a general right to object plus cookie opt-outs.","status":"not_published","url":"https://ahrefs.com/legal/privacy-policy","locator":"4. Purposes; Rights (Right to object)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no option to keep data in the EU found (privacy policy says data is stored in the United States).","status":"not_published","url":"https://ahrefs.com/legal/privacy-policy","locator":"Privacy policy; DPA; sub-processor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (Amazon Web Services, listed with locations USA and Singapore).","status":"verified","url":"https://ahrefs.com/legal/privacy-policy","locator":"Cross-border transfer / storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Personal Data we collect is transferred to and stored in the United States where our services and other web properties operate."},{"key":"dpa","value":"Yes: a published Data Processing Addendum applies by incorporation to the agreement; the EU Standard Contractual Clauses are pre-signed by Ahrefs and become binding when the customer signs Annex I and sends it back.","status":"verified","url":"https://ahrefs.com/legal/data-processing-addendum","locator":"How the DPA applies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the main body of the DPA and Annex C apply by way of incorporation to the Agreement"},{"key":"subprocessor_list","value":"Yes, public at ahrefs.com/legal/subprocessors-list: 37 entries (last modified May 13, 2026); AI-related: Open AI (AI-enabled functionality), Zapier (AI automation), Cursor (AI coding platform).","status":"verified","url":"https://ahrefs.com/legal/subprocessors-list","locator":"Sub-Processors List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Open AI AI-enabled functionality USA"},{"key":"dpf_status","value":"No listing found for search term 'Ahrefs'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Ahrefs' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data is kept only as long as needed for its purpose and deleted when you delete it in your account; some information is kept longer for security, fraud prevention or financial records. No fixed number of days.","status":"verified","url":"https://ahrefs.com/legal/privacy-policy","locator":"6. Storage and Retention of Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where you delete any Personal Data within your account with Ahrefs Services, such Personal Data is also deleted from our servers."},{"key":"certifications","value":"Not stated; no ISO 27001 or SOC 2 certification named on the legal pages (ahrefs.com/security returned 404).","status":"not_published","url":"https://ahrefs.com/legal","locator":"Legal information page; /security (404)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the terms say AI Tools are used at the customer's option, but no organisation-wide switch is documented.","status":"not_published","url":"https://ahrefs.com/legal/terms","locator":"6. Use and Conduct of Artificial Intelligence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€419 per month for Advanced (1 user included); the page also offers annual billing with savings up to 17%; VAT not shown.","status":"verified","url":"https://ahrefs.com/pricing","locator":"Plans & pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€ 119 /mo € 229 /mo € 419 /mo"}]}]},{"slug":"aircall","name":"Aircall","vendor":"Aircall (Aircall SAS, Paris; Aircall.io, Inc., New York)","category":"phone-and-voice","plans":[{"id":"T410","plan":"Professional","tier":"business","price":{"label":"$50 / user / mo","amount":50,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Aircall itself; it says its AI features do not use customer data to train the AI providers' foundational models.","status":"verified","url":"https://aircall.io/privacy-faqs/","locator":"Q6 How does Aircall AI process your data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The AI Features do not use Customer Data submitted to the Services or the resulting AI outputs to train, retrain or improve the providers' foundational models."},{"key":"training_opt_out","value":"No opt-out is described. Aircall states its AI features do not use customer data to train its AI providers' foundational models; nothing is stated about Aircall's own training.","status":"verified","url":"https://aircall.io/privacy-faqs/","locator":"Q6 How does Aircall AI process your data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The AI Features do not use Customer Data submitted to the Services or the resulting AI outputs to train, retrain or improve the providers' foundational models."},{"key":"eu_residency_option","value":"Partly. New accounts are assigned a US, EU (AWS Frankfurt) or Australia hosting region by signup phone number country code for recordings, voicemails and, for new accounts, transcripts and AI data; existing accounts are still migrating.","status":"verified","url":"https://aircall.io/regional-data-hosting/","locator":"Regional data hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"new Aircall accounts are automatically assigned to a US, EU, or Australia hosting location — based on the phone number/country code used at signup — for the data types above."},{"key":"default_data_location","value":"Call recordings and voicemails: AWS Oregon (USA) for North American numbers, AWS Frankfurt (Germany) for EMEA numbers. Everything else (account data, metadata, support data) stays in AWS US West, Oregon.","status":"verified","url":"https://aircall.io/privacy-faqs/","locator":"Q14 Where does Aircall store its customers' data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All other personal information not scoped for the conversational data regional hosting, including Customer account data, Customer contact data, Customer financial/payment data, Information about user, Call/SMS metadata, Additional call-related data, etc., as well as any Personal Data provided during support interaction, remains stored on AWS US West servers in Oregon, USA."},{"key":"dpa","value":"Yes. The DPA is part of the Terms of Use or Master Subscription Agreement automatically; no action or signature needed.","status":"verified","url":"https://aircall.io/privacy-faqs/","locator":"Q3 Concluding a DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"there is no action needed on your side in order to conclude a Data Processing Agreement (DPA) with Aircall"},{"key":"subprocessor_list","value":"Yes: https://aircall.io/subprocessorlist/ . 26 entries: 20 third parties (including 6 AI providers) and 6 Aircall group entities. AI providers: Microsoft Azure, Deepgram, ElevenLabs, AssemblyAI, Cartesia AI, Firecrawl.","status":"verified","url":"https://aircall.io/subprocessorlist/","locator":"AI solution providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Generation of conversation insights (Call summarisation, Key topics list, Talk ratio etc.) from voice transcriptions."},{"key":"dpf_status","value":"Active (Aircall.io, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Aircall'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Call recordings kept for the period in your plan (can be indefinite), at most 30 days after the relationship ends; admins can ask support to change it or delete calls. AI providers keep nothing (zero data retention). DPA: export within 30 days after termination, then deletion.","status":"verified","url":"https://aircall.io/privacy-faqs/","locator":"Q15 retention / Call recordings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We by default store your call recording for the period indicated in your pricing plan, which may be indefinite (but always up to 30 days following the termination of your relationship with Aircall)."},{"key":"certifications","value":"SOC 2 Type 2 (1 certification named). The security programme is only 'aligned with' ISO 27001 and SOC II; AWS hosting holds ISO 27001, SOC 2, PCI DSS, FedRAMP.","status":"verified","url":"https://aircall.io/security/","locator":"Security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Aircall is SOC2 Type 2 compliant"},{"key":"admin_ai_controls","value":"Not stated: no admin switch to turn AI features off was found.","status":"not_published","url":"https://aircall.io/security/","locator":"Looked at security, pricing, privacy FAQs, regional hosting and DPA pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: $50 per license/month (Professional; Essentials $30). Minimum 3 licenses; the page has an annual/monthly toggle (annual saves 25%), and the billing basis of the $50 figure is not stated.","status":"not_published","url":"https://aircall.io/pricing/","locator":"Pricing page: Professional plan and FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Professional plan starts at $50/license/month"}]}]},{"slug":"airtable","name":"Airtable","vendor":"Airtable (Formagrid Inc)","category":"workspace-and-projects","plans":[{"id":"T108","plan":"Team","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Airtable will not use, or let its AI providers or others use, Input, Output or any other Customer Data to train generative AI models","status":"verified","url":"https://www.airtable.com/company/ai-terms","locator":"Section 'Customer Data Rights and Model Training' (last updated 23 Jul 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: customer data is not used to train generative models","status":"verified","url":"https://www.airtable.com/company/ai-terms","locator":"Section 'Customer Data Rights and Model Training'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Team: data residency in Europe is only for Enterprise Scale, and some data (such as organisation metadata) stays in US data centres","status":"verified","url":"https://support.airtable.com/docs/data-residency-at-airtable","locator":"'Plan availability: Enterprise Scale' and section 'What data remains in US data centers?'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: data residency defaults to the US","status":"verified","url":"https://support.airtable.com/docs/data-residency-at-airtable","locator":"Paragraph 'Airtable offers data residency in the United States (default), Europe, and Australia'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Airtable's DPA (last updated 8 Sep 2026) is incorporated by reference into the agreement governing use of the Services","status":"verified","url":"https://www.airtable.com/company/dpa","locator":"Opening paragraphs","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 24 third parties (3 core infrastructure, 9 AI including Anthropic, OpenAI, Google, AWS and IBM, 12 other) plus 3 Airtable subsidiaries; almost all in the US","status":"verified","url":"https://www.airtable.com/company/subprocessors","locator":"Page 'Airtable Subprocessors' (last updated 25 Aug 2026)","url2":"https://www.airtable.com/company/dpa","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search terms 'Airtable' and 'Formagrid'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Searches 'Airtable' and 'Formagrid' returned no results","url2":"https://www.airtable.com/company/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On Team, Airtable's AI providers may keep prompts and answers for up to 30 days for safety moderation (Business and Enterprise Scale: not kept). After the agreement ends, Airtable deletes or anonymises personal data on written request; backups follow its own retention processes","status":"verified","url":"https://www.airtable.com/company/ai-terms","locator":"Section 'Data Retention'","url2":"https://www.airtable.com/company/dpa","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2; ISO/IEC 27001:2022 and 27701:2019; HIPAA support","status":"verified","url":"https://www.airtable.com/company/trust-and-security","locator":"Compliance sections","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Customers can disable Airtable AI at any time from the admin panel or Workspace settings; choosing which AI providers to allow is only for Business and Enterprise Scale","status":"verified","url":"https://www.airtable.com/company/ai-terms","locator":"Opening section ('disable Airtable AI via your admin panel or your Workspace settings')","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 20 per seat/month billed annually, including 15,000 AI credits per paid user a month","status":"not_published","url":"https://airtable.com/pricing","locator":"Plan card 'Team'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"amazon-q-developer","name":"Amazon Q Developer","vendor":"Amazon Web Services, Inc.","category":"code-and-app-builders","plans":[{"id":"T534","plan":"Pro tier","tier":"business","price":{"label":"$19 / user / mo","amount":19,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. For the Pro tier, AWS says customer content is not used to train any underlying foundation models (the Free tier is different).","status":"verified","url":"https://aws.amazon.com/q/developer/faqs/","locator":"FAQs, Does Amazon Q Developer use my content to train any models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For users who access Amazon Q Developer with the Pro Tier, your content is not used to train any underlying FMs."},{"key":"training_opt_out","value":"Nothing to do on the Pro tier: AWS states Pro content is not used for training or service improvement. (The Free tier has an opt-out; telemetry can be switched off in the IDE, but that is not a training setting.)","status":"verified","url":"https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/service-improvement.html","locator":"Amazon Q Developer service improvement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use content from Amazon Q Developer Pro or Amazon Q Business for service improvement."},{"key":"eu_residency_option","value":"Yes. Create the Q Developer profile in Europe (Frankfurt); requests are then stored there, and cross-region inference stays within European Regions. Some features are unavailable in Frankfurt and others can still use the US.","status":"verified","url":"https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.html","locator":"Supported Regions for the Q Developer console and Q Developer profile","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Amazon Q Developer console and Amazon Q Developer profile are supported in the following Regions: US East (N. Virginia) Europe (Frankfurt)"},{"key":"default_data_location","value":"In the AWS Region where the customer's Q Developer profile was created (US East N. Virginia or Europe Frankfurt), for chat, IDE and command-line features. Other features can be stored and processed in a US Region.","status":"verified","url":"https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/data-storage.html","locator":"Data storage, AWS Regions where content is processed and stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your content is stored in the AWS Region where your Amazon Q Developer profile was created only for the following features"},{"key":"dpa","value":"Yes. The AWS Data Processing Addendum supplements the AWS Customer Agreement (or other agreement governing use of the services).","status":"verified","url":"https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf","locator":"AWS Data Processing Addendum, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"supplements the AWS Customer Agreement available at"},{"key":"subprocessor_list","value":"Partly. AWS publishes one AWS-wide sub-processor list (aws.amazon.com/compliance/sub-processors/) organised by service; only 'Amazon Q Developer Free Tier' appears, not the Pro tier. No count given because the list is not specific to Q Developer.","status":"verified","url":"https://aws.amazon.com/compliance/sub-processors/","locator":"Section 2b, AWS entities providing service improvement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Q Developer Free Tier Kiro Free Tier / Individual Subscriber Canada Germany Netherlands USA"},{"key":"dpf_status","value":"Active (Amazon.com, Inc. (listing with 5 covered entities); EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Amazon Web Services'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated. AWS says Pro-tier content can be stored and processed to provide and maintain the service but gives no retention period or deletion window.","status":"not_published","url":"https://aws.amazon.com/q/developer/faqs/","locator":"Looked in: FAQs (Privacy), Data protection and Data storage pages of the User Guide","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1, SOC 2 and SOC 3 (3 reports): the FAQ says Q Developer is included in the latest SOC reports, available through AWS Artifact. No other certification is named for Q Developer.","status":"verified","url":"https://aws.amazon.com/q/developer/faqs/","locator":"FAQs, Is Amazon Q Developer included in AWS’s latest SOC report?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Q Developer is included in the latest SOC 1/2/3 reports."},{"key":"admin_ai_controls","value":"Yes. AWS administrators can allow or deny Amazon Q Developer, or limit it to EU Regions, for the organisation using IAM and service control policies. For Pro, admins also set the code-reference filter centrally.","status":"verified","url":"https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/security_iam_manage-access-with-policies.html","locator":"Manage access to Amazon Q Developer with policies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can also use service control policies (SCPs) to control what Amazon Q features are available in your"},{"key":"price_eur","value":"Shown in USD only: Pro tier $19 per user/month.","status":"not_published","url":"https://aws.amazon.com/q/developer/pricing/","locator":"Pricing Overview, Pro Tier","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro Tier: Expanded limits $19/mo. per user"}]}]},{"slug":"apollo","name":"Apollo.io","vendor":"Apollo.io (Zenleads Inc.)","category":"sales-marketing-and-support","plans":[{"id":"T87","plan":"Professional","tier":"business","price":{"label":"$79 / user / mo","amount":79,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in aggregated or de-identified form: the terms grant Apollo a perpetual licence to analyse customer data with AI to improve the platform and develop products. Apollo may also use customer data to grow and enrich its shared contact database; third parties may not train on it","status":"verified","url":"https://www.apollo.io/terms","locator":"Clauses on Customer Data licence and Contributor Database (terms updated 10 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not described: the licence is perpetual and no opt-out from de-identified AI use or database contribution is offered in the terms","status":"not_published","url":"https://www.apollo.io/terms","locator":"Customer Data licence clause","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://trust.apollo.io/","locator":"Trust Center (full page)","url2":"https://www.apollo.io/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: all listed sub-processors, including hosting on Google Cloud and AWS, are in the US","status":"verified","url":"https://trust.apollo.io/","locator":"Subprocessors table, location column","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Apollo's DPA is incorporated into the agreement; signing the agreement counts as signing the DPA and its SCCs","status":"verified","url":"https://www.apollo.io/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 24 entries, all in the US; AI providers include OpenAI, Anthropic, Microsoft Azure, Perplexity, AssemblyAI, Baseten and Exa","status":"verified","url":"https://trust.apollo.io/","locator":"Subprocessors table","url2":"https://www.apollo.io/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Zenleads Inc., dba Apollo.io; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'ZenLeads' (a search for 'Apollo.io' returns no results)","url2":"https://trust.apollo.io/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the agreement; within 90 days after termination Apollo deletes or returns customer personal data at the customer's choice","status":"verified","url":"https://www.apollo.io/dpa","locator":"Section 'Deletion and Retention', 'Deletion of Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 and ISO/IEC 27001; GDPR, CCPA and EU-US DPF listed","status":"verified","url":"https://trust.apollo.io/","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Limited: admins manage seats and set per-user credit caps; no switch for AI features is described","status":"verified","url":"https://www.apollo.io/pricing","locator":"FAQ on credit usage ('admins can set per-user credit caps')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 79 per seat/month billed annually","status":"not_published","url":"https://www.apollo.io/pricing","locator":"Plan card 'Professional'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"asana","name":"Asana","vendor":"Asana, Inc.","category":"workspace-and-projects","plans":[{"id":"T103","plan":"Advanced","tier":"business","price":{"label":"$24.99 / user / mo","amount":24.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Asana does not use or let its third-party AI partners use customer data to train the generative AI models behind Asana AI","status":"verified","url":"https://asana.com/terms/asana-product-specific-terms","locator":"Section 'Asana AI' ('For purposes of clarity, Asana does not use or permit…')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: no training on customer data","status":"verified","url":"https://asana.com/terms/asana-product-specific-terms","locator":"Section 'Asana AI'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Advanced: EU data residency is part of Enterprise+ and is ordered as a data residency SKU; profile data and organisation membership stay in the US","status":"verified","url":"https://asana.com/pricing","locator":"Enterprise+ note ('adds SIEM integration, data residency…')","url2":"https://asana.com/terms/asana-product-specific-terms","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: organisations are hosted in AWS data centres in the US unless moved under a data residency order","status":"verified","url":"https://asana.com/terms/asana-product-specific-terms","locator":"Section 'Data Residency'","url2":"https://asana.com/terms/subprocessors","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Asana's DPA (effective 1 Sep 2026) is incorporated by reference into the subscription agreement","status":"verified","url":"https://asana.com/terms/data-processing","locator":"Preamble","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 23 entries (15 companies) in four groups, mostly in the US; AI from Anthropic, OpenAI, AWS Bedrock, Google Gemini and Fireworks","status":"verified","url":"https://asana.com/terms/subprocessors","locator":"Subprocessors page (last updated 11 Sep 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Asana; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Asana'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period stated; customers can export and delete data at organisation level","status":"not_published","url":"https://asana.com/trust","locator":"Section on data export and deletion","url2":"https://asana.com/terms/data-processing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO/IEC 27001, 27017, 27018 and 27701; HIPAA","status":"verified","url":"https://asana.com/trust","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not described for Advanced: Asana's pages read mention admin limits on AI request spending and project admin controls, but no switch to turn AI off","status":"not_published","url":"https://asana.com/terms/asana-product-specific-terms","locator":"AI Requests clause ('as set in the Admin Console')","url2":"https://asana.com/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 24.99 per user/month billed annually","status":"not_published","url":"https://asana.com/pricing","locator":"Plan card 'Advanced'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"ashby","name":"Ashby All-in-One","vendor":"Ashby, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T616","plan":"Foundations","tier":"business","price":{"label":"$400 / mo","amount":400,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The AI Terms say neither Ashby nor its AI providers (OpenAI, AWS Bedrock, Google Gemini) will use customer data to train machine learning models. AI tools are opt-in.","status":"verified","url":"https://www.ashbyhq.com/resources/terms-ai-features","locator":"3. No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Neither Ashby nor any of the Third-Party AI Services will use Customer Data to train machine learning models."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train on customer data, and AI tools only run for customers who opt into them.","status":"verified","url":"https://www.ashbyhq.com/resources/terms-ai-features","locator":"3. No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your use of Ashby’s AI Tools does not grant Ashby or such third parties any right or license to use Customer Data for such training purposes."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found. The GDPR page says data is stored and processed in the US and offers help with a Transfer Impact Assessment.","status":"not_published","url":"https://www.ashbyhq.com/resources/gdpr","locator":"Data Transfer and Storage; security page; terms; AI terms (searched for EU region)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ashby can support you in creating a Transfer Impact Assessment on request."},{"key":"default_data_location","value":"United States. Ashby stores and processes data in the US, on Amazon Web Services infrastructure.","status":"verified","url":"https://www.ashbyhq.com/resources/gdpr","locator":"Data Transfer and Storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ashby stores and processes data in the United States."},{"key":"dpa","value":"Yes, on request. Ashby offers a Data Processing Agreement that includes the standard contractual clauses; it is not a click-through part of the terms.","status":"verified","url":"https://www.ashbyhq.com/resources/gdpr","locator":"Data Processing Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ashby offers a Data Processing Agreement on request, which includes the “standard contractual clauses” typically recommended for sub-processor agreements."},{"key":"subprocessor_list","value":"Not captured: Ashby's sub-processor list sits in its Trust Center (trust.ashbyhq.com), which returned 403 without a browser. The AI Terms name 3 AI sub-processors: OpenAI, AWS (Amazon Bedrock) and Google (Gemini).","status":"not_captured","url":"https://www.ashbyhq.com/resources/terms-ai-features","locator":"2. Use of Third-Party AI Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Third-Party AI Services currently used by Ashby in providing the AI Tools are:"},{"key":"dpf_status","value":"Active (Ashby; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Ashby'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer sets custom retention periods using activity- or consent-based rules, and can export, delete or anonymise candidates. Ashby may erase customer data once an account is delinquent, suspended or terminated for 30 days or more. AI providers do not retain data beyond the processing session.","status":"verified","url":"https://www.ashbyhq.com/resources/gdpr","locator":"Candidates have the right to be notified of data collection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ashby’s data privacy tools provide custom data retention periods using activity or consent-based rules."},{"key":"certifications","value":"1 named: SOC 2 Type 2, audited annually. No ISO certificate named on the readable pages; the Trust Center was not readable.","status":"verified","url":"https://www.ashbyhq.com/resources/security","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ashby is SOC2 compliant and Type 2 audited annually."},{"key":"admin_ai_controls","value":"Yes in effect: the AI tools apply only to features the customer specifically opts into, and the AI Notetaker can be disabled. The terms do not say which role switches them on.","status":"verified","url":"https://www.ashbyhq.com/resources/terms-ai-features","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"artificial intelligence tools and functionality that Ashby makes available to Customer in connection with the Ashby Service and that Customer specifically opts into using"},{"key":"price_eur","value":"Shown in USD only: Foundations (up to 100 employees) $400 per month for 1-10 employees, rising with company size; 10% off for annual commitment. Plus and Enterprise plans are priced on request.","status":"not_published","url":"https://www.ashbyhq.com/pricing","locator":"All-In-One Foundations Plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Get started within minutes, scales with you for years. 10% discount for annual commitments available."}]}]},{"slug":"attio","name":"Attio","vendor":"Attio Limited","category":"sales-marketing-and-support","plans":[{"id":"T494","plan":"Pro","tier":"business","price":{"label":"€74 / user / mo","amount":74,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Attio states it does not train its own models on customer data and does not allow third-party AI providers to train on it. One user choice: a personal setting can share downvoted Ask Attio chats with Attio to improve Ask Attio.","status":"verified","url":"https://attio.com/help/reference/attio-ai/attio-ai-policy","locator":"5. Training models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don't train our own models on customer data, and we don't allow third-party AI providers to train their models on it either."},{"key":"training_opt_out","value":"Nothing to do: Attio states it does not train its own models on customer data and does not let third-party AI providers do so.","status":"verified","url":"https://attio.com/help/reference/attio-ai/attio-ai-policy","locator":"5. Training models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don't train our own models on customer data, and we don't allow third-party AI providers to train their models on it either."},{"key":"eu_residency_option","value":"Not stated on the pages read (DPA, services agreement, AI policy, privacy policy). The AI policy says AI providers are used through global endpoints.","status":"not_published","url":"https://attio.com/help/reference/attio-ai/attio-ai-policy","locator":"6. Location of AI models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Please note that we use global endpoints for all AI providers we currently use, and therefore processing may occur outside of the location of the AI provider itself."},{"key":"default_data_location","value":"Hosted on Google Cloud Platform (hosting provider listed: Google Cloud EMEA Limited, Dublin). The region or country is not stated.","status":"not_published","url":"https://attio.com/legal/attio-data-processing-addendum","locator":"Annex B 3.1.1 Physical Access Controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Attio platform is hosted on Google Cloud Platform."},{"key":"dpa","value":"Yes. Attio publishes a DPA (with EU Standard Contractual Clauses and the UK Addendum) as part of the customer agreement; accepting the agreement is treated as signing the SCCs.","status":"verified","url":"https://attio.com/legal/attio-data-processing-addendum","locator":"Annex C 1.1 (EU Standard Contractual Clauses)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By entering into the Attio Customer Agreement, Data Exporter is deemed to have signed these EU Standard Contractual Clauses"},{"key":"subprocessor_list","value":"Yes. Annex A of the public DPA lists 14 entries. Model/AI providers: Google Cloud EMEA (LLM), OpenAI, LLC, Anthropic Ireland, Limited, Baseten Labs (from 26 Oct 2026), plus ElevenLabs for call transcription.","status":"verified","url":"https://attio.com/legal/attio-data-processing-addendum","locator":"Annex A, Approved Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic Ireland, Limited 6th Floor South Bank House, Barrow Street, Dublin 4, Dublin, Ireland SCCs and UK Addendum Large language model for platform functionality"},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Attio Limited, London)","status":"verified","url":"https://attio.com/legal/services-agreement","locator":"Contracting entity definition","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Attio Limited, a company incorporated in England and Wales with its registered office address at 42 St John’s Square, 2nd Floor, London, United Kingdom, EC1M 4EA"},{"key":"data_retention","value":"After termination Attio makes your data available for export for 30 days; after that it deletes only if you ask (it 'may, but is not obligated to' otherwise). Deletion requests are honoured within 30 days. Retention of AI chats not stated.","status":"verified","url":"https://attio.com/legal/services-agreement","locator":"16.2 Effects of termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon any termination, Attio will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days."},{"key":"certifications","value":"Not captured: Attio's help page says certifications are listed on its Trust Center (trust.attio.com), which needs a browser.","status":"not_captured","url":"https://attio.com/help/reference/workspace-settings-billing/security/security-at-attio","locator":"Trust Center paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. Admins can set Ask Attio workspace context, but no page read describes switching AI off for the whole workspace.","status":"not_published","url":"https://attio.com/help/reference/attio-ai/ask-attio/manage-ask-attio-settings","locator":"Access Ask Attio workspace settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Workspace settings can only be configured by admins."},{"key":"price_eur","value":"€74 per user/month billed annually (€93 billed monthly) for Pro. VAT treatment not shown.","status":"verified","url":"https://attio.com/pricing","locator":"Plans: Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro €9374 Save 20% Per user/month, billed monthlyannually"}]}]},{"slug":"avoma","name":"Avoma","vendor":"Avoma, Inc.","category":"meetings-and-notes","plans":[{"id":"T380","plan":"Startup","tier":"business","price":{"label":"$19 / mo","amount":19,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not captured: the trust-centre FAQ has the question 'Does your application use customer data to train or feed any AI or LLMs?' but its answer is hidden behind JavaScript. The privacy policy only says Google Workspace data is not used to train generalized AI models.","status":"not_captured","url":"https://trust.avoma.com/faq","locator":"FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated in the pages read: no setting or email for stopping AI training is described; the trust-centre FAQ answer on training is not readable without a browser","status":"not_published","url":"https://www.avoma.com/privacy-policy","locator":"Looked at privacy policy, terms, security page, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: the security page, privacy policy and DPA name US hosting only and describe no EU storage setting","status":"not_published","url":"https://www.avoma.com/security","locator":"Looked at security page, privacy policy, terms, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Avoma hosts all its software in Amazon Web Services facilities in the USA","status":"verified","url":"https://www.avoma.com/security","locator":"Infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Avoma hosts all its software in Amazon Web Services (AWS) facilities in the USA."},{"key":"dpa","value":"Yes: the Avoma Data Processing Addendum is part of the Terms of Use by reference and is published at avoma.com/data-processing-addendum; it includes EU standard contractual clauses","status":"verified","url":"https://www.avoma.com/terms","locator":"Warranty and Data Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The terms of the Avoma Data Processing Addendum"},{"key":"subprocessor_list","value":"Yes, public list at trust.avoma.com/subprocessors with 15 entries; AI providers listed: OpenAI, Anthropic, Baseten, plus Braintrust (AI observability); transcription by Deepgram and Rev","status":"verified","url":"https://trust.avoma.com/subprocessors","locator":"Subprocessors (15)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Here are the subprocessors that Avoma uses to process data in its infrastructure and business operations."},{"key":"dpf_status","value":"Active (Avoma; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Avoma'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer personal data is returned or deleted within 30 days after the service ends, or sooner on request; retention periods during the subscription are not specified","status":"verified","url":"https://www.avoma.com/terms","locator":"Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Avoma will return Customer Personal Data to Customer or delete such data within thirty (30) days after termination of the Services or sooner upon Customer’s request."},{"key":"certifications","value":"2 named: SOC 2 Type II and ISO/IEC 42001:2023; GDPR support is claimed but not as a certificate","status":"verified","url":"https://www.avoma.com/security","locator":"Security and Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We maintain SOC 2 Type II and ISO/IEC 42001:2023 certifications and support GDPR compliance."},{"key":"admin_ai_controls","value":"Not stated: the pricing page and security page describe no admin switch to turn AI features off or limit them for the organisation","status":"not_published","url":"https://www.avoma.com/pricing","locator":"Looked at pricing comparison and security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $19 per recorder seat per month billed annually ($29 on monthly billing); viewers are free (Startup plan, up to 25 paid seats)","status":"not_published","url":"https://www.avoma.com/pricing","locator":"Startup card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"azure-translator","name":"Azure Translator","vendor":"Microsoft Corporation","category":"writing-and-email","plans":[{"id":"T354","plan":"S1 pay as you go","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: Microsoft states text and audio submitted to Translator are not written to storage and are not used for training.","status":"verified","url":"https://www.microsoft.com/translator/business/notrace/","locator":"No Trace","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The audio and text will not be used for training purposes either."},{"key":"training_opt_out","value":"Nothing to do: Microsoft states Translator text and audio are not used for training.","status":"verified","url":"https://www.microsoft.com/translator/business/notrace/","locator":"No Trace","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The audio and text will not be used for training purposes either."},{"key":"eu_residency_option","value":"Yes: the Europe endpoint (api-eur) processes text translation in France Central or West Europe; Switzerland resources process in Switzerland. Document Translation follows the resource region.","status":"verified","url":"https://learn.microsoft.com/en-us/azure/ai-services/translator/region-support","locator":"Standard NMT endpoints","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Europe, except Switzerland: api-eur.cognitive.microsofttranslator.com France Central or West Europe."},{"key":"default_data_location","value":"Depends on endpoint: the global endpoint uses the closest datacentre; Document Translation processes and temporarily stores content in the region where you created the resource.","status":"verified","url":"https://learn.microsoft.com/en-us/azure/ai-services/translator/region-support","locator":"Plan where documents are processed","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The region where you create the Translator resource determines where document content is processed and temporarily stored during translation."},{"key":"dpa","value":"Yes: the Microsoft Products and Services Data Protection Addendum is part of the terms for Azure subscriptions and applies automatically.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"DPA overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)"},{"key":"subprocessor_list","value":"Microsoft publishes its sub-processor list at https://aka.ms/subprocessor (Service Trust Portal), which needs a browser and could not be read.","status":"not_captured","url":"https://aka.ms/subprocessor","locator":"Service Trust Portal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Text translation stores nothing. Document translation holds data temporarily while processing, then hard-deletes it. Custom Translator training documents stay in your chosen Azure region until you delete them or your account expires.","status":"verified","url":"https://learn.microsoft.com/en-us/legal/cognitive-services/translator/data-privacy-security","locator":"Does Translator keep my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Document translation temporarily stores customer data while processing."},{"key":"certifications","value":"ISO 27001, 27017, 27018, 9001 and 20000-1; SOC 1, 2 and 3; CSA STAR; HITRUST CSF; PCI DSS; FedRAMP High; HIPAA BAA (about 11 listed).","status":"verified","url":"https://www.microsoft.com/translator/business/notrace/","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Translator is ISO certified with five certifications applicable to the service."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to disable Translator found in the pages read. Admins control it through Azure access and resource creation.","status":"not_published","url":"https://learn.microsoft.com/en-us/legal/cognitive-services/translator/data-privacy-security","locator":"Translator documentation pages read","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Pay as you go (S1) is priced per million characters; the saved page text shows only '$-' placeholders, so the amount could not be read.","status":"not_captured","url":"https://azure.microsoft.com/en-us/pricing/details/cognitive-services/translator/","locator":"S1 – Pay as you go","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"bamboohr","name":"BambooHR","vendor":"Bamboo HR, LLC","category":"documents-hr-and-finance","plans":[{"id":"T590","plan":"Pro","tier":"business","price":{"label":"$17 / mo","amount":17,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for the customer's own AI model only: BambooHR may use your data, inputs and outputs to fine-tune and train the models behind its AI features, but says it will do so just to provide those features to you and will not use that model for other customers.","status":"verified","url":"https://www.bamboohr.com/legal/bamboohr-artificial-intelligence-addendum","locator":"8. Improving Bamboo AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To the extent that BambooHR uses customer Data, Input and Output to fine-tune and train the machine learning methods and data models used to provide the Bamboo AI features, it will do so just to provide the Bamboo AI features to you"},{"key":"training_opt_out","value":"No opt-out setting for training is described. The AI Addendum says use of Bamboo AI is optional, so not using the AI features avoids the AI processing.","status":"verified","url":"https://www.bamboohr.com/legal/bamboohr-artificial-intelligence-addendum","locator":"3. Participation and Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer’s use of Bamboo AI and/or its participation in a Bamboo AI Beta Program is optional."},{"key":"eu_residency_option","value":"Partly: an Ireland data centre is offered that BambooHR says meets EU/EEA/Swiss/UK data requirements, assigned depending on the customer's location and needs. No self-serve setting is described.","status":"verified","url":"https://www.bamboohr.com/legal/security","locator":"Secure, International Hosting Sites","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data center located in Ireland meets all of the data requirements of the European Union, European Economic Area, Switzerland, and the United Kingdom"},{"key":"default_data_location","value":"United States, Canada or Ireland, depending on the individual customer's location and needs and applicable laws; no default named.","status":"verified","url":"https://www.bamboohr.com/legal/security","locator":"Secure, International Hosting Sites","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We host customer data in state-of-the-art data centers located in the United States, Canada, or Ireland, depending on the location and needs of the individual customer and applicable laws."},{"key":"dpa","value":"Yes. A Data Processing Agreement is published online and is incorporated into the Terms of Service 'if applicable and accepted by you'; it includes EU Standard Contractual Clauses.","status":"verified","url":"https://www.bamboohr.com/legal/terms-of-service","locator":"6.6 Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Data Processing Agreement (DPA) (if applicable and accepted by you), are incorporated herein by reference"},{"key":"subprocessor_list","value":"A public subcontractor list exists at https://www.bamboohr.com/legal/subcontractors but could not be read without a browser, so entries not counted. The AI Addendum names OpenAI and Cohere as the AI providers.","status":"not_captured","url":"https://www.bamboohr.com/legal/subcontractors","locator":"Subcontractor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Bamboo HR LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Bamboo HR'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After a subscription ends you can download your data for 30 days, then BambooHR deletes it; payroll-service data is kept 7 years for legal and tax reasons. Retention during the subscription is not stated.","status":"verified","url":"https://www.bamboohr.com/legal/terms-of-service","locator":"2.5 Customer Data Downloads and Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you will continue to have the ability to download the information provided, inputted, or uploaded to your databases in the BambooHR® Service by you or on your behalf (“Customer Data”) for thirty (30) days after the effective date of expiration or termination"},{"key":"certifications","value":"Names an annual third-party SOC 1 and SOC 2 audit (SOC 2 Type 2 report in the trust centre, under NDA); no ISO certification named on the security page (2 named).","status":"verified","url":"https://www.bamboohr.com/legal/security","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Annual third-party SOC I & II security audit."},{"key":"admin_ai_controls","value":"Not stated; the AI Addendum says use of the AI features is optional but no organisation-wide admin switch is described.","status":"not_published","url":"https://www.bamboohr.com/legal/bamboohr-artificial-intelligence-addendum","locator":"AI Addendum section 3; Terms of Service; Security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Pro $17 per employee/month headline ($17.50 in the pricing FAQ); companies with 25 or fewer employees pay a flat $425/month for Pro. No EUR price, VAT not shown.","status":"not_published","url":"https://www.bamboohr.com/pricing/","locator":"Plans and pricing, Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"bardeen","name":"Bardeen","vendor":"Bardeen, Inc.","category":"automation","plans":[{"id":"T485","plan":"Premium","tier":"business","price":{"label":"$50 / mo","amount":50,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated clearly. The terms license your content for 'improving (including for training...)' the Services without saying AI models; the privacy policy says data from third-party apps is not used to train generalized AI models.","status":"not_published","url":"https://bardeen.ai/terms-of-service","locator":"User Content, Permissions to Your User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"operating, improving (including for training, optimizing, and developing), and providing the Services"},{"key":"training_opt_out","value":"Not stated; no opt-out from training is described. Deleting content through the product removes it, and third-party API data is excluded from generalized model training.","status":"not_published","url":"https://bardeen.ai/terms-of-service","locator":"User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU residency option stated.","status":"not_published","url":"https://bardeen.ai/privacy-policy","locator":"Transfers; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: the privacy policy says data can be processed and stored anywhere in the world, including the United States. The security page says app data stays in the browser and only automations and connected-app settings are stored on Bardeen servers.","status":"verified","url":"https://bardeen.ai/privacy-policy","locator":"Transfers section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All personal information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States"},{"key":"dpa","value":"Not stated: no data processing agreement found on the privacy policy, terms or security page. The privacy policy names EU Standard Contractual Clauses as one transfer safeguard.","status":"not_published","url":"https://bardeen.ai/privacy-policy","locator":"International transfers section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"one of the safeguards we may use to support such transfer is the EU Standard Contractual Clauses."},{"key":"subprocessor_list","value":"No public list. The security page names Amplitude (usage telemetry), Statsig (A/B testing; spelled 'Stasig') and Sentry (error reports); the privacy policy lists provider categories only.","status":"not_published","url":"https://bardeen.ai/security","locator":"What information do we collect?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We use Amplitude to store usage and telemetry information"},{"key":"dpf_status","value":"No listing found for search term 'Bardeen'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Bardeen' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while you use the service or as needed for legal and business purposes; you can remove all data from the settings page, and data from third-party APIs is not retained.","status":"verified","url":"https://bardeen.ai/privacy-policy","locator":"Retention of personal information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"for as long as you use our Services, or as necessary to fulfill the purpose(s) for which it was collected"},{"key":"certifications","value":"Two named: SOC 2 Type 2 (since 1 April 2024) and CASA Tier 2 and Tier 3; a GDPR checklist is also mentioned.","status":"verified","url":"https://bardeen.ai/security","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As of April 1, 2024, we are proud to announce our compliance with the AICPA SOC 2 Type 2 standards"},{"key":"admin_ai_controls","value":"Not stated; no admin control for AI features is described.","status":"not_published","url":"https://bardeen.ai/security","locator":"Security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Premium $50 per month on monthly billing or $480 per year on annual billing.","status":"not_published","url":"https://bardeen.ai/pricing","locator":"Plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Premium +1000 credits / month"}]}]},{"slug":"basecamp","name":"Basecamp","vendor":"37signals LLC","category":"workspace-and-projects","plans":[{"id":"T453","plan":"Pro","tier":"business","price":{"label":"$99 / mo","amount":99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. 37signals says it does not use your content to train AI models, and the AI providers it works with are contractually barred from training on it.","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, Artificial intelligence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we don’t use your content to train AI models. The AI providers we work with are also contractually prohibited from training their models on your content."},{"key":"training_opt_out","value":"Nothing to do: the privacy policy states 37signals does not use your content to train AI models.","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, Artificial intelligence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we don’t use your content to train AI models. The AI providers we work with are also contractually prohibited from training their models on your content."},{"key":"eu_residency_option","value":"Not stated; no EU or other regional data-storage option found. The policy says EU and UK customer data is transferred to and stored in the United States.","status":"not_published","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, data transfers; Terms; security page; subprocessor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States. The policy says products are primarily housed in the U.S. and that data from the EU or UK is transferred to and stored there. Hosting provider not named.","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our products and other web properties are primarily housed in the United States."},{"key":"dpa","value":"Yes. 37signals has a Data Processing Addendum with Standard Contractual Clauses, published as PDF, HTML and Markdown, and it takes precedence over the main terms.","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, international transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"37signals has adopted a data processing addendum with Standard Contractual Clauses to help ensure this protection."},{"key":"subprocessor_list","value":"Yes, public at https://37signals.com/policies/privacy/basecamp-subprocessors: 12 entries. AI providers listed: Anthropic and OpenAI, described as AI assistant tools used by staff.","status":"verified","url":"https://37signals.com/policies/privacy/basecamp-subprocessors","locator":"Basecamp Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following is a list of personal data subprocessors we use."},{"key":"dpf_status","value":"No listing found for search term '37signals'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search '37signals' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Content is kept while the account is active. Trashed items stay accessible about 25 days and may remain on servers 30 more days; if you cancel, content is inaccessible at once and purged within 60 days, with backups also holding copies for a limited time.","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, What happens when you delete content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 60 days."},{"key":"certifications","value":"No security certification such as SOC 2 or ISO 27001 is named. The security page names a PCI DSS compliance certificate (card payments, SAQ A self-assessment) and a published CSA CAIQ v4.1 self-assessment.","status":"verified","url":"https://37signals.com/policies/security","locator":"Security policy, billing information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our current PCI DSS Certificate of Compliance (PDF), issued by SecurityMetrics on our SAQ A self-assessment, is renewed annually."},{"key":"admin_ai_controls","value":"Not applicable: the policy says the products do not include built-in AI features that process your content, so there is no AI switch. Optional AI-assistant connectors exist (basecamp.com/ai).","status":"verified","url":"https://37signals.com/policies/privacy","locator":"Privacy Policy, Artificial intelligence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our products don’t include built-in AI features that process your content"},{"key":"price_eur","value":"Shown in USD only: Pro $99 per month for the whole account (no per-user fees), with an annual billing option.","status":"not_published","url":"https://basecamp.com/pricing","locator":"Pricing, Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro, $99/mo Just about everything for just about everyone."}]}]},{"slug":"beautiful-ai","name":"Beautiful.ai","vendor":"Beautiful Slides, Inc. (Beautiful.ai)","category":"design-images-and-video","plans":[{"id":"T560","plan":"Team","tier":"business","price":{"label":"$40 / user / mo","amount":40,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for the vendor's own use. The security page says its AI sub-processors are barred from training on customer data and that data processed by its AI models will not train public LLMs.","status":"vendor_statement","url":"https://www.beautiful.ai/security","locator":"Artificial Intelligence (AI) Management; Data Usage for Training Models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data remains private. Our AI sub- processors are barred from using customer data for training."},{"key":"training_opt_out","value":"No training setting described. The security page says AI providers are barred from training on customer data; generative AI integrations can be disabled for a company account on request.","status":"vendor_statement","url":"https://www.beautiful.ai/security","locator":"Data Processing by Generative AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Generative AI integrations can be disabled for your company’s account upon request."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://www.beautiful.ai/privacy-policy","locator":"Privacy policy section 15, security page, pricing page, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the vendor says it processes and stores information on servers in the US; Google Cloud hosting is named.","status":"verified","url":"https://www.beautiful.ai/privacy-policy","locator":"15. Notice to users outside of the United States","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We process and store information on servers located in the United States of America."},{"key":"dpa","value":"Yes, on request: EU customers can request a Data Processing Addendum by emailing privacy@beautiful.ai; it is not click-through.","status":"verified","url":"https://www.beautiful.ai/terms-of-service","locator":"3.4 Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"if Customer is located in the European Union, Customer may request a Data Processing Addendum (“DPA”) from us by contacting Beautiful.ai at privacy@beautiful.ai."},{"key":"subprocessor_list","value":"No public sub-processor list found (the security page says one is available, with no URL). A separate AI page names three AI providers: OpenAI, Anthropic and Google Cloud Services.","status":"not_published","url":"https://www.beautiful.ai/security","locator":"Defending your data: Sub-processors List Available","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Beautiful'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Beautiful' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"AI providers keep data a maximum of 30 days to prevent abuse. On termination, presentation data is deleted no earlier than 14 days after the termination notice; customers must retrieve it themselves.","status":"verified","url":"https://www.beautiful.ai/security","locator":"Data Usage for Training Models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data will be retained for a maximum of 30 days to mitigate against abuse."},{"key":"certifications","value":"SOC 2 Type II; the page also lists GDPR, CCPA and PCI (PCI-DSS via Stripe). SOC 2 Type II is the only independent audit named.","status":"verified","url":"https://www.beautiful.ai/security","locator":"Going beyond compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certifications include: CCPA, PCI, SOC 2 Type II, and GDPR"},{"key":"admin_ai_controls","value":"Limited: the vendor can switch off generative AI integrations for the company account on request; no self-serve admin setting described.","status":"verified","url":"https://www.beautiful.ai/security","locator":"Data Processing by Generative AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Generative AI integrations can be disabled for your company’s account upon request."},{"key":"price_eur","value":"Shown in USD only: $40 per user/month billed annually ($50 billed monthly), for teams of 2 to 20 users.","status":"not_published","url":"https://www.beautiful.ai/pricing","locator":"Pricing page, Team plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teams of 2 to 20 pay $40 per user per month billed annually, or $50 billed monthly."}]}]},{"slug":"billomat","name":"Billomat","vendor":"aifinyo AG","category":"documents-hr-and-finance","plans":[{"id":"T603","plan":"Enterprise","tier":"business","price":{"label":"From €119 / mo","amount":119,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The privacy policy, AGB and pricing page have no clause on training AI models. The homepage mentions an \"AI Assistent\" for account set-up but gives no AI data terms.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung, AGB and Preise page (no AI or model-training clause)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not published. No model-training use is described, so Billomat names no training opt-out.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung and AGB (no training clause or opt-out)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"eu_residency_option","value":"No residency option is published. Billomat is a German provider and names a German host for its website.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Section 6.3; Preise and AGB checked for a region setting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"Not stated for invoice data. The privacy policy names only Hetzner Online GmbH (Gunzenhausen, Germany) as the host of the website and its logs.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung, 6.3 'Hosting durch Hetzner'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpa","value":"Yes, on request. Billomat concludes an AVV (data processing agreement) with users on request; the template is downloadable and can be returned signed by email.","status":"verified","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung, section 19 'Auftragsverarbeitungsvertrag (AVV)'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Auf Wunsch schließen wir mit unseren Nutzern einen AVV ab."},{"key":"subprocessor_list","value":"Not published as a list. The policy names individual service providers (Hetzner, FinaX, Stripe, Mailgun, Cybot) but gives no sub-processor register.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung, sections on hosting, payments and cookies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, aifinyo AG, Berlin)","status":"verified","url":"https://www.billomat.com/impressum/","locator":"Impressum, Anbieterkennzeichnung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"aifinyo AG Friedrichstraße 94, 10117 Berlin"},{"key":"data_retention","value":"Invoice documents are kept at most 6 months from creation during the contract and then deleted. After the contract ends a full export is possible for 6 months for a fee, then data is deleted.","status":"verified","url":"https://www.billomat.com/agb/","locator":"AGB, 7.2 'Unterlagenaufbewahrung, Datensicherung und -löschung'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Billomat hält die elektronischen Unterlagen des Kunden während der Vertragslaufzeit jeweils längstens sechs Monate ab dem Datum ihrer Erstellung für die Datensicherung und Speicherung des Kunden bereit."},{"key":"certifications","value":"Not published. The privacy policy, AGB and imprint name no ISO, SOC 2 or other security certification.","status":"not_published","url":"https://www.billomat.com/datenschutz/","locator":"Datenschutzerklärung, AGB and Impressum checked for certification names","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"admin_ai_controls","value":"Not published. The homepage mentions an \"AI Assistent\" for account set-up, but no administrator setting to switch AI off is described.","status":"not_published","url":"https://www.billomat.com/","locator":"Homepage heading \"Dein individueller AI Assistent\"; Preise, Datenschutz and AGB (no AI control found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From €119 per month, or from €99 per month with annual billing, excluding VAT. Includes 5 users; each extra user costs €10 per month.","status":"verified","url":"https://www.billomat.com/preise/","locator":"Preise page, Enterprise plan block","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise Ideal für wachsende Unternehmen und Mittelstand ab 119€*/mo ab 99€*/mo"}]}]},{"slug":"bland-ai","name":"Bland AI","vendor":"Intelliga Corporation (d/b/a Bland AI)","category":"phone-and-voice","plans":[{"id":"T413","plan":"Build","tier":"business","price":{"label":"$299 / mo","amount":299,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The DPA lets Bland use de-identified data, and data from use of the service, to improve and develop its products, but no page says customer content is or is not used to train models.","status":"not_published","url":"https://bland.ai/legal/dpa","locator":"Section on Deidentified Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bland may create and derive Deidentified Data to improve Bland's products and services and for other business purposes."},{"key":"training_opt_out","value":"Not published: no training opt-out setting or email is described.","status":"not_published","url":"https://bland.ai/legal/dpa","locator":"Looked at DPA, privacy policy, terms, trust-security and pricing pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Enterprise only: the pricing page lists data residency under the Enterprise plan, not Build.","status":"verified","url":"https://bland.ai/pricing","locator":"Enterprise plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Forward deployed engineer available BAA, SSO, data residency"},{"key":"default_data_location","value":"Not stated exactly; the managed cloud is described as multi-region, and the sub-processor list shows AWS storage in the United States, Europe and Asia.","status":"not_published","url":"https://bland.ai/legal/subprocessors","locator":"Sub-processor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS - Cloud infrastructure and storage (United States, Europe, Asia)"},{"key":"dpa","value":"A DPA exists but is written for customers with an Enterprise Services Agreement; it is not stated to apply to the self-serve Build plan.","status":"verified","url":"https://bland.ai/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA amends and forms part of the Agreement."},{"key":"subprocessor_list","value":"Yes: https://bland.ai/legal/subprocessors . 18 entries (AWS, Cloudflare, Datadog, Fivetran, GitHub, Google Workspace, HashiCorp, Linear, Okta, Redis Cloud, Retool, Slack, Stripe, Supabase, Temporal, Twilio, Vanta, Vercel); no AI model providers listed.","status":"verified","url":"https://bland.ai/legal/subprocessors","locator":"Subprocessor List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bland engages the following third parties to process Customer Data."},{"key":"dpf_status","value":"No listing found for search term 'Intelliga', 'Bland AI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Intelliga', 'Bland AI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for call data. On the DPA, at the customer's request Bland deletes or returns personal data when the service ends; the request must be made within 14 days by emailing security@bland.ai. Zero-retention processing is mentioned as available for sensitive workflows.","status":"verified","url":"https://bland.ai/legal/dpa","locator":"Return and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer may make its request within 14 days of the cessation date of the Services by emailing the request to security@bland.ai."},{"key":"certifications","value":"SOC 2 Type II; HIPAA (self-attested with BAA); GDPR; PCI DSS v4.0 (4 named, only SOC 2 Type II independently audited).","status":"verified","url":"https://bland.ai/trust-security","locator":"Compliance, with evidence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type IIHIPAAGDPRPCI DSS v4.0"},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide switch for AI features found; the product is a voice-agent builder rather than an assistant with optional AI.","status":"not_published","url":"https://bland.ai/pricing","locator":"Looked at pricing, trust-security and legal pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: $299 per month platform fee plus $0.12 per minute of talk time (Build plan).","status":"not_published","url":"https://bland.ai/pricing","locator":"Build plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$0.12/min $299/month platform fee"}]}]},{"slug":"bluedot","name":"Bluedot","vendor":"Bluedot","category":"meetings-and-notes","plans":[{"id":"T390","plan":"Business","tier":"business","price":{"label":"$32 / user / mo","amount":32,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. The terms say Bluedot does not use customer content to train or improve AI models, and its vendors may not either.","status":"verified","url":"https://www.bluedothq.com/terms","locator":"4. Customer Content, Ownership, and AI Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bluedot does not use Customer Content to train or improve artificial intelligence models. Our vendors and service providers are not permitted to use Customer Content for their own model training or product improvement."},{"key":"training_opt_out","value":"Nothing to do: the terms state Bluedot does not train on customer content.","status":"verified","url":"https://www.bluedothq.com/terms","locator":"4. Customer Content, Ownership, and AI Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bluedot does not use Customer Content to train or improve artificial intelligence models."},{"key":"eu_residency_option","value":"Yes, EU is the default for customer content; no setting needed. EU data residency is also listed in the security FAQ.","status":"verified","url":"https://www.bluedothq.com/privacy","locator":"9.1 Customer Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Content is stored and processed in the European Union by default."},{"key":"default_data_location","value":"European Union by default (hosted on AWS); US storage available on request under an agreed arrangement.","status":"verified","url":"https://www.bluedothq.com/privacy","locator":"9.1 Customer Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Content is stored and processed in the European Union by default. Customers may request storage and processing in the United States, subject to an agreed arrangement with Bluedot."},{"key":"dpa","value":"A Data Processing Agreement is offered (security page FAQ); how it is concluded (signed, click-through) is not described.","status":"verified","url":"https://www.bluedothq.com/security","locator":"FAQs: Is Bluedot GDPR compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We offer a Data Processing Agreement, support EU data residency, and apply privacy-first controls across our product and infrastructure."},{"key":"subprocessor_list","value":"Not found: no public list in the privacy policy, terms or security page (only categories such as hosting and AI processing providers). A trust centre exists but needs a browser.","status":"not_captured","url":"https://www.bluedothq.com/privacy","locator":"5.1 Service Providers (Processors); trust centre https://trust.bluedothq.com/ returned empty","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Bluedot'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Bluedot' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as it stays in your account. After you delete content or cancel, it is removed from active systems and may sit in backups for up to 30 days, then is permanently deleted. Export what you need first.","status":"verified","url":"https://www.bluedothq.com/terms","locator":"6. Data Retention and Backups","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"It may remain in internal backups for up to 30 days for operational and disaster recovery purposes After this period, Customer Content is permanently deleted."},{"key":"certifications","value":"SOC 2 Type II (1 certification named). GDPR-aligned controls are claimed but are not a certification.","status":"verified","url":"https://www.bluedothq.com/security","locator":"SOC 2 Type II","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bluedot maintains independently audited controls for security, availability, and confidentiality under the SOC 2 Type II framework."},{"key":"admin_ai_controls","value":"Not stated: the Business plan lists 'Advanced admin controls' but no org-wide switch to turn AI features off.","status":"not_published","url":"https://www.bluedothq.com/pricing","locator":"Business plan card; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $32 per user/month billed annually ($39 billed monthly)","status":"not_published","url":"https://www.bluedothq.com/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"bolt-new","name":"Bolt.new","vendor":"StackBlitz, Inc. (Bolt)","category":"code-and-app-builders","plans":[{"id":"T535","plan":"Teams","tier":"business","price":{"label":"$30 / user / mo","amount":30,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No by default for Teams. Training and dataset licensing do not apply to organisation-managed accounts unless the organisation's administrator has enabled them. Individual accounts outside the EEA/UK/Switzerland are opted in unless they opt out.","status":"verified","url":"https://stackblitz.com/privacy-policy","locator":"Privacy Policy, 5.C Excluded Accounts","url2":"https://stackblitz.com/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"or to organization-managed accounts except to the extent the organization’s administrator has enabled such uses"},{"key":"training_opt_out","value":"Nothing to do on Teams by default (excluded from training) as long as the administrator has not enabled it. Individual accounts opt out in account settings or by emailing privacy@stackblitz.com, free on every plan.","status":"verified","url":"https://stackblitz.com/terms-of-service","locator":"Terms of Service, 3.5(c) Opt-Out; Withdrawal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you may opt out of the uses described in Sections 3.5(a) and 3.5(b) at any time, free of charge and regardless of your plan, through your account settings or by contacting privacy@stackblitz.com."},{"key":"eu_residency_option","value":"Not stated for Teams. The security page says a BYOK deployment can run Bolt inside the customer's own AWS or Azure tenant (plan not named); no EU region setting is described.","status":"not_published","url":"https://bolt.new/platform/security","locator":"Security FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"BYOK deployment lets you run Bolt inside your own AWS or Azure tenant with full infrastructure isolation and no shared compute"},{"key":"default_data_location","value":"Not stated. The Privacy Policy says StackBlitz is headquartered in the United States and personal information can be processed and stored in countries outside yours, including the US; no region or hosting provider is named.","status":"not_published","url":"https://stackblitz.com/privacy-policy","locator":"Privacy Policy, international transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"StackBlitz, Inc. is headquartered in the United States, and personal information may be transferred to, processed, and stored in countries outside of your jurisdiction, including the United States."},{"key":"dpa","value":"Not published for Teams. The Terms say a separate written agreement or data processing addendum controls where one exists, and the Privacy Policy says enterprise DPAs apply; no public DPA or sign-up route for Teams was found.","status":"not_published","url":"https://stackblitz.com/terms-of-service","locator":"Looked in: Terms of Service intro (Separate Written Agreements), Privacy Policy, bolt.new/platform/security, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A current list exists, linked from the Privacy Policy to trust.bolt.new, but that page only loads in a browser, so no entries could be counted.","status":"not_captured","url":"https://trust.bolt.new/","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'StackBlitz'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'StackBlitz' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active. After termination or suspension (not for cause) content can be exported for 30 days, after which it can be deleted. After voluntary closure it is deleted or anonymised within a 'reasonable period' (no number).","status":"verified","url":"https://stackblitz.com/privacy-policy","locator":"Privacy Policy, 11. Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we will make available a reasonable means to retrieve or export your content for thirty (30) days following the effective date of the termination or suspension"},{"key":"certifications","value":"SOC 2 Type 2 (1 certification); the vendor also states GDPR and CCPA compliance.","status":"vendor_statement","url":"https://bolt.new/platform/security","locator":"Security FAQ, What certifications does Bolt hold?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bolt is SOC 2 Type 2 certified and compliant with GDPR and CCPA."},{"key":"admin_ai_controls","value":"Not stated. Team admins control roles, integrations, publishing and data export, but no setting to switch off or limit Bolt's AI for the team is described.","status":"not_published","url":"https://support.bolt.new/settings/team-settings","locator":"Looked in: Team settings and Manage your team help pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Teams $30 per month per member, billed monthly (yearly billing is offered with a discount of up to 28%).","status":"not_published","url":"https://bolt.new/pricing","locator":"Pricing, Teams card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"botfriends","name":"BOTfriends X","vendor":"BOTfriends GmbH, Würzburg","category":"phone-and-voice","plans":[{"id":"T434","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, in effect: the vendor says data you put in the platform is not used to improve the BOTfriends X platform. It does not name model training or say anything about the LLM providers behind it.","status":"verified","url":"https://botfriends.de/dsgvo/","locator":"FAQ: Wer ist Eigentümer der Daten?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zudem werden Daten, die Sie in die Plattform hinterlegen nicht genutzt, um die BOTfriends X Plattform zu verbessern, sondern gehören nur Ihnen."},{"key":"training_opt_out","value":"No setting described. The vendor says data you put in the platform is not used to improve the BOTfriends X platform; model training is not named.","status":"verified","url":"https://botfriends.de/dsgvo/","locator":"FAQ: Wer ist Eigentümer der Daten?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zudem werden Daten, die Sie in die Plattform hinterlegen nicht genutzt, um die BOTfriends X Plattform zu verbessern, sondern gehören nur Ihnen."},{"key":"eu_residency_option","value":"EU hosting is the default for all customers; no separate setting needed. A country is not named.","status":"verified","url":"https://botfriends.de/dsgvo/","locator":"FAQ on storage location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alle von uns gewählten Komponenten und Integrationen werden datenschutzkonform in der EU gehostet."},{"key":"default_data_location","value":"EU: servers within the European Union (country not named); platform developed in Germany.","status":"verified","url":"https://botfriends.de/preise-features/","locator":"FAQ: DSGVO- und EU AI Act-konform","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die AI Agent Plattform wird in Deutschland entwickelt und auf Servern innerhalb der Europäischen Union gehostet"},{"key":"dpa","value":"Yes. BOTfriends supplies an Auftragsverarbeitungsvertrag (Data Processing Agreement) to customers; the text itself is not public.","status":"verified","url":"https://botfriends.de/dsgvo/","locator":"FAQ: Bietet BOTfriends Verträge...","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Damit Sie die Technologie datenschutzkonform bei Ihnen im Unternehmen implementieren können, liefern wir Ihnen selbstverständlich einen Auftragsverarbeitungsvertrag (Data Processing Agreement)"},{"key":"subprocessor_list","value":"Not published. No sub-processor list found.","status":"not_published","url":"https://botfriends.de/dsgvo/","locator":"Looked in /dsgvo/ page, pricing page, privacy policy, imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, BOTfriends GmbH, Würzburg)","status":"verified","url":"https://botfriends.de/impressum/","locator":"Imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"BOTfriends GmbH Eichhornstraße 28 97070 Würzburg"},{"key":"data_retention","value":"Admins set automatic deletion per data type (training, human handover, analytics, messages) with their own time interval. After the contract ends data is handed back and then deleted; no period is given.","status":"verified","url":"https://botfriends.de/dsgvo/","locator":"Automatische Datenlöschung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In der BOTfriends X Plattform können Sie eine Vielzahl von Datentypen (Training, Human Handover, Analytics, Nachrichten an den Bot uvm.) nach einem von Ihnen definierten Zeitintervall automatisiert löschen lassen."},{"key":"certifications","value":"Not stated. No ISO 27001, SOC 2 or BSI C5 found on the pricing or data-protection pages.","status":"not_published","url":"https://botfriends.de/dsgvo/","locator":"Looked in /dsgvo/ page, pricing page, privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. Admins choose Managed or Custom generative AI, and set roles per organisation, but no organisation-wide AI off switch is described.","status":"not_published","url":"https://botfriends.de/dsgvo/","locator":"Looked in /dsgvo/ page, pricing FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From 3,000 EUR per month (BOTfriends X, sold via a consultation; a Pilot starts from 500 EUR per month). VAT not stated.","status":"verified","url":"https://botfriends.de/preise-features/","locator":"Plan cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"BOTfriends X Vom ersten Go-Live zum neuen Service-Standard ab 3.000 € / Monat"}]}]},{"slug":"botpress","name":"Botpress","vendor":"Botpress, Inc. (Delaware; Technologies Botpress Inc. for Canadian customers)","category":"phone-and-voice","plans":[{"id":"T431","plan":"Team","tier":"business","price":{"label":"$750 / mo","amount":750,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Botpress says it never uses conversation data for training or model improvement.","status":"verified","url":"https://botpress.com/legal/privacy-statement","locator":"Section 1, End-Users","url2":"https://botpress.com/legal/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use Conversation Data or other End-User personal data for any other purpose, which includes analytics and algorithms and model improvements or training."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not use conversation data for training.","status":"verified","url":"https://botpress.com/legal/privacy-statement","locator":"Section 1, End-Users","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use Conversation Data or other End-User personal data for any other purpose, which includes analytics and algorithms and model improvements or training."},{"key":"eu_residency_option","value":"Not stated. No EU hosting or region setting found; terms say infrastructure can be located anywhere in the world.","status":"not_published","url":"https://botpress.com/legal/terms-of-service","locator":"Looked in terms 2.9, DPA, privacy statement, pricing page, docs index","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States. The DPA says all data is processed in the US unless stated otherwise; the terms let Botpress host anywhere at its discretion.","status":"verified","url":"https://botpress.com/legal/data-processing-agreement","locator":"Schedule 3 – Sub-Processors","url2":"https://botpress.com/legal/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless otherwise stated, all data is processed in the United States."},{"key":"dpa","value":"Yes. A published DPA with EU Standard Contractual Clauses; the page has an 'Execute Data Processing Agreement' button.","status":"verified","url":"https://botpress.com/legal/data-processing-agreement","locator":"Section 2.a Role of the parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In Processing Conversation Data through the Services, the parties acknowledge and agree that the Customer acts as the Controller and that Botpress acts as a Processor."},{"key":"subprocessor_list","value":"Public list on the Trust Center (https://trust.botpress.com/). Server fetch blocked (403), so count and AI providers were not captured.","status":"not_captured","url":"https://trust.botpress.com/","locator":"Public list link in the vendor's DPA or trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Botpress; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Botpress'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Conversations, messages and events are kept 90 days and logs 30 days; conversations and messages can be deleted via API. Files are kept indefinitely unless given an expiry. Data is deleted or returned on termination.","status":"verified","url":"https://botpress.com/docs/docs/studio/guides/advanced/retention-period","locator":"Retention Period table","url2":"https://botpress.com/legal/data-processing-agreement","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Conversations 90 days Can be manually deleted using the Chat API"},{"key":"certifications","value":"1 named: SOC 2 (homepage says SOC II certified, also GDPR compliant and penetration tested by KPMG). Trust Center not readable by server.","status":"vendor_statement","url":"https://botpress.com/","locator":"Homepage security section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC II certified, GDPR compliant, and penetration tested by KPMG."},{"key":"admin_ai_controls","value":"Not stated. Team plan lists roles and permissions (RBAC) but no organisation-wide switch to turn AI features off.","status":"not_published","url":"https://botpress.com/pricing","locator":"Looked in pricing page, terms, docs index","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $750 per month, billed annually (Team plan, 1,500 conversations/month included, unlimited seats)","status":"not_published","url":"https://botpress.com/pricing","locator":"Team card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"brave-leo","name":"Brave Leo","vendor":"Brave Software, Inc.","category":"assistants","plans":[{"id":"T310","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Brave says it does not use Leo conversations for model training (free Leo; Brave has no business plan).","status":"verified","url":"https://brave.com/privacy/browser/","locator":"Brave Leo > Brave Leo privacy protections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your conversations for model training."},{"key":"training_opt_out","value":"Nothing to do: Brave states it does not use Leo conversations for model training.","status":"verified","url":"https://brave.com/leo/","locator":"Leo page FAQ: Will you use my conversations for model training?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your conversations are not persisted for model training."},{"key":"eu_residency_option","value":"Not stated; no EU data-location setting for Leo is described.","status":"not_published","url":"https://brave.com/privacy/browser/","locator":"Looked at brave.com/privacy/browser and brave.com/leo","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated where Leo's servers are located; prompts are processed and discarded, history stays on the user's device.","status":"not_published","url":"https://brave.com/privacy/browser/","locator":"Looked at Brave Leo sections of brave.com/privacy/browser and brave.com/leo","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not published. Leo is a consumer browser feature with no business plan; no data processing agreement was found.","status":"not_published","url":"https://brave.com/privacy/browser/","locator":"Looked at brave.com/privacy/browser (Brave Leo sections) and brave.com/leo FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found. The Leo page names the AI models offered: Mixtral, Anthropic's Claude and Meta's Llama.","status":"not_published","url":"https://brave.com/leo/","locator":"Leo page FAQ on models; privacy notice Leo sections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Brave Software'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Brave Software' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Prompts and responses are not stored on Brave's servers (large prompts can be cached for a few minutes). Chat history stays on the device; it can be turned off or deleted at brave://settings/leo-ai.","status":"verified","url":"https://brave.com/privacy/browser/","locator":"Brave Leo > Brave Leo privacy protections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don’t store or retain prompts, responses, context, or personal data on our servers."},{"key":"certifications","value":"Not published; no security certification named for Leo on the pages read.","status":"not_published","url":"https://brave.com/leo/","locator":"Looked at brave.com/leo and brave.com/privacy/browser","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered; Leo is a personal browser feature with no admin console. Each user can disable chat history in settings.","status":"not_published","url":"https://brave.com/privacy/browser/","locator":"Looked at Leo sections of brave.com/privacy/browser","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Free, no account needed. Leo Premium is a separate paid subscription for individuals; its price is not shown on the Leo page.","status":"verified","url":"https://brave.com/leo/","locator":"Leo page, FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No account or signup is required to access the free Brave Leo experience."}]}]},{"slug":"brevo","name":"Brevo","vendor":"Brevo (Sendinblue SAS)","category":"sales-marketing-and-support","plans":[{"id":"T81","plan":"Standard","tier":"business","price":{"label":"€13.50 / mo","amount":13.5,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Partly: Brevo may use content and usage data to train its AI features only to improve the service for the customer, in particular fraud, phishing and spam prevention; its AI providers process data only to deliver the features","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"Section 6.7 'Control Center' (Terms version 1 Oct 2025)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Partly: AI features can be managed in the Software's Control Center and do not process data unless used; AI-driven dashboards and fraud and spam detection cannot be turned off, and no opt-out from the fraud-prevention training is described","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"Section 6.7 'Control Center'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"DPA Annex 2","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU: hosting at OVH (France) and Google Cloud (Belgium)","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"DPA Annex 2, 'Brevo Infrastructure Sub-Processors'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Brevo's DPA is Appendix 3 of its Terms of Service and applies automatically","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"Appendix 3 'Data Processing Agreement (DPA)'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public in DPA Annex 2: 5 infrastructure sub-processors (OVH, Google Cloud, Cloudflare, Zendesk, Omni), 12 optional service providers including AI providers OpenAI, Google Gemini, Anthropic and Langfuse, and 5 Brevo group companies","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"DPA Annex 2 'List of Sub-Processors'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Sendinblue SAS, Paris)","status":"verified","url":"https://www.brevo.com/legal/privacypolicy/","locator":"Controller paragraph ('Sendinblue, a French société par actions simplifiée')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"No period for customer data is stated in the terms or privacy policy read; Brevo's own data has stated periods (e.g. 5 years after the contract for contract-related requests)","status":"not_published","url":"https://www.brevo.com/legal/privacypolicy/","locator":"Section 'Retention period' (last update 1 Oct 2025)","url2":"https://www.brevo.com/legal/termsofuse/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO 27001:2022","status":"verified","url":"https://www.brevo.com/features/data-security/","locator":"Section on certification ('ISO 27001:2022-certified')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes, partly: the Control Center manages AI features for the account; fraud and spam detection and AI dashboards stay on","status":"verified","url":"https://www.brevo.com/legal/termsofuse/","locator":"Section 6.7 'Control Center'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 13.50 per month billed yearly, or EUR 15 monthly (entry tier, 5,000 emails a month); VAT basis not stated","status":"verified","url":"https://www.brevo.com/pricing/","locator":"Plan card 'Standard' with Monthly / Yearly (-10%) toggle, EUR","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"bubble","name":"Bubble","vendor":"Bubble Group, Inc.","category":"code-and-app-builders","plans":[{"id":"T537","plan":"Team","tier":"business","price":{"label":"$349 / mo","amount":349,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not captured: Bubble's privacy policy, terms and AI pages could not be read. The manual pages on the Bubble AI Agent and AI credits do not mention training.","status":"not_captured","url":"https://bubble.io/privacy","locator":"Privacy Policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not captured: Bubble's privacy and AI terms could not be read, so no training setting or opt-out route is confirmed.","status":"not_captured","url":"https://bubble.io/privacy","locator":"Privacy Policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No, not on the Team plan. Only the Enterprise plan lets the customer choose the AWS region for hosting.","status":"verified","url":"https://manual.bubble.io/help-guides/optimizing-an-application/hosting-and-scaling/how-bubble-hosting-works.md","locator":"How Bubble hosting works, location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"on the other hand, lets you choose the AWS region where you want your app to be hosted"},{"key":"default_data_location","value":"United States. Bubble's shared server environment (used on non-Enterprise plans) is hosted in the US on AWS, and the location cannot be changed.","status":"verified","url":"https://manual.bubble.io/help-guides/optimizing-an-application/hosting-and-scaling/how-bubble-hosting-works.md","locator":"How Bubble hosting works, location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bubble's shared server environment is hosted in the US, and we don't currently offer the possibility of changing that location."},{"key":"dpa","value":"Yes, Bubble says it has Data Processing Agreements with customers that include EU standard contractual clauses. How a Team customer signs or obtains it is not described in readable pages.","status":"verified","url":"https://manual.bubble.io/help-guides/optimizing-an-application/compliance/gdpr.md","locator":"GDPR, Standard contractual clauses","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bubble has implemented the SCCs into its DPAs with its customers and its processors"},{"key":"subprocessor_list","value":"Not captured: bubble.io/subprocessors loads only in a browser.","status":"not_captured","url":"https://bubble.io/subprocessors","locator":"Sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Bubble Group, inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Bubble Group'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not captured: Bubble's privacy policy and terms could not be read, so no retention or post-cancellation deletion period is confirmed.","status":"not_captured","url":"https://bubble.io/privacy","locator":"Privacy Policy, retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II for security (1 certification), plus GDPR measures. The manual says Bubble was audited by Sensiba LLP; no ISO certification is named in the readable pages.","status":"verified","url":"https://manual.bubble.io/help-guides/optimizing-an-application/compliance/soc-2-type-ii.md","locator":"SOC 2 Type II, Is Bubble SOC 2 compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bubble is compliant with the SOC 2 Type II standard for security."},{"key":"admin_ai_controls","value":"Partly. The Bubble AI Agent follows each person's editor permissions, and reading app data is limited to owners and admins for the data types enabled in the Agent settings. No setting to switch the AI off for the whole team was found.","status":"verified","url":"https://manual.bubble.io/help-guides/ai/bubble-ai-agent.md","locator":"Bubble AI Agent, Permissions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is further limited to owners and admins, and only for the data types enabled in"},{"key":"price_eur","value":"Shown in USD only: Team plan, web only, $349 per month billed annually or $399 billed monthly (web + mobile $549 / $649).","status":"not_published","url":"https://manual.bubble.io/account-and-marketplace/account-and-billing/pricing-plans.md","locator":"Pricing tables, Team row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Team $349 $449 $549"}]}]},{"slug":"buffer","name":"Buffer","vendor":"Buffer, Inc.","category":"sales-marketing-and-support","plans":[{"id":"T520","plan":"Team","tier":"business","price":{"label":"$10 / mo","amount":10,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; the AI Assistant FAQ says text you enter is shared with OpenAI, but neither the terms nor the privacy policy say whether Buffer or OpenAI train on it.","status":"not_published","url":"https://buffer.com/ai-assistant","locator":"FAQ: Does Buffer scrape my content to train the AI?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause and no opt-out setting found. The AI Assistant is optional and only used if you open it.","status":"not_published","url":"https://buffer.com/ai-assistant","locator":"FAQ section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data location option found.","status":"not_published","url":"https://buffer.com/legal","locator":"Privacy Policy section 7 Data Transfers; Terms; Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Buffer is US-based and its listed hosting and database providers (AWS, MongoDB Atlas) are in the USA.","status":"verified","url":"https://buffer.com/legal","locator":"Sub-processors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services (AWS), Inc Cloud (hosting) service USA"},{"key":"dpa","value":"Yes: buffer.com/legal says users and external parties can receive a data protection agreement, linked as \"Buffer Data Processing Addendum\" on DocHub; the terms inside it could not be read.","status":"verified","url":"https://buffer.com/legal","locator":"GDPR: Data Protection Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have created a legal agreement that users and external parties can receive from us"},{"key":"subprocessor_list","value":"Yes, public at buffer.com/legal (Our list of sub-processors): 26 entries; AI providers listed are OpenAI and Anthropic.","status":"verified","url":"https://buffer.com/legal","locator":"Our list of sub-processors includes","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI Artificial Intelligence USA Plain"},{"key":"dpf_status","value":"Active (Buffer; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Buffer'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Content you upload is stored indefinitely until you delete it or your account; invoice data is kept up to 7 years after last payment.","status":"verified","url":"https://buffer.com/legal","locator":"Data Retention Notice: How long we retain information for active customers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We store User Content indefinitely."},{"key":"certifications","value":"Not stated; no SOC 2 or ISO certification named on the legal or security page.","status":"not_published","url":"https://buffer.com/security","locator":"Security (redirects to /legal#security)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch to turn off AI Assistant documented. The AI Assistant page says it is optional for each user.","status":"not_published","url":"https://buffer.com/ai-assistant","locator":"FAQ: Is AI Assistant optional","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $10 per month for 1 channel, $120 billed yearly (Essentials plan is $5 per channel).","status":"not_published","url":"https://buffer.com/pricing","locator":"Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"cal-com","name":"Cal.com","vendor":"Cal.com, Inc., San Francisco, California","category":"research-forms-and-storage","plans":[{"id":"T632","plan":"Teams","tier":"business","price":{"label":"$12 / user / mo","amount":12,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No, with narrow wording: Cal.com does not use Customer Data to train or fine-tune generally available AI models and requires the same of its AI subprocessors.","status":"verified","url":"https://cal.com/terms","locator":"Terms of Service 4.5 Beta and AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cal.com does not use Customer Data to train or fine-tune generally available AI models, and requires the same of its AI Subprocessors."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not use customer data to train generally available AI models. AI features are opt-in.","status":"verified","url":"https://cal.com/terms","locator":"Terms of Service 4.5 Beta and AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cal.com does not use Customer Data to train or fine-tune generally available AI models, and requires the same of its AI Subprocessors."},{"key":"eu_residency_option","value":"No on Teams: the pricing comparison lists 'US & EU hosting' (choose where your data is hosted) only for the Organizations and Enterprise plans.","status":"vendor_statement","url":"https://cal.com/pricing","locator":"Comparison table, Data management & security, row 'US & EU hosting' (check icons under Organizations and Enterprise, cross icons under Individual and Teams, read from the page HTML)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Choose where your data is hosted to meet regional data residency requirements."},{"key":"default_data_location","value":"United States. Cal.com says data is processed in the United States; some subprocessors process elsewhere (primary database and storage are at AWS, United States).","status":"verified","url":"https://cal.com/privacy","locator":"Privacy policy, International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We’re a US company and data is processed in the United States; some subprocessors process it elsewhere"},{"key":"dpa","value":"Yes. The DPA at cal.com/dpa is part of the Terms of Service for every account, free or paid; a signed DPA can also be obtained via the Trust Center.","status":"verified","url":"https://cal.com/privacy","locator":"Privacy policy, The short version","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"under the Data Processing Agreement at cal.com/dpa, which is part of our Terms of Service for every account, free or paid."},{"key":"subprocessor_list","value":"Yes, public: https://trust.cal.com/subprocessors. 22 entries. AI providers: OpenAI, Anthropic and Retell AI (opt-in AI features).","status":"verified","url":"https://trust.cal.com/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cal.com engages the third parties below to process customer personal data. Each is bound by a data processing agreement."},{"key":"dpf_status","value":"Active (Cal.com, Inc; EU-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Cal.com'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After the account ends you get at least 30 days to export; Cal.com then deletes the data, normally within 90 days; backups follow a separate schedule. Bookings can be exported or deleted any time.","status":"verified","url":"https://cal.com/dpa","locator":"DPA 10.2-10.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following the applicable export period, Cal.com will delete Customer Personal Data in accordance with its standard deletion schedule, normally within 90 days"},{"key":"certifications","value":"2 on the Trust Center: ISO 27001 certificate and SOC 2 Type 2 report; the security page also names CCPA, GDPR and HIPAA.","status":"verified","url":"https://cal.com/security","locator":"Security page, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 27001, SOC 2 Type II, CCPA, GDPR, and HIPAA certifications"},{"key":"admin_ai_controls","value":"Not stated. AI features are described as opt-in, but no admin setting to limit them organisation-wide was found.","status":"not_published","url":"https://cal.com/privacy","locator":"Privacy policy short version; terms 3.3; pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AI features are opt-in and narrow."},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: $12 per user/month on yearly billing (Teams plan); 14-day free trial.","status":"not_published","url":"https://cal.com/pricing","locator":"Pricing page, Teams card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"### $12 per user/month Save 25%"}]}]},{"slug":"calendly","name":"Calendly","vendor":"Calendly LLC","category":"workspace-and-projects","plans":[{"id":"T101","plan":"Teams","tier":"business","price":{"label":"$16 / user / mo","amount":16,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No for its AI assistant: Calendly says Callie never sells or trains on customer data; the privacy notice mentions no AI training","status":"verified","url":"https://calendly.com/help/callie-data-privacy","locator":"Article summary ('never sells or trains on it')","url2":"https://calendly.com/legal/privacy-notice","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: no training on customer data is described","status":"verified","url":"https://calendly.com/help/callie-data-privacy","locator":"Article summary","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://calendly.com/security","locator":"Security page","url2":"https://calendly.com/help/calendly-sub-processors-gdpr-ccpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: data centres of all listed sub-processors are in the US; Callie data sits in Google Cloud and AWS in the US","status":"verified","url":"https://calendly.com/help/calendly-sub-processors-gdpr-ccpa","locator":"Column 'Locations of Data Center(s)'","url2":"https://calendly.com/help/callie-data-privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Calendly's DPA (effective 1 Jun 2026) is incorporated into the Customer Terms","status":"verified","url":"https://calendly.com/legal/data-processing-addendum","locator":"Preamble ('incorporated into the Customer Terms')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 20 entries, all with US data centres (some also in the Netherlands, Israel or UK); AI features and notetaker summaries use OpenAI, recordings use Recall.ai","status":"verified","url":"https://calendly.com/help/calendly-sub-processors-gdpr-ccpa","locator":"Table 'Calendly Sub-processors' (updated 20 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Calendly LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Calendly'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: personal data is kept as long as reasonably needed for its purposes, contracts and limitation periods; Callie chat history is retained","status":"not_published","url":"https://calendly.com/legal/privacy-notice","locator":"Retention paragraph (notice effective 3 Jul 2026)","url2":"https://calendly.com/help/callie-data-privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO/IEC 27001 and PCI compliance","status":"verified","url":"https://calendly.com/security","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not described: Calendly documents admin controls for users, teams and SSO, but no switch for its AI features was found","status":"not_published","url":"https://calendly.com/help/callie-data-privacy","locator":"Help navigation 'Admins' and Callie articles","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 16 per seat/month (billing toggle default not captured)","status":"not_published","url":"https://calendly.com/pricing","locator":"Plan card 'Teams'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"campaign-monitor","name":"Campaign Monitor","vendor":"Campaign Monitor Pty Ltd","category":"sales-marketing-and-support","plans":[{"id":"T515","plan":"Essentials","tier":"business","price":{"label":"€9 / mo","amount":9,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The terms say Generative AI input and output are Customer Content; nothing says whether they are used to train models.","status":"not_published","url":"https://www.campaignmonitor.com/policies/","locator":"Acceptable Use Policy, Section 8 Generative AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training opt-out described.","status":"not_published","url":"https://www.campaignmonitor.com/policies/","locator":"Section 8 Generative AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU-only hosting option found. The notice says locations depend on the customer's implementation and Ordering Document.","status":"not_published","url":"https://www.campaignmonitor.com/policies/","locator":"Services Privacy Notice (summary and International Data Transfers)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"The Services Privacy Notice says the services can be provided, supported and hosted in the United States; processing can also occur in the UK, EU and Australia, depending on the customer's setup. No fixed region promised.","status":"verified","url":"https://www.campaignmonitor.com/policies/","locator":"Services Privacy Notice, International Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Services may be provided, supported, and hosted in the United States."},{"key":"dpa","value":"Yes, on request: email privacy contact with your legal entity name and the Marigold entity you contract with to execute a DPA.","status":"verified","url":"https://www.campaignmonitor.com/policies/","locator":"Services Privacy Notice, overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To execute a Data Protection Agreement (often referred to as a “Data Processing Agreement” or “DPA”), please submit a request to"},{"key":"subprocessor_list","value":"Not published: no sub-processor list found; the Services notice only says sub-processors may process data in additional jurisdictions.","status":"not_published","url":"https://www.campaignmonitor.com/policies/","locator":"Services Privacy Notice; trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not listed under its own name (Campaign Monitor Pty Ltd); its parent Marigold Group Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Marigold'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Campaign Monitor can delete Customer Content within 30 days after the agreement ends; during the term it is kept until the customer requests deletion. AI input retention not stated.","status":"verified","url":"https://www.campaignmonitor.com/policies/","locator":"Terms of Use, Effect of Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Company may delete Customer Content and/or any archived data within 30 days after the date of expiration or any termination of this Agreement."},{"key":"certifications","value":"1 certification listed on the trust centre: SOC 2 Type 1. GDPR is also listed as a compliance badge.","status":"verified","url":"https://www.campaignmonitor.com/trust/","locator":"Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certifications GDPR SOC 2 Type 1"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to switch AI features off found.","status":"not_published","url":"https://www.campaignmonitor.com/policies/","locator":"Section 8 Generative AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the amount for Essentials is not in the page text (loaded by JavaScript). Lite shows €9 per month.","status":"not_captured","url":"https://www.campaignmonitor.com/pricing/","locator":"Essentials plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"candis","name":"Candis","vendor":"Candis GmbH","category":"documents-hr-and-finance","plans":[{"id":"T597","plan":"Basis","tier":"business","price":{"label":"From €389 / mo","amount":389,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No training across customers. Candis says its AI works only on your own invoice data with no cross-company training; the data processing contract bars use of your data for general AI/LLM training.","status":"verified","url":"https://candis.io/candis-ki","locator":"Candis KI FAQ","url2":"https://candis.io/avv","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Es findet kein unternehmensübergreifendes Training statt"},{"key":"training_opt_out","value":"Nothing to do: Candis states there is no cross-company AI training and the AVV bars general training on your data. Anonymised reuse for product improvement needs the user's prior consent (AGB 6.1).","status":"verified","url":"https://candis.io/candis-ki","locator":"Candis KI FAQ","url2":"https://candis.io/avv","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Es findet kein unternehmensübergreifendes Training statt"},{"key":"eu_residency_option","value":"EU only by contract: the AVV says the service is provided exclusively within an EU or EEA state and moving it to a third country needs the customer's prior consent.","status":"verified","url":"https://candis.io/avv","locator":"7.4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die vertraglich vereinbarte Dienstleistung wird ausschließlich in einem Mitgliedsstaat der Europäischen Union"},{"key":"default_data_location","value":"Germany: AWS hosting in the Frankfurt data zone.","status":"verified","url":"https://candis.io/avv","locator":"7.3 Subunternehmer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Hosting in der Datenzone Frankfurt in"},{"key":"dpa","value":"Yes. Candis publishes its data processing contract (AVV) as a PDF; it applies to all activities under the usage agreement and AGB.","status":"verified","url":"https://candis.io/avv","locator":"Präambel","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sie findet Anwendung auf alle Tätigkeiten, die mit dem Vertragsverhältnis in Zusammenhang stehen"},{"key":"subprocessor_list","value":"Yes, inside the published AVV PDF (section 7.3): 4 entries, 4 companies: Amazon Web Services EMEA Sàrl (hosting), Gini GmbH (reading data from PDFs and scans), Mailjet SAS (notification emails), Google Cloud EMEA (automatic document-type detection). AI-related: Gini, Google Cloud.","status":"verified","url":"https://candis.io/avv","locator":"7.3 Subunternehmer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"werden unter Einschaltung folgender Subunternehmer durchgeführt"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Candis GmbH, Berlin, Germany)","status":"verified","url":"https://candis.io/impressum","locator":"Impressum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Candis GmbH CityQuartier DomAquarée Karl-Liebknecht-Straße 5 10178 Berlin"},{"key":"data_retention","value":"After you give notice of cancellation you can download your content for six weeks (or until the contract ends, if later), then Candis deletes it. Extensions are possible per month for the monthly fee. Retention of AI inputs not stated.","status":"verified","url":"https://candis.io/agb","locator":"7.3 Vertragsende, Datenaufbewahrung und -löschung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Kunde gibt sein Eiverständnis, dass die gespeicherten Inhalte und Dokumente danach durch Candis gelöscht werden."},{"key":"certifications","value":"Not stated for Candis itself on the pages read; the AVV only cites Amazon Web Services' ISO 27001 for the hosting.","status":"not_published","url":"https://candis.io/avv","locator":"Anhang 1, A Zutrittskontrollmaßnahmen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the AI page and AVV describe no setting to switch Candis AI off for the organisation.","status":"not_published","url":"https://candis.io/candis-ki","locator":"Candis KI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From €389 per month for Basis, rising with the number of invoices; unlimited users and companies included; VAT treatment not stated. Plus from €599, Max from €789 per month.","status":"verified","url":"https://candis.io/preise","locator":"Unsere Pakete: Basis","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ab 389 € pro Monat Berechne deinen Preis je nach Rechnungsanzahl"}]}]},{"slug":"canva","name":"Canva","vendor":"Canva","category":"design-images-and-video","plans":[{"id":"T15","plan":"Business","tier":"business","price":{"label":"€170 / user / yr","amount":170,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No, and it cannot be switched on: content from Teams, Business, Enterprise and Education users is not used to improve AI features","status":"verified","url":"https://www.canva.com/newsroom/news/safe-ai-canva-shield/","locator":"Canva Shield page (5 Jan 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: for Business, Teams and Enterprise accounts the AI-improvement control is disabled and Canva does not use their content to improve AI features, nor let third parties do so","status":"verified","url":"https://www.canva.com/trust/privacy/","locator":"FAQ 'Can Canva Business users opt in to Canva using their user content to improve AI-powered features?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not on Business: a US or EU data residency preference needs an Enterprise, Campus or District plan","status":"verified","url":"https://www.canva.com/help/data-residency/","locator":"'Before you start'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States","status":"verified","url":"https://www.canva.com/trust/privacy/","locator":"FAQ 'Where does Canva store my data?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes, for Canva Business and Enterprise: the DPA forms part of the agreement (Terms of Use); 30 days' notice before new sub-processors","status":"verified","url":"https://www.canva.com/policies/data-processing-addendum/","locator":"Preamble, section 2.7","url2":"https://www.canva.com/trust/privacy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public (list dated 17 Apr 2026): 15 third parties, 7 of them for Canva AI (AWS in US and EU; Anthropic, ElevenLabs, Features & Labels, Google, Nanonoble, OpenAI in the US), plus 8 Canva group entities","status":"verified","url":"https://www.canva.com/policies/subprocessors/","locator":"Link to the most recent PDF","url2":"https://content-management-files.canva.com/assets/en/f6022a49-58d4-40d8-88d3-803529880cc0","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Canva US, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Canva'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated. Canva keeps profile information and user content while the account is used and, after closure, 'for a commercially reasonable time' for legal, audit, backup and archive purposes; users can delete content and data in their settings","status":"not_published","url":"https://www.canva.com/policies/privacy-policy/","locator":"Section 8 'How long we keep your information'","url2":"https://www.canva.com/trust/privacy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"ISO 27001, AICPA SOC 2, AICPA SOC 3 and PCI DSS","status":"verified","url":"https://www.canva.com/security/","locator":"Section 'Certifications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. Team administrators can switch Magic Studio AI features on or off and decide by role who can use them","status":"verified","url":"https://www.canva.com/newsroom/news/safe-ai-canva-shield/","locator":"Section 'Built for the workplace'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 170 per person/year (annual billing)","status":"verified","url":"https://www.canva.com/de_de/preise/","locator":"Business card, annual toggle","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"capcut","name":"CapCut","vendor":"Bytedance Pte. Ltd. (CapCut)","category":"design-images-and-video","plans":[{"id":"T553","plan":"Teams","tier":"business","price":{"label":"€14.99 / user / mo","amount":14.99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. The privacy policy says user content and other collected information is used to train and improve CapCut's machine learning models. No separate business terms were found for the Teams plan.","status":"verified","url":"https://www.capcut.com/clause/privacy","locator":"EEA, Switzerland and UK > Legal Basis table (Improve and develop the Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"to understand how you use the Services, and to improve and develop the Services, including to train and improve our technology, such as our machine learning models and algorithms."},{"key":"training_opt_out","value":"No training-specific setting found. EEA/UK users can object to processing based on legitimate interests, which is the stated basis for training, via the Data Subject Request Webform.","status":"verified","url":"https://www.capcut.com/clause/privacy","locator":"EEA, Switzerland and UK > rights","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The right to object to processing if we are processing your personal data on the basis of our legitimate interest"},{"key":"eu_residency_option","value":"Not offered or not stated; the policy says EEA users' data is transferred to and stored in the US, Malaysia and Singapore, and describes no EU storage option.","status":"not_published","url":"https://www.capcut.com/clause/privacy","locator":"Looked in: Privacy Policy (International data transfers, EEA section), Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Malaysia, Singapore and the United States (secure servers). No hosting provider is named.","status":"verified","url":"https://www.capcut.com/clause/privacy","locator":"Section 5 / data storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We store the information we collect in secure servers located in Malaysia, Singapore and the United States."},{"key":"dpa","value":"Not stated; no data processing agreement is offered or mentioned in the Terms of Service or privacy policy for the Teams plan.","status":"not_published","url":"https://www.capcut.com/clause/terms-of-service","locator":"Looked in: Terms of Service, Privacy Policy, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not published; the privacy policy gives only categories of service providers (cloud hosting, content generation, moderation, analytics, payments) and the Terms name third-party AI providers such as Runway, Stable Diffusion, Google, FLUX and Luma.","status":"not_published","url":"https://www.capcut.com/clause/privacy","locator":"Looked in: Privacy Policy (Service Providers and Business Partners), Terms of Service (Third-Party AI Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Bytedance', 'CapCut'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Bytedance', 'CapCut' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: information is kept as long as necessary; cloud-space files you uploaded are deleted at your request. The Türkiye section cites five-year legal retention.","status":"verified","url":"https://www.capcut.com/clause/privacy","locator":"7. Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The retention periods differ depending on the type of information and the purposes for which we use the information."},{"key":"certifications","value":"Not captured: the Trust Center page rendered as navigation only; no certification is named in the privacy policy or Terms.","status":"not_captured","url":"https://www.capcut.com/trust","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the pricing page lists Teams features (brand kit, shared pro features) but no admin setting to limit AI features.","status":"not_published","url":"https://www.capcut.com/pricing","locator":"Looked in: Pricing page (Teams card), Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Teams: EUR 14.99 per seat per month, or EUR 120 per seat per year; shown with 2 seats. VAT treatment not shown; the page says displayed prices are for reference only.","status":"verified","url":"https://www.capcut.com/pricing","locator":"Teams plan card (monthly and yearly tabs)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EUR14.99 /month per seat Renews automatically. Cancel anytime."}]}]},{"slug":"chatbase","name":"Chatbase","vendor":"Chatbase Inc. (Delaware corporation)","category":"phone-and-voice","plans":[{"id":"T430","plan":"Standard","tier":"business","price":{"label":"$120 / mo","amount":120,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The privacy policy says Chatbase does not use your data to train AI models and uses retrieval (RAG) instead.","status":"verified","url":"https://www.chatbase.co/legal/privacy","locator":"Security section, 'No AI Training'","url2":"https://www.chatbase.co/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No AI Training: We do not use your data to train AI models. We use Retrieval-Augmented Generation (RAG) to generate responses without compromising your data."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train AI models on your data.","status":"verified","url":"https://www.chatbase.co/legal/privacy","locator":"Security section, 'No AI Training'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train AI models."},{"key":"eu_residency_option","value":"Not stated. The vendor says primary processing takes place in the United States; no EU hosting option is described.","status":"not_published","url":"https://www.chatbase.co/legal/dpa","locator":"Looked in DPA section 'Transfers of Personal Data', privacy policy, terms, security and pricing pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: AWS us-east-1, with Supabase and Vercel named as providers.","status":"verified","url":"https://www.chatbase.co/legal/privacy","locator":"Security section, 'Infrastructure Security'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our database and application run on AWS infrastructure (us-east-1), managed by reputable providers such as Supabase and Vercel."},{"key":"dpa","value":"Yes. The DPA supplements the Terms of Service and includes EU Standard Contractual Clauses by reference; no signature step is described.","status":"verified","url":"https://www.chatbase.co/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) supplements the Terms of Service (the “Agreement”) entered into by and between Customer"},{"key":"subprocessor_list","value":"Public list at https://trust.chatbase.co/subprocessors (linked from the DPA). Page needs a browser, so the count and AI providers were not captured.","status":"not_captured","url":"https://trust.chatbase.co/subprocessors","locator":"Public list link in the vendor's DPA or trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Chatbase'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Chatbase' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer data is deleted within 30 days of a written deletion request or end of the agreement, backups included; return instead of deletion is possible. Retention while the account is active is not stated.","status":"verified","url":"https://www.chatbase.co/legal/dpa","locator":"Section 2.4 / Annex II, limited data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Company shall delete Customer’s Personal Data within thirty (30) days of Company’s receipt of Customer’s written deletion request or termination of the Agreement, whichever occurs first."},{"key":"certifications","value":"1 named certification: SOC 2 Type II. Also claims GDPR compliance and HIPAA-eligible Enterprise workspaces (no ISO 27001 named).","status":"verified","url":"https://www.chatbase.co/security","locator":"Enterprise security and privacy section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Chatbase is SOC 2 Type II compliant, supports GDPR requirements, and provides HIPAA-eligible Enterprise workspaces."},{"key":"admin_ai_controls","value":"Not stated. Pages describe guardrails on what an agent answers, but no organisation-wide switch to turn AI features off.","status":"not_published","url":"https://www.chatbase.co/security","locator":"Looked in security page, terms, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $120 per month, billed yearly (Standard plan, 3 members, 4,000 message credits/month)","status":"not_published","url":"https://www.chatbase.co/pricing","locator":"Standard card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"chatgpt","name":"ChatGPT","vendor":"OpenAI","category":"assistants","plans":[{"id":"T26","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. OpenAI may use conversations on Free, Plus and Pro to train its models unless the user opts out; feedback (thumbs up/down) can still put a whole conversation into training after an opt-out","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"Section 'Services for individuals' (updated 18 Oct 2026) and FAQ on feedback after opting out","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"The user turns off 'Improve the model for everyone' under Settings > Data controls, or selects 'Do not train on my content' in OpenAI's Privacy Portal. Only new conversations are affected, and thumbs-up/down feedback still allows training on that conversation","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"Section 'Services for individuals'","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No. Data residency in Europe is offered only to eligible API customers and new Enterprise and Edu workspaces","status":"verified","url":"https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt","locator":"Eligibility section","url2":"https://chatgpt.com/pricing/?type=team","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Outside the EU: OpenAI processes and stores personal data on servers in the United States and in countries where its affiliates and vendors are, using EU Standard Contractual Clauses","status":"verified","url":"https://openai.com/policies/eu-privacy-policy/","locator":"Section on international transfers (EU privacy policy updated 24 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"No. On personal plans OpenAI is the controller under its consumer terms; its DPA attaches only to the business OpenAI Services Agreement","status":"verified","url":"https://openai.com/policies/data-processing-addendum/","locator":"Preamble ('supplements, and is incorporated into, the OpenAI Services Agreement')","url2":"https://openai.com/policies/eu-privacy-policy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"No list for personal plans. OpenAI's sub-processor list covers only the API and ChatGPT Business, Enterprise and Edu; the EU privacy policy names categories of vendors (hosting, cloud, payments, analytics, safety, age verification)","status":"verified","url":"https://openai.com/policies/sub-processor-list/","locator":"Column 'OpenAI Product or Service' in both tables","url2":"https://openai.com/policies/eu-privacy-policy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'OpenAI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'OpenAI' (same result as for ChatGPT Business, checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats stay until the user deletes them; deleted chats and accounts leave OpenAI's systems within 30 days, unless kept longer for legal, safety or abuse reasons. Temporary chats are deleted within 30 days","status":"verified","url":"https://openai.com/policies/eu-privacy-policy/","locator":"Section 4 'Retention'","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"None listed for personal plans. OpenAI's product compliance matrix covers ChatGPT Business, Enterprise, Edu, Healthcare, Teachers, the API, Codex and Presence, not Free, Go, Plus or Pro","status":"verified","url":"https://openai.com/product-compliance-status/","locator":"Matrix 'Enterprise products and programs' (page version 1.1, 4 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal plan has no admin. The user controls training, memory and chat history in their own settings","status":"verified","url":"https://chatgpt.com/pricing/","locator":"FAQ 'How many users are supported on each subscription plan?' ('designed to be used by individuals')","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 0 per month","status":"verified","url":"https://chatgpt.com/pricing/","locator":"Personal plans: Free, Go, Plus, Pro cards","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T27","plan":"Plus","tier":"personal","price":{"label":"€23 / mo","amount":23,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. OpenAI may use conversations on Free, Plus and Pro to train its models unless the user opts out; feedback (thumbs up/down) can still put a whole conversation into training after an opt-out","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"Section 'Services for individuals' (updated 18 Oct 2026) and FAQ on feedback after opting out","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"The user turns off 'Improve the model for everyone' under Settings > Data controls, or selects 'Do not train on my content' in OpenAI's Privacy Portal. Only new conversations are affected, and thumbs-up/down feedback still allows training on that conversation","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"Section 'Services for individuals'","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No. Data residency in Europe is offered only to eligible API customers and new Enterprise and Edu workspaces","status":"verified","url":"https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt","locator":"Eligibility section","url2":"https://chatgpt.com/pricing/?type=team","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Outside the EU: OpenAI processes and stores personal data on servers in the United States and in countries where its affiliates and vendors are, using EU Standard Contractual Clauses","status":"verified","url":"https://openai.com/policies/eu-privacy-policy/","locator":"Section on international transfers (EU privacy policy updated 24 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"No. On personal plans OpenAI is the controller under its consumer terms; its DPA attaches only to the business OpenAI Services Agreement","status":"verified","url":"https://openai.com/policies/data-processing-addendum/","locator":"Preamble ('supplements, and is incorporated into, the OpenAI Services Agreement')","url2":"https://openai.com/policies/eu-privacy-policy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"No list for personal plans. OpenAI's sub-processor list covers only the API and ChatGPT Business, Enterprise and Edu; the EU privacy policy names categories of vendors (hosting, cloud, payments, analytics, safety, age verification)","status":"verified","url":"https://openai.com/policies/sub-processor-list/","locator":"Column 'OpenAI Product or Service' in both tables","url2":"https://openai.com/policies/eu-privacy-policy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'OpenAI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'OpenAI' (same result as for ChatGPT Business, checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats stay until the user deletes them; deleted chats and accounts leave OpenAI's systems within 30 days, unless kept longer for legal, safety or abuse reasons. Temporary chats are deleted within 30 days","status":"verified","url":"https://openai.com/policies/eu-privacy-policy/","locator":"Section 4 'Retention'","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"None listed for personal plans. OpenAI's product compliance matrix covers ChatGPT Business, Enterprise, Edu, Healthcare, Teachers, the API, Codex and Presence, not Free, Go, Plus or Pro","status":"verified","url":"https://openai.com/product-compliance-status/","locator":"Matrix 'Enterprise products and programs' (page version 1.1, 4 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal plan has no admin. The user controls training, memory and chat history in their own settings","status":"verified","url":"https://chatgpt.com/pricing/","locator":"FAQ 'How many users are supported on each subscription plan?' ('designed to be used by individuals')","url2":"https://help.openai.com/en/articles/7730893-data-controls-faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 23 per month (monthly billing; VAT basis not stated on the page)","status":"verified","url":"https://chatgpt.com/pricing/","locator":"Personal plans: Free, Go, Plus, Pro cards","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T01","plan":"Business","tier":"business","price":{"label":"€21 / user / mo","amount":21,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Business prompts, responses and files are used to improve models only if the organisation signs a separate agreement; thumbs-up/down feedback does not permit training on the conversation","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"Sections 'Business services and managed workspaces' and FAQ 'What if I submit feedback after opting out?' (updated 17 Oct 2026)","url2":"https://openai.com/enterprise-privacy/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Business prompts, responses and files are not used to improve OpenAI's models unless the organisation signs a separate agreement. Thumbs-up/down feedback does not permit training; admins can also turn response feedback off (Admin Console > Workspace settings > Allow response feedback)","status":"verified","url":"https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance","locator":"FAQ 'What if I submit feedback after opting out?', Business paragraph (article updated 17 Oct 2026)","url2":"https://help.openai.com/en/articles/8798634-managing-data-sharing-and-privacy-in-chatgpt-business","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not on Business. Enterprise/Edu: storage at rest in Europe (EEA + Switzerland) and in-region inference for Europe","status":"verified","url":"https://chatgpt.com/pricing/?type=team","locator":"Comparison row 'Data residency in US, EU, UK, ...': Business = No, Enterprise = Yes","url2":"https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated for Business. Residency is offered only to eligible API and new Enterprise/Edu workspaces; sub-processor list shows Business infrastructure in the US and many other countries","status":"not_published","url":"https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt","locator":"Eligibility section (article updated about 15 Oct 2026)","url2":"https://openai.com/policies/sub-processor-list/","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. DPA (effective 1 Jan 2026) is incorporated into the Services Agreement; EEA and Swiss customers contract with OpenAI Ireland Ltd.","status":"verified","url":"https://openai.com/policies/data-processing-addendum/","locator":"Preamble (updated 1 Dec 2025, effective 1 Jan 2026)","url2":"https://openai.com/enterprise-privacy/","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 16 third-party entities, 15 of which cover ChatGPT Business; list updated 14 Oct 2026; sign-up form for notices of new sub-processors","status":"verified","url":"https://openai.com/policies/sub-processor-list/","locator":"Third Party Sub-processors table; 'Last updated: October 14, 2026'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'OpenAI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'OpenAI' returned 'Query returned no results' (3,683 participants in total)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Workspace admins can set how long data is kept; deleted or unsaved conversations are removed from OpenAI's systems within 30 days unless the law or harm prevention requires longer","status":"verified","url":"https://openai.com/enterprise-privacy/","locator":"FAQ 'What is OpenAI's policy on data retention for ChatGPT Business?' (page updated 8 Jan 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type 2 only. ISO/IEC 27001 and 27701 cover ChatGPT Enterprise, Edu and the API, but not ChatGPT Business","status":"verified","url":"https://openai.com/product-compliance-status/","locator":"Matrix 'Enterprise products and programs', row 'ChatGPT Business' (page version 1.1, 4 Aug 2026)","url2":"https://trust.openai.com/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Admins choose which apps (connected tools) are enabled and can turn response feedback off; they cannot switch off shared links for everyone, which is an Enterprise-only setting","status":"verified","url":"https://openai.com/enterprise-privacy/","locator":"Section on apps: 'Your workspace admins can control which apps are enabled'","url2":"https://help.openai.com/en/articles/8798634-managing-data-sharing-and-privacy-in-chatgpt-business","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 21 per user/month billed annually; EUR 26 billed monthly (premium seat EUR 105 / 130)","status":"verified","url":"https://chatgpt.com/pricing/?type=team","locator":"Business & Enterprise tab, Business card","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"circleback","name":"Circleback","vendor":"Circleback AI, Inc.","category":"meetings-and-notes","plans":[{"id":"T393","plan":"Business","tier":"business","price":{"label":"$25 / user / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Circleback's security documentation says it does not use customer data to train models (not plan-specific).","status":"verified","url":"https://circleback.ai/docs/support/security/security","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use customer data to train models."},{"key":"training_opt_out","value":"Nothing to do: Circleback states it does not use customer data to train models.","status":"verified","url":"https://circleback.ai/docs/support/security/security","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use customer data to train models."},{"key":"eu_residency_option","value":"Not stated: no EU hosting option found in the DPA, privacy policy, support articles or pricing; processing is in the US.","status":"not_published","url":"https://circleback.ai/dpa","locator":"DPA (International Transfers); privacy policy; docs/support/security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the DPA says primary processing takes place in the US.","status":"verified","url":"https://circleback.ai/dpa","locator":"International Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer acknowledges that Circleback’s primary processing operations take place in the United States"},{"key":"dpa","value":"Yes. A DPA is published at circleback.ai/dpa and applies automatically to customers who use the Services (click-through, no signature needed).","status":"verified","url":"https://circleback.ai/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By using the Services, you agree to this DPA."},{"key":"subprocessor_list","value":"The DPA says the current list is at security.circleback.ai, a JavaScript trust centre that could not be read here; count and AI providers not captured. The privacy policy names categories only (AI model providers, transcription providers).","status":"not_captured","url":"https://circleback.ai/dpa","locator":"7. Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The current list of Subprocessors can be found at security.circleback.ai."},{"key":"dpf_status","value":"Active (Circleback; EU-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Circleback'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Business plan: workspace admins set retention separately for recordings, transcripts and all meeting data; expired data is permanently deleted. Without a setting, data stays until the customer deletes it. Recording storage 2 years on Business. Deleting an account removes all data immediately.","status":"verified","url":"https://circleback.ai/docs/support/workspace-and-teams/data-retention-settings","locator":"Data retention settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When a retention period expires, that data is permanently deleted and cannot be recovered."},{"key":"certifications","value":"SOC 2 Type II (1 certification named); also claims HIPAA compliance and EU-U.S. DPF certification (not security certifications).","status":"verified","url":"https://circleback.ai/docs/support/security/security","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Circleback is SOC 2 Type II and EU-U.S. Data Privacy Framework-certified"},{"key":"admin_ai_controls","value":"Not stated: Business adds admin roles, 'default and enforceable settings' and custom data retention, but no organisation-wide switch for AI features is described.","status":"not_published","url":"https://circleback.ai/pricing","locator":"Business plan card; docs 'Default and enforced workspace settings'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $25 per user/month (Business; monthly/yearly toggle, the page text shows one figure)","status":"not_published","url":"https://circleback.ai/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"claude","name":"Claude","vendor":"Anthropic","category":"assistants","plans":[{"id":"T28","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: Anthropic's privacy policy says it may use inputs and outputs to train its models 'unless you opt out through your account settings'. Chats flagged for safety review and chats sent as feedback can be used even after an opt-out","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section on use of Inputs and Outputs (policy effective 10 Sep 2026)","url2":"https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off 'Help improve our AI models' under Settings > Privacy (web, desktop or mobile). New chats are then excluded and stored chats leave future training runs; training already under way is not undone. Incognito chats are never used","status":"verified","url":"https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings","locator":"Sections 'Modifying Your Model Improvement Settings' (article dated 3 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option. Anthropic names only a US-only inference option for Enterprise and API traffic-routing controls","status":"verified","url":"https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers","locator":"Article on server locations","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Outside the EU: personal data is transferred to Anthropic's servers in the US or other countries outside the EEA, under adequacy decisions or Standard Contractual Clauses","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section 5 'Data Transfers'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. On consumer plans Anthropic Ireland is the controller under the consumer terms; Anthropic's DPA belongs to its commercial terms (Claude for Work and the API)","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section on the data controller ('Anthropic Ireland, Limited')","url2":"https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 18 of 22 entries cover Free: cloud (Google Cloud, AWS, Azure), Cloudflare, support, analytics, fraud and identity checks (Persona, Yoti, hCaptcha), web search (Brave, Parallel Web Systems); most in the US","status":"verified","url":"https://trust.anthropic.com/subprocessors","locator":"Subprocessors list, all pages; scope line per entry","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Anthropic'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Anthropic' (same result as for Claude Team, checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats stay until the user deletes them; deleted chats leave the back-end within 30 days. With model improvement on, chats may be kept de-identified for up to 5 years in training pipelines; flagged chats up to 2 years; feedback 5 years","status":"verified","url":"https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data","locator":"'Controlling Your Chats', 'If You Allow Us to Use Your Data to Improve Claude', 'Usage Policy Violations', 'Feedback Data' (dated 1 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed for consumer plans. Anthropic's Trust Center scope table covers the API, Claude Enterprise, Claude Team and cloud-partner offerings, not Free, Pro or Max","status":"verified","url":"https://trust.anthropic.com/","locator":"Overview scope table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: an individual plan has no admin; the user controls model improvement and chat history in their own settings","status":"verified","url":"https://claude.com/pricing","locator":"Plans grouped as individual plans (Free, Pro, Max)","url2":"https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 0 per month","status":"verified","url":"https://claude.com/pricing","locator":"Individual plans: Free, Pro, Max cards ('Prices shown don't include applicable tax')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T29","plan":"Pro","tier":"personal","price":{"label":"€18 / mo","amount":18,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: Anthropic's privacy policy says it may use inputs and outputs to train its models 'unless you opt out through your account settings'. Chats flagged for safety review and chats sent as feedback can be used even after an opt-out","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section on use of Inputs and Outputs (policy effective 10 Sep 2026)","url2":"https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off 'Help improve our AI models' under Settings > Privacy (web, desktop or mobile). New chats are then excluded and stored chats leave future training runs; training already under way is not undone. Incognito chats are never used","status":"verified","url":"https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings","locator":"Sections 'Modifying Your Model Improvement Settings' (article dated 3 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option. Anthropic names only a US-only inference option for Enterprise and API traffic-routing controls","status":"verified","url":"https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers","locator":"Article on server locations","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Outside the EU: personal data is transferred to Anthropic's servers in the US or other countries outside the EEA, under adequacy decisions or Standard Contractual Clauses","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section 5 'Data Transfers'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. On consumer plans Anthropic Ireland is the controller under the consumer terms; Anthropic's DPA belongs to its commercial terms (Claude for Work and the API)","status":"verified","url":"https://www.anthropic.com/legal/privacy","locator":"Section on the data controller ('Anthropic Ireland, Limited')","url2":"https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 19 of 22 entries cover Pro (the Free set plus Stripe for billing); most in the US","status":"verified","url":"https://trust.anthropic.com/subprocessors","locator":"Subprocessors list, all pages; scope line per entry","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Anthropic'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Anthropic' (same result as for Claude Team, checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats stay until the user deletes them; deleted chats leave the back-end within 30 days. With model improvement on, chats may be kept de-identified for up to 5 years in training pipelines; flagged chats up to 2 years; feedback 5 years","status":"verified","url":"https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data","locator":"'Controlling Your Chats', 'If You Allow Us to Use Your Data to Improve Claude', 'Usage Policy Violations', 'Feedback Data' (dated 1 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed for consumer plans. Anthropic's Trust Center scope table covers the API, Claude Enterprise, Claude Team and cloud-partner offerings, not Free, Pro or Max","status":"verified","url":"https://trust.anthropic.com/","locator":"Overview scope table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: an individual plan has no admin; the user controls model improvement and chat history in their own settings","status":"verified","url":"https://claude.com/pricing","locator":"Plans grouped as individual plans (Free, Pro, Max)","url2":"https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 18 per month billed monthly, or EUR 15 per month billed yearly (EUR 180); excludes tax","status":"verified","url":"https://claude.com/pricing","locator":"Individual plans: Free, Pro, Max cards ('Prices shown don't include applicable tax')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T02","plan":"Team","tier":"business","price":{"label":"€18 / user / mo","amount":18,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Exception: chats a user rates with thumbs up/down or otherwise opts in may be used for training","status":"verified","url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","locator":"Commercial products section (updated 18 Aug 2026)","url2":"https://claude.com/pricing","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Team chats are not used for training by default. Chats someone rates with thumbs up/down may be used; an Owner can block that with the 'Rate chats' setting (Organization settings > Data and Privacy)","status":"verified","url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","locator":"Paragraphs on commercial products, 'Feedback' and 'Disabling Feedback'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No EU option documented for Team. Only a US-only inference option (Enterprise, usage-based billing) and API traffic-routing controls are named","status":"not_published","url":"https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers","locator":"Article body (updated 15 Jun 2026)","url2":"https://claude.com/pricing","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Data stored in the US; traffic may by default be routed to select countries in the US, Europe, Asia and Australia","status":"verified","url":"https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers","locator":"Article body (updated 15 Jun 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA with SCCs is automatically incorporated into the Commercial Terms","status":"verified","url":"https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa","locator":"Article body (dated 16 Mar 2026)","url2":"https://www.anthropic.com/legal/data-processing-addendum","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 22 entries (product scope varies by entry); cloud infrastructure (Google Cloud, AWS, Azure) listed as Worldwide, most others US; subscribe-to-updates button","status":"verified","url":"https://trust.anthropic.com/subprocessors","locator":"Subprocessors table, '1-10 of 22 results'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Anthropic'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Anthropic' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats stay until a user deletes them; deleted chats leave Anthropic's back-end within 30 days. Chats flagged for policy violations: up to 2 years; feedback: 5 years. Custom retention is Enterprise only","status":"verified","url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","locator":"'Standard Retention Timeframe', 'Usage Policy Violations', 'Feedback Data' (article dated 1 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, ISO 27001, ISO 42001, CSA STAR and NIST 800-171 listed for Claude Team; HIPAA marked not applicable","status":"verified","url":"https://trust.anthropic.com/","locator":"Overview scope table, row 'Claude Team'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes, feature by feature. Owners can switch off Claude in Chrome and code execution/file creation for the organisation (both on by default for Team) and stop members sending feedback","status":"verified","url":"https://support.claude.com/en/articles/13065128-claude-in-chrome-admin-controls","locator":"'Enable or disable the extension': 'Team plans: The extension is enabled by default'","url2":"https://support.claude.com/en/articles/12111783-create-and-edit-files-with-claude","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 18 per seat/month billed annually; EUR 21.04 billed monthly (premium seat EUR 90 / 105.23); excl. tax","status":"verified","url":"https://claude.com/pricing","locator":"Team & Enterprise tab, Team card","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"clay","name":"Clay","vendor":"Clay Labs Inc. (USA)","category":"sales-marketing-and-support","plans":[{"id":"T503","plan":"Launch","tier":"business","price":{"label":"$167 / mo","amount":167,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; the terms only license user content for 'providing and improving the Services' and no page mentions training AI models.","status":"not_published","url":"https://www.clay.com/legal/terms-of-service","locator":"Terms of Service, User Content licence; also privacy policy and DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://www.clay.com/legal/terms-of-service","locator":"Looked in terms, privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU storage option found.","status":"not_published","url":"https://www.clay.com/legal/dpa","locator":"Looked in DPA, terms, privacy policy, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the sub-processor list places Amazon Web Services (cloud service provider) in the USA; the terms, privacy policy and DPA name no storage region for customer content.","status":"verified","url":"https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4_A9UcoAN7t6Ob4yYzA/export?format=txt","locator":"Clay Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Clay Subprocessors Subprocessors Purpose Location Additional Information Amazon Web Services Cloud service provider USA"},{"key":"dpa","value":"Yes. A public DPA is incorporated by reference into the customer agreement; the privacy policy also says DPAs are given on request, and a custom DPA is listed as an Enterprise feature.","status":"verified","url":"https://www.clay.com/legal/dpa","locator":"DPA preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is incorporated by reference into the applicable agreement governing Customer’s use of Clay’s services"},{"key":"subprocessor_list","value":"Yes, public Google Doc linked from the DPA: 32 sub-processors plus a second table of 164 third-party data providers. AI providers listed: Anthropic, Cohere, Fireworks, Google Gemini, Mistral, OpenAI.","status":"verified","url":"https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4_A9UcoAN7t6Ob4yYzA/export?format=txt","locator":"Clay Subprocessors; Clay 3rd Party Data Providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Clay Subprocessors Subprocessors Purpose Location Additional Information Amazon Web Services Cloud service provider USA"},{"key":"dpf_status","value":"No listing found for search term 'Clay Labs'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Clay Labs' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active; deleting the account deletes the data, and users can request deletion by email. After termination the customer may ask for its data to be returned, then Clay deletes remaining copies.","status":"verified","url":"https://www.clay.com/legal/terms-of-service","locator":"Terms of Service, data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Clay Labs retains user data as long as your user account is active. If your account is deleted, your data is deleted with it."},{"key":"certifications","value":"Not captured: security and certification details sit on trust.clay.com, which is empty without JavaScript.","status":"not_captured","url":"https://trust.clay.com/","locator":"Trust portal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features (Claygent) found.","status":"not_published","url":"https://www.clay.com/pricing","locator":"Looked in pricing page, terms, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Launch plan $167 per month (starts at 15,000 actions a month; an annual toggle saves 10%).","status":"not_published","url":"https://www.clay.com/pricing","locator":"Plans, Launch card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"cleverreach","name":"CleverReach Newsletter Tool","vendor":"CleverReach GmbH & Co. KG","category":"sales-marketing-and-support","plans":[{"id":"T511","plan":"Pro","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The AI Content Generator sends the prompt to OpenAI; no sentence says whether prompts or newsletter content are used for training.","status":"not_published","url":"https://www.cleverreach.com/en/newsletter-tool/creating-and-designing-newsletters/ai-content-generator/","locator":"AI Content Generator page; terms; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no setting or request is described for stopping AI-related training.","status":"not_published","url":"https://www.cleverreach.com/en/newsletter-tool/creating-and-designing-newsletters/ai-content-generator/","locator":"AI Content Generator page; terms; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not a setting: all customer data is stored only in Germany/the EU by default.","status":"verified","url":"https://www.cleverreach.com/en/data-security/","locator":"Data security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored in our secure data centers exclusively in the European region."},{"key":"default_data_location","value":"Germany and the EU: servers exclusively in Germany and the EU; data centres are in the European region.","status":"verified","url":"https://www.cleverreach.com/en/gdpr-compliant-newsletter-tool/","locator":"Secure Servers Located in Germany and the EU","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"CleverReach guarantees top data security thanks to its servers, which are exclusively located in Germany and the EU."},{"key":"dpa","value":"Yes, but not automatic: the terms say a DPA must be concluded separately, and customers sign it online in their account.","status":"verified","url":"https://www.cleverreach.com/en/gdpr-compliant-newsletter-tool/","locator":"Conclude Data Processing Contract Online","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our customers can easily sign this contract with us online in their account."},{"key":"subprocessor_list","value":"Not published: no public sub-processor list found; the OpenAI use for the AI generator is disclosed on the AI feature page. The DPA is available in the account.","status":"not_published","url":"https://www.cleverreach.com/en/data-security/","locator":"Data security, privacy policy, terms, GDPR page, legal information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, CleverReach GmbH & Co. KG, Rastede, Germany)","status":"verified","url":"https://www.cleverreach.com/en/legal-information/","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"CleverReach GmbH & Co. KG"},{"key":"data_retention","value":"Not stated for stored data during the contract. After termination the customer may demand in writing that stored order data be deleted without delay; no fixed deletion period given.","status":"verified","url":"https://www.cleverreach.com/en/terms-of-service/","locator":"§7 End of the right of use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After termination of the cooperation in the sense of this contract, the Client may demand that the order data stored in the database during the cooperation be deleted by the Provider without delay."},{"key":"certifications","value":"2 certifications named for its data centres (DIN ISO/IEC 27001, PCI DSS Level 1 service provider), plus annual SOC 1 tests; not CleverReach's own certificates.","status":"verified","url":"https://www.cleverreach.com/en/data-security/","locator":"Data security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"They have also received DIN ISO/IEC 27001 certification and have been confirmed as Level 1 service providers for the data security standard of the credit card industry (DSS/PCI)."},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch the AI Content Generator off was found.","status":"not_published","url":"https://www.cleverreach.com/en/newsletter-tool/creating-and-designing-newsletters/ai-content-generator/","locator":"AI Content Generator page; terms; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"18 € per month for the Pro plan at 500 recipients (default tier shown), plus statutory VAT; payment is made annually in advance and the monthly price is the annual price divided by 12.","status":"verified","url":"https://www.cleverreach.com/en/plans-and-pricing/","locator":"Pro plan card and billing note","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Payment is made annually in advance. The monthly price is merely a mathematical representation of the annual price."}]}]},{"slug":"clickup","name":"ClickUp","vendor":"ClickUp (Mango Technologies, Inc.)","category":"workspace-and-projects","plans":[{"id":"T107","plan":"Business","tier":"business","price":{"label":"$12 / user / mo","amount":12,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. ClickUp says its AI is not trained on Workspace data, and its contracts stop AI partners from training on or keeping it","status":"verified","url":"https://help.clickup.com/hc/en-us/articles/15428419095831-ClickUp-AI-models-privacy-and-security-FAQ","locator":"Question 'Is my data used to train any AI models?'","url2":"https://clickup.com/security","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Workspace data is not used to train AI models","status":"verified","url":"https://help.clickup.com/hc/en-us/articles/15428419095831-ClickUp-AI-models-privacy-and-security-FAQ","locator":"Question 'Is my data used to train any AI models?'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not on Business: EU-only hosting is for Enterprise customers on request, at no charge; ClickUp AI data is processed outside the chosen region (in the US)","status":"verified","url":"https://help.clickup.com/hc/en-us/articles/15999383444247-Data-hosting","locator":"Sections 'Localized data hosting' and 'Localized data processing'","url2":"https://help.clickup.com/hc/en-us/articles/15428419095831-ClickUp-AI-models-privacy-and-security-FAQ","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated for Business: customer data sits in one of five AWS regions (Oregon, Ohio, Sydney, Singapore, Dublin), but the help centre does not say which one a non-Enterprise Workspace gets","status":"not_published","url":"https://help.clickup.com/hc/en-us/articles/15999383444247-Data-hosting","locator":"Section 'Data hosting'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. The Data Protection Addendum forms part of the Terms of Use or SaaS Services Agreement with Mango Technologies, Inc. (ClickUp)","status":"verified","url":"https://clickup.com/terms/dpa","locator":"Opening paragraphs","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 53 entries: 1 infrastructure (AWS), 32 platform, 12 AI (including Anthropic, OpenAI, Microsoft Azure AI Foundry, and two located in China: Kling 3.0 and Seedance 2.0), 4 support and 4 professional services; nearly all in the US","status":"verified","url":"https://clickup.com/terms/dpa/subprocessors","locator":"Page 'Subprocessors' (last updated 28 Sep 2026)","url2":"https://clickup.com/terms/dpa","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search terms 'ClickUp' and 'Mango Technologies'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Searches 'ClickUp' and 'Mango Technologies' returned no results","url2":"https://clickup.com/terms/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the term; at the end ClickUp deletes customer personal data as soon as reasonably practicable. Backups are kept for up to one year, so deleted items can stay in backups until then. AI partners keep no data (zero retention agreements)","status":"verified","url":"https://help.clickup.com/hc/en-us/articles/43941086639383-Backups-and-data-retention","locator":"Sections 'Backup retention' and 'Deleted data and backups'","url2":"https://clickup.com/terms/dpa","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 1 Type 2, SOC 2 Type 2 and SOC 3; ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019 and 42001; PCI compliance","status":"verified","url":"https://clickup.com/security","locator":"Sections 'SOC 2 Compliance' and 'ISO Certifications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes, by ClickUp's terms: ClickUp AI can be disabled for the whole Workspace; the help centre pages read did not show the steps","status":"verified","url":"https://clickup.com/terms/ai","locator":"Opening paragraph ('you may also disable ClickUp AI in your Workspace'; last updated 11 Jul 2025)","url2":"https://help.clickup.com/hc/en-us/articles/15999383444247-Data-hosting","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 12 per user/month billed yearly (USD 19 monthly); Brain AI add-on USD 9 per user/month","status":"not_published","url":"https://clickup.com/pricing","locator":"Plan card 'Business' and AI section 'Brain AI'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"close-crm","name":"Close","vendor":"Elastic Inc (Close)","category":"sales-marketing-and-support","plans":[{"id":"T493","plan":"Growth","tier":"business","price":{"label":"$99 / user / mo","amount":99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The terms let Close use your content to provide and improve the service and as inputs to AI features built by Close or third parties; no sentence mentions training models.","status":"not_published","url":"https://www.close.com/terms","locator":"3. General Conditions, clause E (Your Content)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"to provide, maintain and improve the Services; to perform such other actions as authorized by you in connection with your use of the Services including for use as inputs in features incorporating Artificial Intelligence"},{"key":"training_opt_out","value":"Not stated: no training statement and no opt-out route found in the terms, privacy policy, security or GDPR pages.","status":"not_published","url":"https://www.close.com/terms","locator":"3. General Conditions, clause E","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated on the pages read (terms, privacy, security, GDPR pages).","status":"not_published","url":"https://close.com/gdpr","locator":"GDPR Compliance page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States, on Amazon Web Services (the privacy policy gives the place of processing for AWS hosting as the US).","status":"verified","url":"https://www.close.com/privacy","locator":"Amazon Web Services (AWS) entry","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"hosting and backend service provided by Amazon Web Services, Inc. Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States"},{"key":"dpa","value":"Yes, provided to any customer who needs one: Close's DPA includes Standard Contractual Clauses; the GDPR page offers it for e-signing or as a PDF (dated 7 Feb 2023).","status":"verified","url":"https://close.com/gdpr","locator":"Contractual Agreements","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Close provides Data Processing Agreements to any customer who may need them."},{"key":"subprocessor_list","value":"No dedicated sub-processor list found. The privacy policy names 35 third-party services (incl. AWS, OpenAI API, Anthropic, Twilio, Stripe); the GDPR page names AWS as a key sub-processor.","status":"not_published","url":"https://www.close.com/privacy","locator":"Third-party service entries (#### headings)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The OpenAI API provided by OpenAI, L.L.C. is a service that helps the Owner to automate tasks through its AI engine."},{"key":"dpf_status","value":"No listing found for search term 'Close'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Close' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active or a limited time needed for the purpose. Deleting a lead removes it from all systems within 30 days; full removal on email request to support@close.com. No fixed period after cancellation stated.","status":"verified","url":"https://close.com/gdpr","locator":"Recommendations for Close Customers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"simply delete the lead within Close and within 30 days that information will be completely removed from our systems"},{"key":"certifications","value":"1 named: SOC 2 Type 2. GDPR and CCPA compliance statements; no ISO 27001 named.","status":"verified","url":"https://www.close.com/security","locator":"Close is SOC 2 Type 2 compliant","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As a SOC 2 Type 2 certified SaaS provider, Close securely manages your data to protect the interests and privacy of your organization."},{"key":"admin_ai_controls","value":"Not stated on the pages read. The Scale plan lists role-based permissions, but no page describes switching AI (Chloe) off for the organisation.","status":"not_published","url":"https://www.close.com/pricing","locator":"Plan comparison","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Growth is $99 per user/month billed annually ($109 billed monthly).","status":"not_published","url":"https://www.close.com/pricing","locator":"Plan cards and billing toggle","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"coda","name":"Coda / Superhuman Docs","vendor":"Superhuman Platform Inc. (formerly Grammarly; Coda Project LLC)","category":"workspace-and-projects","plans":[{"id":"T450","plan":"Superhuman Business","tier":"business","price":{"label":"€33 / user / mo","amount":33,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out. The plans page lists Model training as 'Opt out' for Free, Pro and Business and 'Off by default' for Enterprise. The privacy policy says the choice is a training control in account settings.","status":"verified","url":"https://superhuman.com/plans","locator":"Plans and features, Privacy: Model training row (columns Free, Pro, Business, Enterprise)","url2":"https://coda.io/trust/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Model training Opt out Opt out Opt out Off by default"},{"key":"training_opt_out","value":"Turn off the AI training control in account settings (the policy gives no menu path). The plans page lists model training as 'Opt out' for Business, i.e. on until switched off; whether an admin can set it for the whole organisation is not stated for Docs.","status":"verified","url":"https://coda.io/trust/privacy","locator":"Privacy Policy, 'Your Rights and Choices'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AI training control. As described above, you can decide whether Superhuman can use your user content to train our AI models"},{"key":"eu_residency_option","value":"Not stated; no EU data-residency option found. The DPA allows US and other processing, with transfer safeguards for European data.","status":"not_published","url":"https://coda.io/trust/dpa","locator":"DPA section on international transfers; Trust centre security page; sub-processor page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Hosted on Amazon Web Services; the DPA allows processing in the United States and other places where Superhuman and its sub-processors operate. No region is named.","status":"verified","url":"https://coda.io/trust/dpa","locator":"DPA Exhibit B, hosting paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Docs is hosted on Amazon Web Services (AWS). Encryption key management is provided through AWS Key Management Service (KMS)."},{"key":"dpa","value":"Yes. A Data Privacy Addendum is part of the agreement between the customer and Superhuman and takes precedence over the main terms.","status":"verified","url":"https://coda.io/trust/dpa","locator":"Data Privacy Addendum, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is incorporated into and subject to the terms and conditions of the current version of any agreements"},{"key":"subprocessor_list","value":"Yes, public at https://coda.io/trust/subprocessor: 20 third-party sub-processors plus 8 Superhuman group companies. AI providers listed: Anthropic, Azure, Baseten, OpenAI.","status":"verified","url":"https://coda.io/trust/subprocessor","locator":"Superhuman Subprocessors, Third-party Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Superhuman Platform (including products offered as “Grammarly”, “Coda”, “Superhuman Go”, and “Superhuman Mail”) engages certain third-party vendors"},{"key":"dpf_status","value":"Active (Superhuman Platform Inc. (formerly Grammarly, Inc.); EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Superhuman Platform'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Deleted documents stay in primary storage 7 days for recovery, then are removed; they remain in backups for another 35 days before being purged (unless the account holder directs otherwise).","status":"verified","url":"https://coda.io/trust/dpa","locator":"DPA Exhibit B, hosting paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"documents are retained in primary storage for seven (7) days to allow for recovery, then permanently removed from primary storage"},{"key":"certifications","value":"5 named: ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 (enterprise customers only) and SOC 3. HIPAA, GDPR and CCPA are listed as compliance programmes.","status":"verified","url":"https://coda.io/trust/security","locator":"Trust centre, Security, Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type 2 (Type Ⅱ) Trust Services Principles Available for enterprise customers"},{"key":"admin_ai_controls","value":"Not stated; no admin switch for turning off AI features organisation-wide found in the fetched legal and trust pages.","status":"not_published","url":"https://coda.io/trust/security","locator":"Trust centre security, DPA, privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 33 per member/month billed annually (EUR 40 billed monthly) for the Superhuman Business plan, which bundles Mail, Grammarly, Docs and Go; VAT not shown.","status":"verified","url":"https://superhuman.com/plans","locator":"Plans page, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"per member / month, billed annually €40 when billed monthly"}]}]},{"slug":"cognism","name":"Cognism Sales Prospecting","vendor":"Cognism Limited (London, UK)","category":"sales-marketing-and-support","plans":[{"id":"T502","plan":"Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI or model-training clause found in the privacy policy, security page, compliance FAQ or DPA.","status":"not_published","url":"https://www.cognism.com/security","locator":"Looked in security page, compliance FAQ, privacy policy, DPA (v2 July 2026)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://www.cognism.com/security","locator":"Looked in security page, compliance FAQ, privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated as a plan option; no setting or request process to choose EU storage found.","status":"not_published","url":"https://www.cognism.com/security","locator":"Looked in security page, compliance FAQ, privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Mainly Ireland: the DPA says Cognism's production infrastructure is on AWS, primarily in the eu-west-1 region (Ireland). Cognism also says it generally keeps collected data inside the EEA.","status":"verified","url":"https://www.cognism.com/hubfs/customer-terms-DPA.pdf","locator":"DPA Annex 2, physical and environmental security (hosting)","url2":"https://www.cognism.com/compliance","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Infrastructure is primarily deployed in eu-west-1 region (Ireland)"},{"key":"dpa","value":"Yes. A public Data Processing Addendum (v2, July 2026) applies to the services agreement between Cognism and the customer.","status":"verified","url":"https://www.cognism.com/hubfs/customer-terms-DPA.pdf","locator":"DPA section 1 Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) sets forth the terms and conditions relating to the privacy, confidentiality"},{"key":"subprocessor_list","value":"A list is referenced in the DPA ('as listed here') but the link target could not be read; count unknown.","status":"not_captured","url":"https://www.cognism.com/hubfs/customer-terms-DPA.pdf","locator":"DPA Annex 1, Approved Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Cognism Limited, London)","status":"verified","url":"https://www.cognism.com/en/privacy-policy","locator":"Privacy policy, company details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cognism Limited, C/O Worldwide Corporate Advisors, 30–34 New Bridge Street, London EC4V 6BJ, United Kingdom"},{"key":"data_retention","value":"No fixed retention period: customer data is kept only as long as necessary. Under the DPA, within 30 days after the agreement ends Cognism stops processing and, on the customer's written request, deletes or returns it.","status":"verified","url":"https://www.cognism.com/hubfs/customer-terms-DPA.pdf","locator":"DPA section 4.5 Data Deletion","url2":"https://www.cognism.com/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Within thirty (30) days following the termination or expiry of the Agreement, Cognism shall cease"},{"key":"certifications","value":"ISO 27001, ISO 27701 and SOC 2 Type II (security and availability): 3.","status":"verified","url":"https://www.cognism.com/security","locator":"Certifications, Regulations and Standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cognism holds the following certifications and attestations: ISO 27001 ISO 27701 SOC 2 Type II (Security and Availability)"},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features found.","status":"not_published","url":"https://www.cognism.com/pricing","locator":"Looked in pricing page, security page, compliance FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: the pricing page lists Standard (5 seats included) and Pro with 'talk to sales' and no amounts.","status":"not_published","url":"https://www.cognism.com/pricing","locator":"How Cognism pricing works, Standard and Pro cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"comet","name":"Comet","vendor":"Perplexity AI, Inc.","category":"research-forms-and-storage","plans":[{"id":"T644","plan":"Perplexity Enterprise Pro","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for what staff enter in Comet's assistant: the Enterprise Terms bar training on Customer Content. Browsing data falls under separate Browser Terms that do not mention training, and Perplexity's Comet privacy notice lists improving its AI models among its general data uses.","status":"verified","url":"https://www.perplexity.ai/hub/legal/enterprise-terms-of-service","locator":"1.3.3 Model Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Perplexity shall not use (or authorize third parties to use) Customer Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models."},{"key":"training_opt_out","value":"Nothing to do: Perplexity states it does not train on enterprise customer content, and its agreements with AI providers prohibit them from training on it.","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11187708-data-retention-and-privacy-for-enterprise-organizations-and-users","locator":"Model training and third parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise data is never used to train or fine-tune Perplexity’s models, and our agreements with third-party AI providers prohibit them from training on your data."},{"key":"eu_residency_option","value":"Not stated: no EU storage option is described on the pages read. The DPA covers transfers outside the EU with standard contractual clauses.","status":"not_published","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"11. Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: neither the DPA nor the help articles read name a storage country or region.","status":"not_published","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"Pages checked: DPA, Enterprise Terms, data-retention help article, Enterprise Security Hub Settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The Enterprise Terms incorporate Perplexity's Data Processing Addendum by reference (part of the terms, with EU standard contractual clauses).","status":"verified","url":"https://www.perplexity.ai/hub/legal/enterprise-terms-of-service","locator":"5.1 Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Agreement incorporates by reference Perplexity’s Data Processing Addendum (“DPA”), available at https://www.perplexity.ai/hub/legal/dpa."},{"key":"subprocessor_list","value":"A public list exists at https://trust.perplexity.ai/subprocessors (named in the DPA), but the page needs a browser; count and AI providers not captured.","status":"not_captured","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"6. Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Perplexity AI; EU-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Perplexity AI'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Input is stored until the customer deletes it or 30 days after the service ends; uploaded files are deleted after 7 days; admins can enforce Incognito Mode (sessions kept 24 hours) or set retention windows.","status":"verified","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"Annex 1, categories of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"will be stored until the earlier of (a) the date it is deleted by Customer through the Services’ interface and (b) the date that is thirty days after Perplexity is no longer providing the Services"},{"key":"certifications","value":"SOC 2 Type II (1 certification named on the Enterprise page); the page also calls Perplexity GDPR and HIPAA compliant. Full list sits on the Trust Center (needs a browser).","status":"vendor_statement","url":"https://www.perplexity.ai/enterprise","locator":"Keep your company’s data airtight","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type II Certified"},{"key":"admin_ai_controls","value":"Yes. Admins set which AI models and providers are used, and manage permissions by product, under Organization Settings > Data and privacy.","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11187708-data-retention-and-privacy-for-enterprise-organizations-and-users","locator":"Admin controls for Enterprise organizations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Retention (including Enforce Incognito Mode), AI Model & Provider Settings, and Audit Log Settings live in a dedicated Data and privacy section under Organization Settings."},{"key":"price_eur","value":"Not captured: the Enterprise pricing tab loads with JavaScript and shows no seat price without a browser.","status":"not_captured","url":"https://www.perplexity.ai/enterprise/pricing","locator":"Enterprise tab","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"confluence","name":"Confluence","vendor":"Atlassian Pty Ltd","category":"workspace-and-projects","plans":[{"id":"T476","plan":"Premium","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for metadata only: Premium always contributes de-identified, aggregated usage metadata (e.g. common search terms, Rovo prompt topics), used to train Atlassian's search models; no opt-out. Page content (in-app data) is Off unless an admin switches it On. AI providers do not train.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/","locator":"Data contribution settings, Default data contribution settings table, Premium row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Premium Metadata contribution: Is always contributed In-app data contribution: Off"},{"key":"training_opt_out","value":"In-app content: nothing to do on Premium, it is Off by default (Atlassian Administration > Security > Data contribution to change). Metadata: no opt-out on Premium; only Enterprise plans can switch metadata contribution off.","status":"verified","url":"https://www.atlassian.com/trust/ai/data-contribution/faqs","locator":"Data contribution FAQ, 'Can I adjust data contribution for metadata?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If your Atlassian organization’s highest active plan is Free, Standard, or Premium, metadata contribution is always on, and you’re not able to opt-out."},{"key":"eu_residency_option","value":"Yes. Premium is covered: an organisation admin can pin Confluence data to Europe (Frankfurt and Dublin regions) or the US via data residency. In-app data contributions follow the setting, but de-identified aggregated data is not covered.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Understand data residency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can choose whether the data is hosted in a defined geographic location, such as Europe or the US."},{"key":"default_data_location","value":"Global: by default Atlassian apps are hosted across all Atlassian AWS regions, and data moves between regions as needed. Hosting provider is Amazon Web Services.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Understand data residency, default location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, all Atlassian apps are hosted in the Global location, which includes all of our AWS regions."},{"key":"dpa","value":"Yes. The Atlassian DPA supplements the Customer Agreement and applies automatically; EU Standard Contractual Clauses are included and effective without signing (a pre-signed copy can be downloaded).","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"DPA FAQ, 'Why can't Atlassian use my organization's DPA?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The EU SCCs are incorporated by reference into the DPA and are effective automatically. It is not necessary to sign them."},{"key":"subprocessor_list","value":"Yes, public: https://www.atlassian.com/legal/sub-processors . 29 named third-party entries (25 distinct companies; several repeat per product) plus 15 Atlassian Group entities and 5 Government Cloud rows. AI providers: AWS Bedrock, Google Vertex AI, OpenAI, Databricks.","status":"verified","url":"https://www.atlassian.com/legal/sub-processors","locator":"Atlassian Sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Atlassian uses the third-party entities listed below"},{"key":"dpf_status","value":"Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Atlassian'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer can delete content in the product. After the agreement ends Atlassian deletes personal data per its documentation but may keep copies in standard backups; no fixed number of days found. Rovo AI providers keep no inputs or outputs.","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"DPA, 6.2 Post Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data."},{"key":"certifications","value":"At least 3 named on readable pages: ISO/IEC 27001:2022, ISO/IEC 27018 and SOC 2. The full Compliance Resource Center list is script-driven and was not readable.","status":"verified","url":"https://www.atlassian.com/trust/compliance/resources/iso27001","locator":"ISO/IEC 27001:2022 page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO/IEC 27018 establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information"},{"key":"admin_ai_controls","value":"Yes. An organisation admin can block Rovo AI features per app (including Confluence): Atlassian Administration > AI and Rovo > Access > Add app > Block access. Available on Standard, Premium and Enterprise.","status":"verified","url":"https://support.atlassian.com/organization-administration/docs/deactivate-ai-in-apps/","locator":"Manage Rovo access, Block apps from Rovo features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Blocking an app will disable all current and upcoming AI features for that app."},{"key":"price_eur","value":"Not captured: the Confluence pricing page is a JavaScript page that returns an empty shell to non-browser fetch.","status":"not_captured","url":"https://www.atlassian.com/software/confluence/pricing","locator":"Confluence pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"atlassian-rovo","name":"Confluence with Rovo","vendor":"Atlassian","category":"workspace-and-projects","plans":[{"id":"T14","plan":"Standard","tier":"business","price":{"label":"$5.78 / user / mo","amount":5.78,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form, unless an admin acts. Since 17 Aug 2026, on Free and Standard plans Atlassian uses in-app data (page titles and content, comments and similar) by default, de-identified and aggregated, to improve its apps and AI for all customers, and retrains models on it; metadata, including common Rovo Chat prompt patterns, is always contributed. Third-party AI providers never train on customer data","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/","locator":"Table 'Default data contribution settings', row 'Free or Standard'","url2":"https://support.atlassian.com/security-and-access-policies/docs/what-types-of-data-does-my-organization-contribute/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"An organisation admin must act: Atlassian Administration > Security > Data contribution, set in-app data contribution to Off (or exclude apps or spaces). Metadata contribution cannot be switched off on Standard. After opting out, in-app data leaves the datasets within 30 days and affected models are retrained","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/","locator":"Intro ('navigate to Atlassian Administration, then Security, and then Data contribution') and defaults table","url2":"https://support.atlassian.com/security-and-access-policies/docs/what-types-of-data-does-my-organization-contribute/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes on Standard: pin to EU (Frankfurt and Dublin) or Germany; covers Rovo chat logs and agent configuration at rest; AI processing location not confirmed","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Plans, regions and Rovo section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Global: data may sit in any Atlassian AWS region unless pinned; Rovo sends data outside the site to third-party model providers by default","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Default location section","url2":"https://www.atlassian.com/trust/ai","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA (effective 17 Aug 2026) applies automatically with the Atlassian Customer Agreement; SCCs take effect automatically","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"FAQ and section 1.5","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 29 entries (25 companies) on Atlassian's list; 13 entries (11 companies) apply to Confluence Cloud, including AWS, Google Vertex AI and OpenAI; list effective 15 May 2026; 30 days' email notice","status":"verified","url":"https://www.atlassian.com/legal/sub-processors","locator":"Third-party table, 'Applicable Cloud Products'","url2":"https://www.atlassian.com/legal/data-processing-addendum","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Atlassian, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Atlassian'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period for Rovo chats is stated. Third-party AI providers keep no inputs or outputs (zero data retention); de-identified, aggregated contributed data may be kept for up to seven years","status":"not_published","url":"https://www.atlassian.com/trust/ai","locator":"FAQ on LLM providers and data residency","url2":"https://support.atlassian.com/security-and-access-policies/docs/what-types-of-data-does-my-organization-contribute/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Rovo has completed SOC 2 and ISO 27001; Atlassian's AI features join its annual compliance audit. Rovo can be used in HIPAA-enabled environments within stated limits","status":"verified","url":"https://www.atlassian.com/trust/ai","locator":"FAQ 'Is Rovo SOC 2 and ISO 27001 compliant?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. On Standard, Rovo is on for everyone by default; an organisation admin can choose which apps have Rovo features, or block Rovo for an app","status":"verified","url":"https://support.atlassian.com/organization-administration/docs/manage-rovo-access/","locator":"'Manage Rovo access' (Atlassian Cloud: Standard, Premium, Enterprise)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR on the German page: USD 5.78 per user/month (monthly billing)","status":"not_published","url":"https://www.atlassian.com/de/software/confluence/pricing","locator":"Standard card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"consensus","name":"Consensus","vendor":"Consensus NLP, Inc.","category":"research-forms-and-storage","plans":[{"id":"T621","plan":"Team","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The privacy policy says queries, content and personal information are never used to train AI models, Consensus's own or third parties'. The policy covers all users; no plan-specific statement.","status":"verified","url":"https://consensus.app/home/privacy-policy/","locator":"Use of Information Collected: what we will never do with your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train large language models. Your queries, content, and personal information are never used to train AI models"},{"key":"training_opt_out","value":"Nothing to do: the privacy policy states user content is never used to train AI models, ours or third parties'.","status":"verified","url":"https://consensus.app/home/privacy-policy/","locator":"Use of Information Collected: what we will never do with your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your queries, content, and personal information are never used to train AI models — neither our own nor those of any third party."},{"key":"eu_residency_option","value":"Not stated. The policy says all servers are in the United States and describes no EU region option.","status":"not_published","url":"https://consensus.app/home/privacy-policy/","locator":"Users located in countries other than the United States","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the privacy policy says all Consensus servers are located in the United States.","status":"verified","url":"https://consensus.app/home/privacy-policy/","locator":"Users located in countries other than the United States","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are headquartered in the United States of America and all our servers are located in the United States."},{"key":"dpa","value":"Not stated. No data processing agreement is mentioned in the privacy policy or terms of use.","status":"not_published","url":"https://consensus.app/home/privacy-policy/","locator":"Privacy policy and terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found. The privacy policy names four AI model providers it uses to process content: OpenAI, Anthropic, Google and Baseten.","status":"not_published","url":"https://consensus.app/home/privacy-policy/","locator":"How We Process Your Content to Deliver the Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Some of that processing runs on models operated by OpenAI, Anthropic, Google and Baseten, which act as our service providers for this purpose."},{"key":"dpf_status","value":"No listing found for search term 'Consensus NLP'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Consensus NLP' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as reasonably necessary, with no fixed period. Users can delete: Settings > 'Clear thread history' removes searches and conversations; 'Delete account' closes the account. Providers can keep content briefly under their own terms.","status":"verified","url":"https://consensus.app/home/privacy-policy/","locator":"Data Retention and Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Clear your search history. In Settings, “Clear thread history” deletes your searches and their associated conversations from Consensus."},{"key":"certifications","value":"Not stated. No security certification (SOC 2, ISO 27001 etc.) is named in the privacy policy, terms or organizations page.","status":"not_published","url":"https://consensus.app/home/privacy-policy/","locator":"Privacy policy security section; research-organizations page 'Safe, Secure and Enterprise-Ready AI'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. No organisation-wide setting to switch AI features off is described.","status":"not_published","url":"https://consensus.app/home/research-organizations/","locator":"Organisations page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page loads its plans with JavaScript, so no Team price could be read.","status":"not_captured","url":"https://consensus.app/pricing/","locator":"Pricing page, Team and Enterprise tab","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"copper-crm","name":"Copper","vendor":"Copper CRM, Inc.","category":"sales-marketing-and-support","plans":[{"id":"T496","plan":"Professional","tier":"business","price":{"label":"$69 / user / mo","amount":69,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for customer content. The privacy policy says only that data obtained through Google Workspace APIs is not retained to train generalized AI or ML models. Terms limit use of Customer Content to providing the service, support and analysis.","status":"not_published","url":"https://www.copper.com/privacy","locator":"Gmail integration / Google APIs section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our application does not retain user data obtained through Workspace APIs to develop, improve, or train generalized AI and/or ML models."},{"key":"training_opt_out","value":"Not stated: no training statement for customer content and no opt-out route on the pages read.","status":"not_published","url":"https://www.copper.com/privacy","locator":"Gmail integration / Google APIs section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No. Copper says it cannot store data in other locations.","status":"verified","url":"https://www.copper.com/privacy","locator":"Where is my data stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Copper is unable to accommodate requests to store data in other locations."},{"key":"default_data_location","value":"United States.","status":"verified","url":"https://www.copper.com/privacy","locator":"Where is my data stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The servers used to provide these hosting services are located in the United States."},{"key":"dpa","value":"Yes. The Data Protection Addendum is incorporated by reference into the terms and applies where customer content includes personal information.","status":"verified","url":"https://www.copper.com/terms","locator":"Data Protection Addendum (section 4.4)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The terms of the Data Protection Addendum (link) are incorporated by reference into this TOS and shall apply to the extent any Customer Content includes Personal Information"},{"key":"subprocessor_list","value":"Yes: the Copper help article 'Copper Sub-Processors' (last updated May 2026) lists 23 providers, including OpenAI, L.L.C. (USA) for generative AI services.","status":"verified","url":"https://support.copper.com/hc/en-us/articles/360001006747-Copper-Sub-Processors","locator":"Third Party Provider table (23 rows; last row OpenAI)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Loggly USA Product OpenAI, L.L.C. USA Generative AI services"},{"key":"dpf_status","value":"Active (Copper; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Copper CRM'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Retention and deletion periods are not stated on the terms or privacy pages; the terms say the Data Protection Addendum describes how Copper retains and deletes personal information.","status":"not_published","url":"https://www.copper.com/terms","locator":"Data Protection Addendum (section 4.4)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Copper’s Data Protection Addendum describes how Copper will process, retain and delete Personal Information on Customer’s behalf in connection with the Service."},{"key":"certifications","value":"None named: the security page and trust centre do not name SOC 2 or ISO 27001. The trust centre lists privacy frameworks (TRUSTe DPF verification, GDPR, CPRA, EU-US/UK/Swiss DPF, VCDPA, ColoPA, PIPEDA).","status":"not_published","url":"https://trust.copper.com/","locator":"Compliances section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated on the pages read.","status":"not_published","url":"https://www.copper.com/pricing","locator":"Plan features and AI email tools","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Professional is $69 per seat/month.","status":"not_published","url":"https://www.copper.com/pricing","locator":"Plan cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"copy-ai","name":"Copy.ai","vendor":"CopyAI, Inc.","category":"assistants","plans":[{"id":"T314","plan":"Chat","tier":"business","price":{"label":"$29 / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Vendor statement only: the security page says it does not train on your data. The Terms do not mention training and grant a broad licence to use content to operate and improve services.","status":"vendor_statement","url":"https://www.copy.ai/security","locator":"We don't train on your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We value your trust, ensuring our models are trained without utilizing your individual data."},{"key":"training_opt_out","value":"Nothing to do according to the vendor, which says it does not train on your data. No setting or email is described.","status":"vendor_statement","url":"https://www.copy.ai/security","locator":"We don't train on your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We value your trust, ensuring our models are trained without utilizing your individual data."},{"key":"eu_residency_option","value":"Not stated; no setting to keep data only in the EU.","status":"not_published","url":"https://www.copy.ai/privacy-notice","locator":"Looked at privacy notice, terms, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States and European Union, no per-customer region stated.","status":"verified","url":"https://www.copy.ai/privacy-notice","locator":"Summary list, Cross-border data transfer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We use cloud-based services to store and process data in the United States and European Union and will store data at additional sites, at our discretion"},{"key":"dpa","value":"Not published; no DPA found on the public pages.","status":"not_published","url":"https://www.copy.ai/privacy-notice","locator":"Looked at terms-of-service, privacy-notice, security; /dpa returned 404; trust.copy.ai needs a browser","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found. The pricing page says Chat gives access to OpenAI, Anthropic and Gemini models.","status":"not_published","url":"https://www.copy.ai/prices","locator":"Looked at privacy notice, terms, security; /subprocessors returned 404; trust.copy.ai needs a browser","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'CopyAI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'CopyAI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated. The privacy notice says different data types are kept for different periods depending on purpose and legal duties.","status":"not_published","url":"https://www.copy.ai/privacy-notice","locator":"Data retention and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 (1 named; report available on request, type not stated). No ISO certificate named.","status":"verified","url":"https://www.copy.ai/security","locator":"More on Copy.ai security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Request our complete SOC 2 report, or speak with our sales team to learn more about the security and reliability of the Copy.ai Platform."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features found.","status":"not_published","url":"https://www.copy.ai/prices","locator":"Looked at pricing, security, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $29 per month billed monthly, or $24 per month billed $288 per year. Includes 5 seats.","status":"not_published","url":"https://www.copy.ai/prices","locator":"Self-Serve > Chat plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"craft","name":"Craft","vendor":"Craft Docs Limited","category":"workspace-and-projects","plans":[{"id":"T462","plan":"Team","tier":"business","price":{"label":"€50 / mo","amount":50,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Craft's Terms say it does not use your content, and does not let its service providers or subprocessors use it, to train or improve AI or machine-learning models. The privacy policy says the same.","status":"verified","url":"https://www.craft.do/api/share/gMx9gRiCwcl2Sv","locator":"Terms of Service (craft.do/terms), AI features: No training on User Content","url2":"https://www.craft.do/api/share/vYJn32won9XDNR","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Craft does not use your User Content, and does not permit any of its service providers or subprocessors to use your User Content, to train, fine-tune, or otherwise improve any artificial intelligence or machine learning models"},{"key":"training_opt_out","value":"Nothing to do: Craft's Terms state it does not use your content, nor let its subprocessors use it, to train AI or machine-learning models.","status":"verified","url":"https://www.craft.do/api/share/gMx9gRiCwcl2Sv","locator":"Terms of Service (craft.do/terms), AI features: No training on User Content","url2":"https://www.craft.do/api/share/vYJn32won9XDNR","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Craft does not use your User Content, and does not permit any of its service providers or subprocessors to use your User Content, to train, fine-tune, or otherwise improve any artificial intelligence or machine learning models"},{"key":"eu_residency_option","value":"Not stated: No EU data-region option is described on the pricing, security or help pages; the privacy policy and terms could not be read.","status":"not_published","url":"https://www.craft.do/security","locator":"Security page, pricing page, help centre data-storage and AI pages, privacy policy, Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Craft's cloud servers run on Amazon Web Services (AWS). The country or region is not named; the privacy policy says data can be stored anywhere in the world, including the United States.","status":"verified","url":"https://support.craft.do/en/account-and-subscription/data-and-security/data-storage","locator":"Help centre: How Your Data Is Stored, Cloud Storage","url2":"https://www.craft.do/api/share/vYJn32won9XDNR","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All Craft documents are stored on secure cloud servers hosted on Amazon Web Services (AWS)"},{"key":"dpa","value":"Not stated: Craft's privacy policy, Terms of Service, security page and help-centre data pages do not mention a data processing agreement.","status":"not_published","url":"https://www.craft.do/api/share/vYJn32won9XDNR","locator":"Privacy policy (craft.do/privacy), Terms (craft.do/terms), security page, help data-storage page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not stated: no public sub-processor list found on the security, pricing, help, privacy or Terms pages. The Terms say subprocessors may not use content for AI training.","status":"not_published","url":"https://www.craft.do/security","locator":"Security page, pricing page, help centre, privacy policy, Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Craft Docs Limited, London)","status":"verified","url":"https://www.craft.do/api/share/gMx9gRiCwcl2Sv","locator":"Terms of Service, opening: company details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Craft Docs Limited is a limited company, registered in England."},{"key":"data_retention","value":"Documents stay until you delete them; deleted documents sit in Recently Deleted for 30 days, then are removed. Version history is kept 180 days on Team. Deleting an account is permanent; backup retention is only described as a limited operational period.","status":"verified","url":"https://support.craft.do/en/account-and-subscription/data-and-security/data-storage","locator":"Help centre: How Your Data Is Stored, Data Retention table","url2":"https://support.craft.do/en/introduction/account-setup/delete-account","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deleted documents move to Recently Deleted, where they can be restored before permanent deletion."},{"key":"certifications","value":"SOC 2 is named (report type not stated); the security page also says it has third-party audits and lists GDPR compliance. 1 named certification.","status":"verified","url":"https://www.craft.do/security","locator":"Security and Privacy page, headings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Vendor Management ### SOC 2 Certification ### GDPR Compliance"},{"key":"admin_ai_controls","value":"Yes, partly: the Assistant can be turned off per Space in Settings. Who may change it (any member or only owners) is not stated.","status":"verified","url":"https://support.craft.do/en/ai-assistant","locator":"AI Assistant help page, FAQ","url2":"https://support.craft.do/en/ai-assistant/using","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes. You can turn it off per Space in Settings."},{"key":"price_eur","value":"€50 per month for a fixed bundle of up to 10 accounts (Team plan, monthly price shown; no per-user price). Yearly price and VAT treatment not shown.","status":"verified","url":"https://www.craft.do/pricing","locator":"Pricing, Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€50.0 /month Fixed-price with up to 10 Plus accounts in a single subscription."}]}]},{"slug":"crisp","name":"Crisp","vendor":"Crisp IM SAS, Nantes (France)","category":"phone-and-voice","plans":[{"id":"T436","plan":"Essentials","tier":"business","price":{"label":"$95 / mo","amount":95,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Crisp does not use customer data, AI inputs or AI outputs to train or fine-tune its AI models unless agreed in writing.","status":"verified","url":"https://crisp.chat/en/terms/","locator":"AI terms, Crisp Data access","url2":"https://crisp.chat/en/privacy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Except as expressly agreed in writing, Crisp does not use Customer Data, AI Inputs, or AI Outputs to train or fine-tune the Crisp's artificial intelligence models."},{"key":"training_opt_out","value":"Nothing to do: the terms say Crisp does not train on customer data.","status":"verified","url":"https://crisp.chat/en/terms/","locator":"AI terms, Crisp Data access","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Except as expressly agreed in writing, Crisp does not use Customer Data, AI Inputs, or AI Outputs to train or fine-tune the Crisp's artificial intelligence models."},{"key":"eu_residency_option","value":"EU hosting is the default for all plans; no setting needed. Optional third-party AI providers (OpenAI, Gemini, Anthropic) process in the US if you switch them on.","status":"verified","url":"https://crisp.chat/en/sub-processors/","locator":"Sub-processor table notes","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The third-party LLM providers listed below are entirely optional: they are disabled by default and used only when explicitly enabled by the Customer."},{"key":"default_data_location","value":"EU: main servers in the Netherlands and Germany (DigitalOcean), encrypted backups in Ireland (AWS), AI features on Crisp's own infrastructure at Scaleway in France.","status":"verified","url":"https://crisp.chat/en/sub-processors/","locator":"Sub-processor table","url2":"https://crisp.chat/en/privacy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Crisp's AI features run on Crisp's own in-house AI infrastructure, hosted in the EU (Scaleway)"},{"key":"dpa","value":"Yes. The Data Processing Agreement is part of the Agreement (the general terms) and can be downloaded from inside the Crisp account.","status":"verified","url":"https://crisp.chat/en/terms/","locator":"Section 1 Agreement","url2":"https://crisp.chat/en/privacy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"and the Data Processing Agreement (\"DPA\") and its Annexes."},{"key":"subprocessor_list","value":"Public list at https://crisp.chat/en/sub-processors/ (updated 15 July 2026): 13 entries. AI and model providers: OpenAI, Gemini, Anthropic, Mistral (all optional, off by default), Microsoft Azure (optional translation and AI processing), Crisp's own AI on Scaleway.","status":"verified","url":"https://crisp.chat/en/sub-processors/","locator":"Page body","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Crisp is based in France and makes use of the following sub-Processors:"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Crisp IM SAS, Nantes, France)","status":"verified","url":"https://crisp.chat/en/terms/","locator":"Contact block","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"CRISP IM SAS 2 Boulevard de Launay 44100 Nantes, France"},{"key":"data_retention","value":"Essentials keeps data without a time limit while the workspace exists. Deleting a workspace irreversibly deletes all its data; Crisp deletes account and customer data on request; accounts inactive for 12 months get a deletion notice. System logs are kept up to 1 year.","status":"verified","url":"https://crisp.chat/en/privacy/","locator":"How long do we retain your data","url2":"https://crisp.chat/en/pricing/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We delete your account and all related customer data upon your request."},{"key":"certifications","value":"Not stated. No ISO 27001, SOC 2 or similar certification found on the security practices page, privacy policy or terms.","status":"not_published","url":"https://docs.crisp.chat/guides/others/security-practices/","locator":"Looked in security practices, privacy policy, terms, sub-processor page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes in practice: Hugo AI is enabled per workspace, and third-party LLM providers are disabled by default and only used when the customer enables them.","status":"verified","url":"https://crisp.chat/en/sub-processors/","locator":"Sub-processor table notes","url2":"https://crisp.chat/en/terms/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"they are disabled by default and used only when explicitly enabled by the Customer."},{"key":"price_eur","value":"Shown in USD only: $95 per month per workspace (Essentials, 10 seats included, $25 included AI credits)","status":"not_published","url":"https://crisp.chat/en/pricing/","locator":"Essentials card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"cursor","name":"Cursor","vendor":"Anysphere (Cursor)","category":"code-and-app-builders","plans":[{"id":"T83","plan":"Teams","tier":"business","price":{"label":"From $30 / user / mo","amount":30,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Depends on Privacy Mode: with it off, Cursor may store and use code, prompts and editor actions to train its models; with it on, nothing is trained. A team admin can turn it on for everyone; whether new Teams start with it on is not stated","status":"verified","url":"https://cursor.com/data-use","locator":"Data Use & Privacy Overview (updated 3 Sep 2026)","url2":"https://cursor.com/security","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Turn on Privacy Mode in settings, or have a team admin enable it for the whole team; new members inherit the team setting","status":"verified","url":"https://cursor.com/security","locator":"Section 'Privacy Mode'","url2":"https://cursor.com/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://cursor.com/security","locator":"Security page (full text)","url2":"https://trust.cursor.com/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: infrastructure is mainly on AWS in the US, with some latency-critical services in Europe and Singapore","status":"verified","url":"https://trust.cursor.com/","locator":"Subprocessor note for Amazon Web Services","url2":"https://cursor.com/security","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. A Cursor DPA is offered in the Trust Center documents","status":"verified","url":"https://trust.cursor.com/","locator":"Documents list ('Cursor DPA')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 20 entries; inference by OpenAI, Anthropic, Google Gemini, Fireworks, Databricks, Baseten, Together, SpaceXAI (xAI), Meta, Nebius, TypeSafe AI and CoreWeave; hosting on AWS, Azure and Google Cloud","status":"verified","url":"https://trust.cursor.com/subprocessors","locator":"Subprocessors list ('20 results')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Anysphere'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Anysphere' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"With Privacy Mode on, file contents are cached only during a request and model providers keep nothing (zero data retention); otherwise Cursor keeps data as long as needed for the service; prompts flagged by abuse detectors may be stored for investigation","status":"verified","url":"https://cursor.com/data-use","locator":"Data Use & Privacy Overview","url2":"https://cursor.com/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and AIUC-1","status":"verified","url":"https://cursor.com/security","locator":"Certifications sentence (page updated 25 Aug 2026)","url2":"https://trust.cursor.com/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Teams has team-wide privacy settings, centralised billing and administration, and SAML/OIDC SSO","status":"verified","url":"https://cursor.com/pricing","locator":"Comparison rows 'Team-wide privacy settings', 'Centralized billing and administration', 'SAML/OIDC SSO'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: from USD 30 per user/month, excluding VAT and third-party model usage","status":"not_published","url":"https://cursor.com/pricing","locator":"Plan list 'Teams $30+/user/month' and tax note","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"customer-io","name":"Customer.io","vendor":"Peaberry Software, Inc. d/b/a Customer.io","category":"sales-marketing-and-support","plans":[{"id":"T517","plan":"Essentials","tier":"business","price":{"label":"$100 / mo","amount":100,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Customer.io itself. Its terms say its third-party AI providers are contractually prohibited from using inputs or outputs to train their foundation models, and that data is processed solely to deliver the requested AI feature.","status":"verified","url":"https://customer.io/legal/feature-terms","locator":"4. AI Features and Credits","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer.io's third-party AI providers are contractually prohibited from using your inputs or outputs to train their foundation models."},{"key":"training_opt_out","value":"Nothing to do for providers (they may not train). Separately, an admin can switch off Customer.io AI under Privacy, Data, & AI settings, after which no data goes to AI providers.","status":"verified","url":"https://customer.io/legal/feature-terms","locator":"4. AI Features and Credits, Opt-Out","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you may disable AI Features for your account at any time through your Privacy, Data, & AI settings."},{"key":"eu_residency_option","value":"Yes: EU data centres are available; data can be ingested, processed and stored in the chosen region. Plan eligibility is not stated.","status":"verified","url":"https://customer.io/security","locator":"Regional infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"With our US and EU data centers, you can ingest, process, and store your data in the region that meets all your business and legal requirements."},{"key":"default_data_location","value":"Not stated as a single default; customers choose between US and EU data centres (security page). Hosting is on AWS and Google Cloud.","status":"not_published","url":"https://customer.io/security","locator":"Regional infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, published DPA is part of the agreement and applies to personal data processing; it can be downloaded and co-executed, and includes the EU Standard Contractual Clauses.","status":"verified","url":"https://customer.io/legal/terms-of-service","locator":"Agreement documents and order of precedence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer.io's Data Processing Addendum, solely with respect to the processing of Personal Data"},{"key":"subprocessor_list","value":"Yes, https://customer.io/legal/sub-processors (revised October 2026): 9 entries. AI providers: OpenAI, Google Cloud (Vertex AI), Anthropic (Claude).","status":"verified","url":"https://customer.io/legal/sub-processors","locator":"List of Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Below is a list of subprocessors we work with and the purpose for why we use their services."},{"key":"dpf_status","value":"Active (Peaberry Software Inc; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Peaberry Software'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data kept for the duration of the agreement; at the end the customer elects deletion after a chance to download, except data the law requires to be kept. No fixed day count and no AI-prompt retention period stated.","status":"verified","url":"https://customer.io/legal/dpa","locator":"7.6 Deletion and Return of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon termination or expiration of the Agreement, Customer.io will (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data"},{"key":"certifications","value":"1 certification stated: SOC 2 Type II. HIPAA compliance is claimed; ISO 27001 appears as a badge and FAQ heading but its status is not spelled out in the page text.","status":"verified","url":"https://customer.io/security","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our platform is HIPAA compliant and SOC 2 Type II certified."},{"key":"admin_ai_controls","value":"Yes: AI Features are on by default and can be disabled for the whole account at any time in Privacy, Data, & AI settings. Plan restrictions not stated.","status":"verified","url":"https://customer.io/legal/feature-terms","locator":"4. AI Features and Credits, Opt-Out","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"While AI Features are enabled by default within the CIO Platform, you may disable AI Features for your account at any time"},{"key":"price_eur","value":"Not published in euros. Shown in USD only: Essentials starts at $100 per month, billed monthly (price depends on number of profiles).","status":"not_published","url":"https://customer.io/pricing","locator":"Essentials plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"starts at$100/mo"}]}]},{"slug":"deel","name":"Deel","vendor":"Deel, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T594","plan":"Hire contractors","tier":"business","price":{"label":"$49 / mo","amount":49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, according to Deel's AI page: conversations and organisation data are never shared with learning models. This is a marketing-page statement; the binding AI Terms of Service could not be read.","status":"vendor_statement","url":"https://www.deel.com/hr-platform/ai/","locator":"FAQs: How does Deel AI protect my privacy?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deel AI ensures that your conversations and organization data are never shared with any learning models"},{"key":"training_opt_out","value":"Nothing to do, according to Deel's AI page: it says conversations and organisation data are never shared with learning models. No opt-out setting is described; binding AI Terms not read.","status":"vendor_statement","url":"https://www.deel.com/hr-platform/ai/","locator":"FAQs: How does Deel AI protect my privacy?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deel AI ensures that your conversations and organization data are never shared with any learning models"},{"key":"eu_residency_option","value":"Not captured: the DPA and privacy documents need a browser; the security page only states Ireland as primary location without describing a choice.","status":"not_captured","url":"https://www.deel.com/legal/data-processing-addendum/","locator":"DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Ireland (primary) with a disaster-recovery site in France, on AWS.","status":"vendor_statement","url":"https://www.deel.com/security","locator":"Data Infrastructure that’s secure, scalable, and reliable","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We leverage a fully AWS-hosted infrastructure, with primary operations in Ireland and a disaster recovery site in France"},{"key":"dpa","value":"Yes: Deel's legal hub lists a Data Processing Addendum and DPA FAQs among its privacy documents. The text of the DPA could not be read, so how it is concluded is not captured.","status":"vendor_statement","url":"https://www.deel.com/legal","locator":"Legal hub: Privacy at Deel","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Processing Addendum Deel Trust Center Privacy FAQ DPA FAQs"},{"key":"subprocessor_list","value":"Not captured: the Trust Center (trust.deel.com) and DPA load only in a browser.","status":"not_captured","url":"https://trust.deel.com/","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Deel, Inc.; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Deel'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not captured: retention and deletion periods sit in the privacy policy, DPA and platform terms, which load only in a browser.","status":"not_captured","url":"https://www.deel.com/legal/privacy-policy/","locator":"Privacy Policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1, SOC 2, SOC 3 and ISO 27001 (4 named); GDPR compliance and AES-256 encryption also listed.","status":"verified","url":"https://www.deel.com/security","locator":"We meet the top global standards for data security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"An ISO 27001 certification means Deel has put in place systems to manage risks related to the security of data"},{"key":"admin_ai_controls","value":"Not captured: the AI product page says nothing about an admin switch for Deel AI, and the AI Terms of Service need a browser.","status":"not_captured","url":"https://www.deel.com/legal/ai-terms-of-service/","locator":"AI Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $49 per contractor per month (Hire contractors); no EUR price or VAT shown. Other products priced separately (e.g. $14 per worker per month Find talent, $599 per EOR employee per month).","status":"not_published","url":"https://www.deel.com/pricing","locator":"Hire contractors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"deepl","name":"DeepL","vendor":"DeepL","category":"writing-and-email","plans":[{"id":"T07","plan":"Pro Team","tier":"business","price":{"label":"€24.99 / user / mo","amount":24.99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. Pro texts are not stored permanently and not used to improve the service","status":"verified","url":"https://www.deepl.com/en/privacy","locator":"Section 4 (policy 'Last update: October 2026')","url2":"https://support.deepl.com/hc/en-us/articles/26380849099932-DeepL-infrastructure-and-data-protection","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: texts submitted under DeepL Pro are not used to improve DeepL's services","status":"verified","url":"https://www.deepl.com/en/privacy","locator":"Section 4 'Texts and Improvements – DeepL Translator Pro / DeepL API Pro / DeepL Write Pro'","url2":"https://www.deepl.com/en/pro-data-security","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Add-on for sales-assisted Team, Business and API-for-Business customers (not purchasable online); included in Enterprise; one region per organisation (EU, US or JP)","status":"verified","url":"https://support.deepl.com/hc/en-us/articles/26380849099932-DeepL-infrastructure-and-data-protection","locator":"Section 'Your options during DeepL's transition to AWS (2026)'","url2":"https://trust.deepl.com","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"No fixed country: the DeepL Pro licence terms let DeepL decide where business content is processed, on its own servers or third-party cloud providers, depending partly on where the customer is.","status":"verified","url":"https://www.deepl.com/en/pro-license","locator":"3.1.3 (Services and data processing)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"DeepL has the right to determine the location of data processing. The location of the data processing may depend, among other things, on the location of the customer or its Internal Users"},{"key":"dpa","value":"Yes, on request. Pro terms (section 8.1.4) provide for a DPA; customers email privacy@deepl.com. Trust Center lists a DPA document","status":"verified","url":"https://www.deepl.com/en/privacy","locator":"Section 4","url2":"https://trust.deepl.com","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No consolidated public list found. Privacy policy names providers inline (e.g. Stripe, Cloudflare, Zendesk, Zoom); AWS added as sub-processor in 2026","status":"not_published","url":"https://www.deepl.com/en/privacy","locator":"Sections 9, 24.7","url2":"https://trust.deepl.com","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, headquartered in Germany)","status":"verified","url":"https://support.deepl.com/hc/en-us/articles/26380849099932-DeepL-infrastructure-and-data-protection","locator":"Section 'Legal framework'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Texts and documents are kept only while the translation is produced and delivered, then deleted. Account and billing data are kept for the contract term and legal retention periods","status":"verified","url":"https://www.deepl.com/en/privacy","locator":"Section 4 (Pro texts) and section 6 (Pro subscription data)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"BSI C5 Type 2, ISO/IEC 27001:2022 and SOC 2 Type 2; HIPAA listed in the Trust Center","status":"verified","url":"https://trust.deepl.com/","locator":"Trust Center compliance tiles and the C5/SOC 2 announcement","url2":"https://www.deepl.com/en/pro","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Limited. Team includes team administration from 2 users and SSO from 50 users; no organisation-wide switch for individual AI features is described for Team. Write Pro is a separate paid add-on","status":"verified","url":"https://www.deepl.com/en/pro","locator":"Plan comparison, 'Admin and control' rows; 'Write Pro add-on' section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 24.99 per user/month billed annually, incl. VAT (Germany)","status":"verified","url":"https://www.deepl.com/de/pro","locator":"Translator tab, Team card","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"deepseek","name":"DeepSeek","vendor":"DeepSeek","category":"assistants","plans":[{"id":"T48","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: DeepSeek uses personal data to train and improve its models and gives users a right to opt out; inputs are de-identified before use","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Section on how personal data is used; rights section ('the right to opt-out of using your Personal Data for training our models')","url2":"https://cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not described. DeepSeek states a right to opt out of training and says users can opt out of data use for training, but publishes no menu path; requests go to privacy@deepseek.com","status":"not_published","url":"https://cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html","locator":"Closing section on user rights","url2":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Section 'Where We Store Your Personal Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"China: DeepSeek collects, processes and stores personal data in the People's Republic of China","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Section 'Where We Store Your Personal Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. DeepSeek is the controller under its consumer terms; no DPA or business terms are offered for the chat service","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"'Data Controller' paragraph (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list. The privacy policy names categories of service providers and corporate group entities, including for storage and model training","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Section on sharing with service providers and corporate group","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (vendor in China; the DPF covers US organisations). Search 'DeepSeek' returned no results","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'DeepSeek'","url2":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: data is kept as long as needed for the service and other purposes, including improving and developing the service; users can delete their chat history","status":"not_published","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Section 'How Long Do We Keep Your Personal Data'","url2":"https://cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed","status":"not_published","url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","locator":"Privacy policy and model disclosure (full text)","url2":"https://cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: there is no organisation account","status":"verified","url":"https://cdn.deepseek.com/policies/en-US/deepseek-terms-of-use.html","locator":"Terms of Use (individual accounts only)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"No price published for the chat service: deepseek.com links straight to chat and lists pricing only for the API","status":"not_published","url":"https://www.deepseek.com/en","locator":"Site navigation ('Chat with DeepSeek', 'API Pricing')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"descript","name":"Descript","vendor":"Descript, Inc.","category":"meetings-and-notes","plans":[{"id":"T385","plan":"Business","tier":"business","price":{"label":"$50 / user / mo","amount":50,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the customer opts out: the Terms allow Descript to use inputs and outputs of its AI tools to train its models; opt out under App Settings > Profile > Share data with Descript. Enterprise drives have sharing disabled.","status":"verified","url":"https://www.descript.com/terms","locator":"8.4 Generated Output (e)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"This includes use by Descript to train, improve, and develop its models and technologies (unless you have opted out of such use)"},{"key":"training_opt_out","value":"Switch off \"Share data with Descript\": App Settings (Cmd/Ctrl + comma) > Profile tab > Share data with Descript > click Allowed to toggle it off. Enterprise drives have no toggle; sharing is disabled by default there","status":"verified","url":"https://help.descript.com/account-and-app-settings/data-privacy.md","locator":"Disabling data sharing; intro","url2":"https://www.descript.com/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise drives do not have the option to toggle data sharing, which is disabled by default."},{"key":"eu_residency_option","value":"Not stated: no EU storage option is described in the pages read","status":"not_published","url":"https://www.descript.com/subprocessors","locator":"Looked at security, privacy, subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the subprocessor list shows Data Region US for AWS and Google Cloud, Descript's hosting providers","status":"verified","url":"https://www.descript.com/subprocessors","locator":"Data Region column","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Here’s a list of subprocessors we work with, and the teams that use their services."},{"key":"dpa","value":"Not stated: no customer DPA found in the terms, privacy policy or security page; the security page says Descript's own suppliers sign data processing agreements","status":"not_published","url":"https://www.descript.com/security","locator":"Looked at terms, privacy, security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes, public list at descript.com/subprocessors: 49 rows, 46 distinct companies; AI-related include OpenAI API, Anthropic API, OpenRouter, Hugging Face, Baseten, ElevenLabs, Braintrust","status":"verified","url":"https://www.descript.com/subprocessors","locator":"Descript Data Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Here’s a list of subprocessors we work with, and the teams that use their services."},{"key":"dpf_status","value":"No listing found for search term 'Descript'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Descript' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Deleting a project removes it from servers within 30 days; deleting the user account permanently deletes all its data","status":"verified","url":"https://www.descript.com/security","locator":"Data deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you delete a project from Descript, we delete it permanently from our servers within 30 days."},{"key":"certifications","value":"1 named: SOC 2 Type II","status":"verified","url":"https://www.descript.com/security","locator":"SOC 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have achieved SOC 2 Type II compliance by going through a Certified Public Accounting firm"},{"key":"admin_ai_controls","value":"Not stated for Business: 'AI and data controls' are listed under Enterprise only","status":"not_published","url":"https://www.descript.com/pricing","locator":"Enterprise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $50 per person per month billed annually ($65 on monthly billing); team of up to 5 billed separately","status":"not_published","url":"https://www.descript.com/pricing","locator":"Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"dia-browser","name":"Dia","vendor":"The Browser Company of New York, Inc. (Dia)","category":"research-forms-and-storage","plans":[{"id":"T645","plan":"Better Answers","tier":"personal","price":{"label":"$10 / mo","amount":10,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless you opt out: the Terms of Use license lets Dia use your content and outputs to develop and improve Dia, including to train its models. Opt-out is in Settings > Privacy. Its AI partners are contractually barred from training.","status":"verified","url":"https://diabrowser.com/termsofuse","locator":"User Content licence","url2":"https://diabrowser.com/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"to enable Browser to provide, maintain, develop and improve Dia, including to train our models. If you want to opt-out from our use of your User Content to train our models, you may do so in the privacy section of your account settings."},{"key":"training_opt_out","value":"Settings > Privacy > 'Share content data to help improve Dia' (switch it off). Organizations can disable content sharing for everyone.","status":"verified","url":"https://diabrowser.com/security","locator":"FAQ: Which AI models do you use","url2":"https://diabrowser.com/termsofuse","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can disable this by going to Settings → Privacy → Share content data to help improve Dia."},{"key":"eu_residency_option","value":"Not stated: Dia says it is hosted in the US and no EU region option appears on the pages read.","status":"not_published","url":"https://diabrowser.com/privacy","locator":"Pages checked: privacy, security, forwork, plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Dia is hosted and operated in the US; chats, history and files are encrypted and stored locally on the device by default.","status":"verified","url":"https://diabrowser.com/privacy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dia is hosted and operated in the United States (“U.S.”) through The Browser Company and its service providers."},{"key":"dpa","value":"Not stated for this plan; Enterprise security and privacy features are by contact. The privacy policy mentions only a data processing agreement with standard clauses for transfers to the US.","status":"not_published","url":"https://diabrowser.com/privacy","locator":"International data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A Trust Center exists at https://trust.diabrowser.com/ but needs a browser; the security page names AI partners Anthropic, OpenAI, Gemini, Azure and AWS. Count not captured.","status":"not_captured","url":"https://diabrowser.com/security","locator":"FAQ: Is my data used for training?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Browser Company'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Browser Company' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Shared content data is kept 30 days, not tied to the account, then deleted; deleting an account removes associated data within 30 days. Chats, files and history are stored locally and can be cleared by the user.","status":"verified","url":"https://diabrowser.com/security","locator":"FAQ: What if I want to delete my chats, files, or history?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you choose to share content data with Dia, it is not associated with your account and deleted from our servers after 30 days."},{"key":"certifications","value":"SOC 2 Type II (1 certification) covering security, confidentiality and privacy for calendar year 2025; report issued 2026. Not HIPAA-compliant.","status":"verified","url":"https://diabrowser.com/security","locator":"FAQ: Has Dia completed a SOC 2 Type II audit?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Browser Company completed a SOC 2 Type II examination for Dia covering security, confidentiality, and privacy for calendar year 2025."},{"key":"admin_ai_controls","value":"Yes, through device management: admins can disable AI features on specific websites and turn off content sharing for the whole organisation. Presented as For Work features; not tied to this self-serve plan.","status":"verified","url":"https://diabrowser.com/forwork","locator":"Does Dia offer AI security controls?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes. Dia supports MDM controls that let you disable all AI-powered features on specific websites."},{"key":"price_eur","value":"Shown in USD only: $10 per month on the Better Answers plan card (no EUR price, billing basis not stated on the card).","status":"not_published","url":"https://diabrowser.com/plans","locator":"Better Answers plan card","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Better Answers ($20/month) — Chat that digs across your tools, tabs, and docs to answer with full context."}]}]},{"slug":"dialpad-ai","name":"Dialpad Connect with Dialpad AI","vendor":"Dialpad, Inc.","category":"phone-and-voice","plans":[{"id":"T411","plan":"Standard","tier":"business","price":{"label":"$15 / user / mo","amount":15,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless training is switched off in Settings: Dialpad's AI guide says using Dialpad AI helps improve it with call audio and transcripts, and customers can opt out at any level.","status":"verified","url":"https://assets.ctfassets.net/r6vlh4dr9f5y/1fPEqvDRO5EMHRT2g4A3GM/1995f828d577b7dfe18dc9776fc8dd7c/Dialpad_Legal_Guide_-_Using_AI_in_Your_Business.pdf","locator":"Dialpad Ai: How data is used","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"models behind them being trained on how our users actually use our products. (Mainly using portions of aggregated audio and transcripts from actual calls.)"},{"key":"training_opt_out","value":"Use the AI training election in Settings (it can be set from one person up to the whole company), or ask your Dialpad support contact or privacy@dialpad.com. Turning Dialpad Ai off for a call also removes that call from training.","status":"verified","url":"https://assets.ctfassets.net/r6vlh4dr9f5y/1fPEqvDRO5EMHRT2g4A3GM/1995f828d577b7dfe18dc9776fc8dd7c/Dialpad_Legal_Guide_-_Using_AI_in_Your_Business.pdf","locator":"Dialpad Ai: How data is used","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Go to Settings, or contact your customer support representative or privacy@dialpad with questions."},{"key":"eu_residency_option","value":"Not stated: no EU region is named. The privacy policy says data is stored in the US unless a Dialpad admin has selected a different region, without saying which regions exist.","status":"not_published","url":"https://www.dialpad.com/legal/","locator":"Privacy policy: where is data stored; also looked at trust page, DPA, legal guide, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (Google Cloud Storage) by default, unless a Dialpad admin has selected a different region; Dialpad AI data used to improve the service is stored in the US on Google Cloud.","status":"verified","url":"https://www.dialpad.com/legal/","locator":"Privacy policy: where is data stored","url2":"https://assets.ctfassets.net/r6vlh4dr9f5y/1fPEqvDRO5EMHRT2g4A3GM/1995f828d577b7dfe18dc9776fc8dd7c/Dialpad_Legal_Guide_-_Using_AI_in_Your_Business.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"are stored in the United States via Google Cloud Storage unless your Dialpad Services Administrator has selected a different region."},{"key":"dpa","value":"Yes. Customers can sign Dialpad's Data Processing Agreement with one click.","status":"verified","url":"https://www.dialpad.com/trust/","locator":"GDPR","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dialpad customers can sign a Data Processing Agreement (DPA) that addresses GDPR and beyond."},{"key":"subprocessor_list","value":"Yes: a list is kept in Dialpad's Trust Center (linked from https://www.dialpad.com/subprocessors/), but the entries load by script, so the count and AI providers were not read.","status":"not_captured","url":"https://www.dialpad.com/subprocessors/","locator":"Our subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For Dialpad’s current list of subprocessors, please visit our Trust Center:"},{"key":"dpf_status","value":"Active (Dialpad; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Dialpad'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active; deleted automatically within 180 days after the account is closed. Customers can set a customizable retention policy that deletes data routinely.","status":"verified","url":"https://www.dialpad.com/legal/","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon closure of your account, Dialpad will automatically delete your data within 180 days of account termination."},{"key":"certifications","value":"4 named: SOC 2 Type II, ISO 27001:2022, ISO 27017:2015, ISO 27018:2019 (plus HIPAA-ready with a BAA).","status":"verified","url":"https://www.dialpad.com/trust/","locator":"Industry compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dialpad’s infrastructure and processes are annually certified against ISO 27001:2022 (Information security management), ISO 27017:2015 (Information Security in the cloud), and ISO 27018:2019 (PII for public cloud processors)."},{"key":"admin_ai_controls","value":"Yes: Dialpad AI access can be set at company and office level and down to individual employee phone numbers (per the vendor's AI guide; plan-level availability not stated).","status":"vendor_statement","url":"https://assets.ctfassets.net/r6vlh4dr9f5y/1fPEqvDRO5EMHRT2g4A3GM/1995f828d577b7dfe18dc9776fc8dd7c/Dialpad_Legal_Guide_-_Using_AI_in_Your_Business.pdf","locator":"Grant access to Dialpad Ai","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dialpad gives you the option of setting access to Dialpad Ai features at the company and office level and as granularly as by individual employee phone numbers."},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: $15 per user/month (Connect Standard; monthly/annual toggle on page, a EUR selector exists but is script-driven).","status":"not_published","url":"https://www.dialpad.com/pricing/","locator":"Dialpad Connect, Standard","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"docusign","name":"Docusign eSignature","vendor":"Docusign, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T106","plan":"Business Pro","tier":"business","price":{"label":"€38 / user / mo","amount":38,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for new buyers: customers who bought eSignature on the website on or after 8 Jul 2026 consent to Docusign training its AI on their data, anonymised and aggregated first; the account's AI data controls setting is on by default. Customers who bought before that date have not consented","status":"verified","url":"https://www.docusign.com/legal/terms-and-conditions/ai-attachment-docusign-services","locator":"Section 2 table 'Web Plan Customers and Users' and Section 4.1 (version date 8 Jul 2026)","url2":"https://support.docusign.com/s/document-item?language=en_US&bundleId=fzd1707173174972&topicId=dcs1708531444159.html&_LANG=enus","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Yes. Account administrators can turn off the AI data controls toggle under Admin > AI Control Settings; from then on Docusign stops ingesting the account's data, but data already anonymised for training is kept","status":"verified","url":"https://support.docusign.com/s/document-item?language=en_US&bundleId=fzd1707173174972&topicId=dcs1708531444159.html&_LANG=enus","locator":"Section 'Turn the AI data controls setting off or on' and FAQ 'What happens to my data if I turn the AI data controls setting off?' (last updated 21 Sep 2026)","url2":"https://www.docusign.com/legal/terms-and-conditions/ai-attachment-docusign-services","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Yes: Europe is one of Docusign's five data center regions and Agreement Data stays in the account's region; support staff in any Docusign company may see limited personal information, but not document contents","status":"verified","url":"https://www.docusign.com/trust/privacy/data-mgmt-privacy","locator":"Question 'Where is my data physically stored?'","url2":"https://www.docusign.com/trust/privacy/subprocessors-list","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Set by location: Agreement Data is stored in one of five data center regions (US, Canada, Europe, Australia, Japan), chosen automatically for web customers as the region closest to where the account is signed up","status":"verified","url":"https://www.docusign.com/trust/privacy/data-mgmt-privacy","locator":"Question 'Where is my data physically stored?' (last updated 14 Apr 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The web-plan Data Protection Attachment (version date 9 Jan 2025) is incorporated into and made part of the Terms","status":"verified","url":"https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment/web-plan","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 39 supplier rows for eSignature and its add-ons: hosting by 365 Data Centers, Centersquare, Equinix and Microsoft Azure, email by Amazon SES, AI by Microsoft Azure AI Services and Google Vertex AI, the rest for optional ID checks, SMS and other add-ons; plus 4 support suppliers and 18 Docusign companies","status":"verified","url":"https://assets.ctfassets.net/3fcisxc3a6xz/3DSEO8vllzkAoDIfW6ZIfp/599de7af141aa6452ffca74e0e6172db/Docusign_Services_Subprocessor_List.pdf","locator":"Section 'Docusign eSignature Service and Related Service Add-ons' (last updated 8 Oct 2026)","url2":"https://www.docusign.com/trust/privacy/subprocessors-list","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search terms 'DocuSign' and 'Docusign'; Docusign relies on Binding Corporate Rules approved by EU data protection authorities","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Searches 'DocuSign' and 'Docusign' returned no results","url2":"https://www.docusign.com/trust/compliance/certifications","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customers set envelope retention and can purge documents at any time (an audit log can be kept); on request before the Terms end, Docusign deletes personal data as soon as reasonably practicable. Anonymised AI training data is kept with no duty to delete","status":"verified","url":"https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment/web-plan","locator":"Section 'Destruction or Retrieval of Personal Data'","url2":"https://www.docusign.com/trust/privacy/data-mgmt-privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022, 27017:2015 and 27018:2019; SOC 1 Type II and SOC 2 Type II; PCI DSS 4.0; BSI C5 Type II (eSignature); FedRAMP; EU qualified trust service provider under eIDAS (Docusign France)","status":"verified","url":"https://www.docusign.com/trust/compliance/certifications","locator":"Page 'Docusign Global Certifications, Self-Assessments, and Standards'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: admins can switch off AI training (AI data controls); the switch for the AI assistant and agents is only for IAM plans in North America, so no AI features switch is documented for Business Pro in Europe","status":"verified","url":"https://support.docusign.com/s/document-item?bundleId=pik1583277475390&topicId=task-5373.html&_LANG=enus","locator":"Article 'Manage AI Features for an Account' (last updated 2 Sep 2026), Note","url2":"https://support.docusign.com/s/document-item?language=en_US&bundleId=fzd1707173174972&topicId=dcs1708531444159.html&_LANG=enus","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 38 per user/month billed annually (EUR 456 a year); VAT basis not stated","status":"verified","url":"https://ecom.docusign.com/plans-and-pricing/esignature","locator":"Plan card 'Business Pro' (German page)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"doodle","name":"Doodle","vendor":"Doodle AG, Zurich, Switzerland","category":"research-forms-and-storage","plans":[{"id":"T633","plan":"Team","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for self-serve terms. The Master Services Agreement (contracted orders) lets Doodle use customer content in anonymised/aggregated form to optimise its machine learning models and AI features; terms and privacy policy are silent.","status":"not_published","url":"https://doodle.com/en/master-services-agreement/","locator":"Master Services Agreement 9.2 Aggregated Statistics; also terms of service, privacy policy, general data processing terms, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"optimizing Doodle’s machine learning models and AI-enhanced features, including any intellectual property or model rights resulting from such training or improvement"},{"key":"training_opt_out","value":"Not stated. No setting or request process to stop the anonymised/aggregated use described in MSA 9.2 is documented.","status":"not_published","url":"https://doodle.com/en/privacy-policy/","locator":"Privacy policy; general terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not a setting: default hosting is already in Germany and Ireland (EU). No region choice is described.","status":"verified","url":"https://doodle.com/en/data-subprocessors/","locator":"List of data subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"MongoDB Atlas | Cloud Database | Germany, Ireland"},{"key":"default_data_location","value":"EU: cloud hosting (AWS) and database (MongoDB Atlas) in Germany and Ireland.","status":"verified","url":"https://doodle.com/en/data-subprocessors/","locator":"List of data subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services, Inc | Cloud Hosting Provider | Germany, Ireland"},{"key":"dpa","value":"Yes. The General Data Processing Terms apply automatically on top of the Terms of Service; a fuller DPA with SCCs is part of the Master Services Agreement for contracted orders.","status":"verified","url":"https://doodle.com/en/general-data-processing-terms/","locator":"General Terms and Conditions of the Processing of Personal Data, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"these General Terms and Conditions of the Processing of Personal Data apply in addition to the applicable general Terms of Service"},{"key":"subprocessor_list","value":"Yes, public: https://doodle.com/en/data-subprocessors/ (dated 23 September 2026). 12 entries. No AI or model provider is listed.","status":"verified","url":"https://doodle.com/en/data-subprocessors/","locator":"List of data subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following is Doodle's current list of Subprocessors authorized to process customer data for Doodle's services:"},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, Doodle AG, Zurich)","status":"verified","url":"https://doodle.com/en/data-processing-addendum","locator":"Data Processing Addendum, parties clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Doodle AG with the business address of Werdstrasse 21, 8004 Zurich, Switzerland"},{"key":"data_retention","value":"After the contract ends Doodle deletes personal data as soon as possible and at the latest within 180 days; users can also delete polls manually any time.","status":"verified","url":"https://doodle.com/en/general-data-processing-terms/","locator":"General Data Processing Terms, point 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Doodle will delete the personal data upon termination of the contractual relationship with you as soon as possible and at the latest within a maximum period of 180 days"},{"key":"certifications","value":"2 named: SOC 2 Type II and Cyber Verify Level 3 (MSP Verify); the page also claims GDPR, CCPA and HIPAA compliance.","status":"verified","url":"https://doodle.com/en/features/security/","locator":"Security page > System and Organization Controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Doodle has successfully completed its SOC 2 Type II examination and the MSP Verify Program."},{"key":"admin_ai_controls","value":"Not stated. The Team plan has an Admin Console with roles, but no admin switch for AI features is described.","status":"not_published","url":"https://doodle.com/en/premium/","locator":"Pricing page, Team plan features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admin Console Roles and permissions Co-host events Book on behalf Activity reports Custom branding Get paid with Stripe AI-generated meeting descriptions"},{"key":"price_eur","value":"Not captured: the Team plan price is not in the page text (only 'per seat / month, billed annually'); the number is drawn by JavaScript.","status":"not_captured","url":"https://doodle.com/en/premium/","locator":"Pricing page, Team card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"dropbox","name":"Dropbox","vendor":"Dropbox","category":"workspace-and-projects","plans":[{"id":"T100","plan":"Standard","tier":"business","price":{"label":"€12 / user / mo","amount":12,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No without consent (vendor statement): Dropbox's AI principles say it will not build generative AI models using customer content without consent","status":"vendor_statement","url":"https://www.dropbox.com/ai-principles","locator":"Principle 'Keep customers in control of their data'","url2":"https://www.dropbox.com/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off per Dropbox's AI principles (training only with consent); no setting is documented","status":"vendor_statement","url":"https://www.dropbox.com/ai-principles","locator":"Principle 'Keep customers in control of their data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, with conditions: teams on Standard or higher with at least 10 licences, annual billing and a billing address outside the current storage region can ask support to move file data to the EU; requests are reviewed one by one and cannot be undone","status":"verified","url":"https://help.dropbox.com/security/physical-location-data-storage","locator":"Section 'Can I change where my file data is stored?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States by default; storage is also available in Australia, the EU, Japan and the UK for eligible teams","status":"verified","url":"https://help.dropbox.com/security/physical-location-data-storage","locator":"Article 'Where is my Dropbox data stored?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The Data Processing Agreement is part of the Dropbox Services Agreement for business customers","status":"verified","url":"https://www.dropbox.com/business_agreement","locator":"Definition of 'Agreement' and section 'Data Processing Agreement'","url2":"https://assets.dropbox.com/documents/en/legal/dfb-data-processing-agreement.pdf","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not found: the DPA says Dropbox lists its sub-processors 'in the Agreement', but no public list was found on the pages checked","status":"not_published","url":"https://assets.dropbox.com/documents/en/legal/dfb-data-processing-agreement.pdf","locator":"Section 4.1 (Sub-processors)","url2":"https://www.dropbox.com/business_agreement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Dropbox, Inc.; EU-US DPF, Swiss-US DPF, UK Extension; one covered entity)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Dropbox'","url2":"https://www.dropbox.com/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Files stay as long as the account exists; on termination Dropbox deletes stored data within a commercially reasonable period after an admin asks before termination","status":"verified","url":"https://assets.dropbox.com/documents/en/legal/dfb-data-processing-agreement.pdf","locator":"Section 'Deletion'","url2":"https://www.dropbox.com/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO 27001, 27017, 27018, 27701 and 22301; SOC 1, SOC 2 and SOC 3; CSA STAR; ISMAP; HIPAA/HITECH; NIST SP 800-171 attestation; EU Cloud Code of Conduct","status":"verified","url":"https://www.dropbox.com/business/trust/compliance/certifications-compliance","locator":"Sections 'ISO certifications', 'SOC reports' and following","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: admins choose which team members get a Dash (AI search) licence; other switches for AI features were not found","status":"verified","url":"https://help.dropbox.com/account-access/assign-dash-access","locator":"Article 'How to add Dash access to team member accounts' (updated 22 Apr 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 12 per user/month billed annually; VAT basis not stated","status":"verified","url":"https://www.dropbox.com/de/business/pricing","locator":"Plan card 'Standard' with 'Jährliche Abrechnung' selected","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"dropbox-sign","name":"Dropbox Sign","vendor":"Dropbox, Inc. (Dropbox International Unlimited Company for customers outside the US, Canada and Mexico)","category":"documents-hr-and-finance","plans":[{"id":"T583","plan":"Standard","tier":"business","price":{"label":"$25 / user / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. Dropbox Sign has a closed-beta AI feature (AI Auto-place Fields); no training clause found in the Dropbox Sign terms, privacy policy, DPA or trust page, nor in the beta help article.","status":"not_published","url":"https://sign.dropbox.com/about/privacy","locator":"Privacy policy, terms, DPA, trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://sign.dropbox.com/about/privacy","locator":"Privacy policy, terms, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found for Dropbox Sign.","status":"not_published","url":"https://sign.dropbox.com/about/privacy","locator":"Privacy policy, terms, DPA, trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States and other locations worldwide; no specific region or hosting provider is named.","status":"verified","url":"https://sign.dropbox.com/about/privacy","locator":"Privacy policy, international data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we may store, process, and transmit data in the United States and locations around the world"},{"key":"dpa","value":"Yes. A Data Processing Agreement applies to Dropbox Sign when customer data is subject to EU data protection law; it is part of the Terms, with no separate signing.","status":"verified","url":"https://sign.dropbox.com/about/terms","locator":"6.4.2 Data Processing Agreement","url2":"https://assets.dropbox.com/documents/en/legal/hs-data-processing-agreement.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To the extent Customer Data is subject to EU Data Protection Laws and is processed by Dropbox on Customer's behalf, Customer and Dropbox agree to the Data Processing Agreement."},{"key":"subprocessor_list","value":"A public list exists (https://www.dropbox.com/privacy/subprocessor/sign, referenced by the DPA) but could not be read without a browser, so the count and AI providers are not captured.","status":"not_captured","url":"https://www.dropbox.com/privacy/subprocessor/sign","locator":"Sub-processor page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Dropbox, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Dropbox'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data is kept as long as needed for its purposes. Customers can delete their files in the account; at the end of the contract Dropbox deletes customer data in a commercially reasonable period after the customer asks. No fixed number of days is stated.","status":"verified","url":"https://assets.dropbox.com/documents/en/legal/hs-data-processing-agreement.pdf","locator":"Section 7 Deletion","url2":"https://sign.dropbox.com/about/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dropbox will delete Customer Data in Customer’s account in a commercially reasonable period of time following receipt of Customer’sr equest to do so prior to such termination."},{"key":"certifications","value":"4 named for Dropbox Sign: SOC 2, SOC 3, ISO/IEC 27001, ISO 27018. Dropbox-wide trust centre also lists ISO 27701, EU Cloud Code of Conduct and EU-US DPF.","status":"verified","url":"https://trust.dropbox.com","locator":"Trust Center Updates: New Dropbox SOC Reports and ISO Certificates","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dropbox Sign SOC 2 Dropbox Sign SOC 3"},{"key":"admin_ai_controls","value":"Not stated. AI Auto-place Fields is a closed beta (via Support for API use); no admin setting to switch AI off for an organisation is described.","status":"not_published","url":"https://trust.dropbox.com","locator":"Pricing, trust, terms pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Standard is $25 per user/month (from $600 per year for the minimum seats); the page also shows a discounted $17.50 per user/month (from $420 per year).","status":"not_published","url":"https://sign.dropbox.com/products/dropbox-sign/pricing","locator":"Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"duck-ai","name":"Duck.ai","vendor":"DuckDuckGo (DuckDuckGo, Inc.)","category":"assistants","plans":[{"id":"T303","plan":"free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. By default chats are not recorded and not used to train models by DuckDuckGo or the underlying model providers. Chats you choose to share as feedback are stored and reviewed to improve products.","status":"verified","url":"https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy","locator":"How does Duck.ai protect my privacy?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your conversations are not used to train chat models by DuckDuckGo or the underlying model providers"},{"key":"training_opt_out","value":"Nothing to do: DuckDuckGo states chats are not used to train models by it or the model providers.","status":"verified","url":"https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy","locator":"How does Duck.ai protect my privacy?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your conversations are not used to train chat models by DuckDuckGo or the underlying model providers"},{"key":"eu_residency_option","value":"Not stated; no EU residency setting found.","status":"not_published","url":"https://duckduckgo.com/duckai/privacy-terms","locator":"Duck.ai privacy policy, ai-chat-privacy help page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Chats are saved locally on the user's device by default. DuckDuckGo servers are worldwide, with devices usually connecting to regional ones (European servers in Europe).","status":"verified","url":"https://duckduckgo.com/privacy","locator":"Cross-border transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we have servers across the world and while your device will typically try to automatically connect to regional servers (e.g., European servers in Europe, U.S. servers in the U.S.)"},{"key":"dpa","value":"Not stated for Duck.ai; no data processing agreement found. DuckDuckGo says its paid Subscription is for personal, individual use only.","status":"not_published","url":"https://duckduckgo.com/duckduckgo-help-pages/privacy-pro/business-corporate-subscription","locator":"Do you offer any business or corporate plans?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No sub-processor list; the help page lists 5 model providers: Tinfoil, Mistral, Azure, OpenAI and Anthropic. The Duck.ai privacy policy also names together.ai.","status":"verified","url":"https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy","locator":"Provider table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Requests to Anthropic, OpenAI, Mistral, Azure, and Tinfoil appear as though they are coming from DuckDuckGo rather than individual users."},{"key":"dpf_status","value":"No listing found for search term 'DuckDuckGo'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'DuckDuckGo' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chats are not recorded by DuckDuckGo by default; recent chats live on the device and can be deleted with the Fire Button. Model providers delete prompts after replying (at most 30 days with limited exceptions). Sync & Backup chats are deleted after 18 months without access.","status":"verified","url":"https://duckduckgo.com/duckai/privacy-terms","locator":"Privacy Policy: model provider agreements","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"deleting all information received once it is no longer necessary to provide Outputs (at most within 30 days, with limited exceptions for safety and legal compliance)"},{"key":"certifications","value":"Not stated; no security certifications found on the Duck.ai pages.","status":"not_published","url":"https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy","locator":"Duck.ai privacy policy and help pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for organisations: no admin controls found. DuckDuckGo says its paid Subscription is for personal, individual use only; individual users can hide Duck.ai.","status":"not_published","url":"https://duckduckgo.com/duckduckgo-help-pages/privacy-pro/business-corporate-subscription","locator":"Business or corporate plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Free to use, with a daily usage limit; higher limits are on the paid Plus and Pro subscription plans.","status":"verified","url":"https://duckduckgo.com/duckduckgo-help-pages/duckai/usage-limits","locator":"Usage limits","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Duck.ai is free to use, but there is a daily limit on usage."}]}]},{"slug":"dust","name":"Dust","vendor":"Permutation Labs (Dust)","category":"assistants","plans":[{"id":"T323","plan":"Business, Pro seat","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per Dust's security page. Its privacy policy adds that the model providers (OpenAI, Anthropic, Mistral, Google, Fireworks) are prohibited from training on customer data.","status":"vendor_statement","url":"https://dust.tt/home/security","locator":"No Model Training","url2":"https://dust.tt/home/platform-privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No Model Training Your data is never used to train models."},{"key":"training_opt_out","value":"Nothing to do: Dust states customer data is never used to train models.","status":"vendor_statement","url":"https://dust.tt/home/security","locator":"No Model Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No Model Training Your data is never used to train models."},{"key":"eu_residency_option","value":"Yes. Business lists US and EU data residency. EU workspaces can also switch on Admin > Models > EU-hosted models only, so agents use only EU-hosted models (credit plans).","status":"verified","url":"https://dust.tt/home/pricing","locator":"Business plan feature list","url2":"https://docs.dust.tt/docs/user-documentation/admins/admin-governance/eu-hosted-models.md","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SSO with Okta, Entra ID & Jumpcloud US & EU data residency"},{"key":"default_data_location","value":"Not stated which region is the default. Dust runs on Google Cloud (Postgres, Qdrant Cloud for embeddings); Business workspaces can be placed in the US or EU.","status":"not_published","url":"https://dust.tt/home/platform-privacy","locator":"Section 8 How do we secure your Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for Business: pricing lists Custom legal terms (MSA, DPA) under Enterprise only. Dust's online terms need a browser to read.","status":"not_published","url":"https://dust.tt/home/pricing","locator":"Business vs Enterprise columns; terms at dust.tt/terms (Notion)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Published on Dust's Trust Center (trust.dust.com), which needs a browser; count not captured. Privacy policy names OpenAI, Anthropic, Mistral, Google and Fireworks as model providers.","status":"not_captured","url":"https://trust.dust.com","locator":"Trust Center sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Permutation Labs, Paris, France)","status":"verified","url":"https://dust.tt/home/platform-privacy","locator":"Section 1 intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Permutation Labs, 86 avenue de Wagram, 75017 Paris, France"},{"key":"data_retention","value":"Not stated for Business chats. Enterprise adds custom data retention. Model providers apply zero data retention. Personal data in contracts is archived 5 years after the agreement ends.","status":"not_published","url":"https://dust.tt/home/pricing","locator":"Enterprise column; privacy policy section 5","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"1 named: SOC 2 Type II; GDPR compliance is also claimed and HIPAA is described as enabled.","status":"vendor_statement","url":"https://dust.tt/home/security","locator":"Enterprise-grade Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GDPR Compliant & SOC2 Type II Certified. Enables HIPAA compliance."},{"key":"admin_ai_controls","value":"Partly. Admins can cap which models members may use, at workspace, group or member level (Admin > Models), and restrict to EU-hosted models. No switch to turn AI off is described.","status":"verified","url":"https://docs.dust.tt/docs/user-documentation/admins/usage-seats-and-credits/model-access-tiers.md","locator":"Intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Administrators can cap how far up the model list each member can go."},{"key":"price_eur","value":"Pro seat: 24 euro per seat per month billed yearly (30 euro monthly), excluding VAT, with 8,000 credits per month. Max seat 120 euro yearly. Free seat has 500 lifetime credits.","status":"verified","url":"https://dust.tt/home/pricing","locator":"FAQ: difference between Free, Pro and Max seats","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro: 30€/month, or 24€/month billed yearly, with 8,000 credits/month."}]}]},{"slug":"dynamics-365-sales","name":"Dynamics 365 Sales","vendor":"Microsoft Corporation","category":"sales-marketing-and-support","plans":[{"id":"T492","plan":"Professional","tier":"business","price":{"label":"€56.30 / user / mo","amount":56.3,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Microsoft says its AI models are not trained on your tenant data or prompts unless your tenant admin opts in to data sharing (off by default).","status":"verified","url":"https://learn.microsoft.com/en-us/dynamics365/faqs-copilot-data-security-privacy","locator":"Architected to protect your data at both the tenant and the environment level","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft AI models are not trained on and don't learn from your tenant data or your prompts, unless your tenant admin has opted in to sharing data with us."},{"key":"training_opt_out","value":"Nothing to do by default: the data-sharing setting is off. If an admin switched it on, turn it off in Power Platform admin center > Settings > Tenant settings > Data sharing for Dynamics 365 Copilot and Power Platform Copilot AI Features.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/faqs-copilot-data-sharing","locator":"If I've opted in, how can I withdraw my consent?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, the data sharing option is disabled for you."},{"key":"eu_residency_option","value":"Yes. Host the environment in a European region; Copilot AI then runs in the EU Data Boundary. If you allow cross-region data movement, prompts and results may leave your region.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/admin/geographical-availability-copilot","locator":"Move data across regions for Copilots (intro and table)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you allow data movement across regions, your inputs (prompts) and outputs (results) might move outside of your region to the location where the generative AI feature is hosted."},{"key":"default_data_location","value":"Set by the region where your Dynamics 365 environment is hosted; no single default. For Copilot AI features, a European environment uses Azure OpenAI hosted inside the EU Data Boundary.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/admin/geographical-availability-copilot","locator":"Regions where data is processed for Copilots and generative AI features (table)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Europe** In European Union (EU) Data Boundary United States"},{"key":"dpa","value":"Yes. The Microsoft Products and Services DPA applies automatically to subscriptions under the Product Terms; no separate signing is described.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"DPA landing page, first paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)."},{"key":"subprocessor_list","value":"Microsoft says it publishes sub-processor information, but the list sits on a script-only Service Trust page, so no count or AI provider names could be read.","status":"not_captured","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Limited subprocessor access","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After a subscription ends, Microsoft keeps your data 90 days in a limited-function account for you to export it, then deletes it within a further 90 days. Copilot prompts and answers are not stored for abuse monitoring.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-management","locator":"Data deletion / retention period after termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft will store your customer data in a limited-function account for 90 days"},{"key":"certifications","value":"At least 5 named for Dynamics 365: ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701, SOC 2 Type 2 and Germany C5. Microsoft lists more attestations elsewhere.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"In-scope cloud platforms and services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Dynamics 365, Dynamics 365 Government, and Dynamics 365 Germany"},{"key":"admin_ai_controls","value":"Yes. A Power Platform admin turns Copilot in Dynamics 365 Sales on or off in the Power Platform admin center, and controls whether data may move across regions for AI features.","status":"verified","url":"https://learn.microsoft.com/en-us/dynamics365/sales/sales-copilot-data-movement","locator":"Prerequisites","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Make sure that your Power Platform administrator has turned on Copilot in Dynamics 365 Sales in Power Platform Admin Center."},{"key":"price_eur","value":"€56.30 per user/month, paid yearly, excluding VAT (Dynamics 365 Sales Professional).","status":"verified","url":"https://www.microsoft.com/en-ie/dynamics-365/products/sales/pricing","locator":"Dynamics 365 Sales plans, Professional card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€56.30 user/month, paid yearly Price does not include VAT."}]}]},{"slug":"elevenlabs","name":"ElevenLabs","vendor":"ElevenLabs","category":"phone-and-voice","plans":[{"id":"T71","plan":"Creator","tier":"personal","price":{"label":"$22 / mo","amount":22,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: ElevenLabs trains on non-Enterprise data by default; Enterprise customers' data is not used","status":"verified","url":"https://elevenlabs.io/docs/help-center/legal/is-my-data-used-to-improve-eleven-labs-ai-models","locator":"Help article on data use","url2":"https://elevenlabs.io/terms-of-use","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off 'Improve the models for everyone': profile icon > Terms and privacy > Data use. Only new data is excluded","status":"verified","url":"https://elevenlabs.io/docs/help-center/legal/is-my-data-used-to-improve-eleven-labs-ai-models","locator":"Section 'How can I modify my data use settings?'","url2":"https://elevenlabs.io/terms-of-use","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Creator: choosing a hosting location is an Enterprise option","status":"verified","url":"https://compliance.elevenlabs.io/subprocessors","locator":"Location column ('Enterprise: US or Customer's Selected Hosting Location; Non-Enterprise: US, EU or Singapore')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States for storage per the privacy policy; the Trust Center adds that non-Enterprise data may be processed in the US, EU or Singapore for latency","status":"verified","url":"https://elevenlabs.io/privacy-policy","locator":"Section 'International Data Transfers' ('transferred to the United States for storage')","url2":"https://compliance.elevenlabs.io/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes for business use: the terms point to ElevenLabs' DPA (8 Apr 2026) for personal data in business clients' content, and sign-up with a company email may make the company the controller","status":"verified","url":"https://elevenlabs.io/terms-of-use","locator":"Terms list of incorporated documents ('Our Data Processing Addendum, which governs…business clients')","url2":"https://elevenlabs.io/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 32 entries; LLM services from Google, Anthropic, OpenAI, xAI, Fireworks and Databricks; media generation partners include ByteDance, Kling, Runway, Creatify, Fal and Sync; locations include the US, EU, Singapore, Indonesia and Malaysia","status":"verified","url":"https://compliance.elevenlabs.io/subprocessors","locator":"Subprocessors list ('32 results', all pages)","url2":"https://elevenlabs.io/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (ElevenLabs; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'ElevenLabs'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for self-serve content: ElevenLabs may delete it after 180 days of inactivity; voice-derived data is kept no longer than 3 years after the last interaction. Zero Retention Mode is offered (plan not stated)","status":"verified","url":"https://elevenlabs.io/dpa","locator":"Section 9.2.2 (Self-Serve Services)","url2":"https://elevenlabs.io/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO 27001, 27017, 27018, 27701 and 42001, PCI DSS 4.0.1 Level 1; HIPAA, GDPR and EU AI Act listed","status":"verified","url":"https://compliance.elevenlabs.io/","locator":"Compliance section and documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered on Creator: it is a single-user plan; workspace and admin features come with higher plans","status":"verified","url":"https://elevenlabs.io/pricing","locator":"Plan cards (Creator is per user)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 22 per month (first month USD 11)","status":"not_published","url":"https://elevenlabs.io/pricing","locator":"Plan card 'Creator'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"elicit","name":"Elicit","vendor":"Elicit Research, PBC","category":"research-forms-and-storage","plans":[{"id":"T620","plan":"Scale","tier":"business","price":{"label":"$89 / user / mo","amount":89,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Scale. The team terms license Elicit to use customer content to 'develop, improve' its services but never mention training models. Only the Enterprise plan is advertised as 'no training on your data by default'.","status":"not_published","url":"https://elicit.com/operations/team-terms","locator":"Content / license clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"to use, copy, modify, and make derivative works of the Content in order to provide, maintain, develop, improve the Platform"},{"key":"training_opt_out","value":"Not stated. No training opt-out setting or email is described for Scale in the privacy policy, terms, team terms or help centre.","status":"not_published","url":"https://elicit.com/operations/team-terms","locator":"Content / license clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated for Scale. The Enterprise plan advertises custom deployments such as single-tenancy, but no EU region is named.","status":"not_published","url":"https://elicit.com/pricing","locator":"Pricing page, Enterprise card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the privacy policy says Elicit's servers are located in the United States.","status":"verified","url":"https://elicit.com/operations/privacy","locator":"Is Your Information Transferred Internationally?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our servers are located in the United States."},{"key":"dpa","value":"Yes. Elicit's Data Processing Addendum, with EU Standard Contractual Clauses, is public and the team subscription agreement incorporates it.","status":"verified","url":"https://elicit.com/operations/team-terms","locator":"Data protection clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Elicit's Data Protection Agreement, which can be found at elicit.com/operations/dpa, and which is hereby incorporated into this Agreement"},{"key":"subprocessor_list","value":"A public list exists at https://trust.elicit.com/subprocessors, but it could not be read without a browser, so entries and AI providers are not counted.","status":"not_captured","url":"https://trust.elicit.com/subprocessors","locator":"Subprocessor List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Elicit'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Elicit' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data is kept only as long as necessary; uploaded PDFs stay until the user deletes them; on Scale cancellation team accounts are closed and locked; under the DPA data is kept for the term of the agreement. No fixed number of days is given.","status":"verified","url":"https://support.elicit.com/en/articles/14758043-privacy-for-uploaded-papers","locator":"Privacy for uploaded papers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"PDFs you upload are encrypted and remain private to your account only, until you choose to delete them."},{"key":"certifications","value":"Not captured: the security and certification details sit on trust.elicit.com, which needs a browser; no certification is named in the pricing page, privacy policy or DPA.","status":"not_captured","url":"https://trust.elicit.com","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"No AI on/off setting is described for Scale. Team admins get a dashboard to invite or remove members, view usage and buy seats.","status":"not_published","url":"https://support.elicit.com/en/articles/14759330-elicit-s-scale-plan-for-teams","locator":"Team Admin Settings page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Team admins have access to an Admin Dashboard to invite or remove team members, view usage, and purchase additional seats."},{"key":"price_eur","value":"Shown in USD only: $89 per user/month, billed as $1,068 annually (a second view of the page shows $169, billed as $2,028 annually). No EUR price.","status":"not_published","url":"https://elicit.com/pricing","locator":"Pricing page, Scale card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Per user/month, billed as $1,068 annually"}]}]},{"slug":"evernote-enterprise","name":"Evernote Enterprise","vendor":"Bending Spoons S.p.A. (Evernote)","category":"workspace-and-projects","plans":[{"id":"T463","plan":"","tier":"enterprise","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. Evernote says it does not use what you put into AI features, or the results, to train its own or third-party AI models.","status":"verified","url":"https://evernote.com/privacy/policy","locator":"Privacy Policy, AI Features","url2":"https://evernote.com/legal/supplemental-terms","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your Input or Output to train our artificial intelligence models or tools, or those of third-party AI model providers."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not use AI input or output to train models.","status":"verified","url":"https://evernote.com/privacy/policy","locator":"Privacy Policy, AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your Input or Output to train our artificial intelligence models or tools, or those of third-party AI model providers."},{"key":"eu_residency_option","value":"No selectable EU region is described. The DPA commits Evernote to process and retain Customer Personal Data within the EEA only to the extent EU data protection law requires; the Terms and security page say data is stored in the United States.","status":"verified","url":"https://evernote.com/legal/dpa","locator":"DPA, data location clause","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"To the extent required under Applicable Data Protection Law, Processor shall process and retain Customer Personal Data within the EEA"},{"key":"default_data_location","value":"United States: the security page says all Evernote data resides inside the US, hosted on Google Cloud Platform.","status":"verified","url":"https://evernote.com/security","locator":"Security page, data hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All Evernote data resides inside the United States."},{"key":"dpa","value":"Yes. An Enterprise Data Processing Addendum is incorporated into the Evernote Enterprise Agreement and applies where Evernote processes personal data for the customer.","status":"verified","url":"https://evernote.com/legal/dpa","locator":"Enterprise Data Processing Addendum, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is incorporated into the Evernote Enterprise Agreement (“Agreement”). This Addendum applies to the extent that Processor processes Customer Personal Data"},{"key":"subprocessor_list","value":"Yes: https://evernote.com/privacy/vendors lists 11 vendors (Bird, Calendly, Datadog, Fastly, Google Cloud, Google Analytics, hCaptcha, Invision Power Boards, OpenAI, Sentry, Zendesk). OpenAI is the only AI provider, shown with country Ireland.","status":"verified","url":"https://evernote.com/privacy/vendors","locator":"Vendors table","url2":"https://evernote.com/legal/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Invision Power Boards United States Community OpenAI Ireland AI-powered processing"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Bending Spoons S.p.A., Milan, Italy)","status":"verified","url":"https://evernote.com/privacy/policy","locator":"Entity line","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Bending Spoons S.p.A. is the data controller. We’re an Italian tech company based in Via Nino Bonnet 10, Milan, MI 20154."},{"key":"data_retention","value":"Content is kept until you delete it; backups may hold deleted content for up to 60 days. After the Enterprise agreement ends, Evernote has no duty to keep content and may delete it; the DPA deletes or returns data on written request.","status":"verified","url":"https://evernote.com/privacy/policy","locator":"Privacy Policy, retention","url2":"https://evernote.com/legal/enterprise","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Evernote Service’s back-up systems may retain residual copies of your deleted Content and attachments for up to 60 days"},{"key":"certifications","value":"1 certification: ISO 27001 (as of November 2025), plus an annual Google CASA Tier 2 security assessment. No SOC 2 named.","status":"verified","url":"https://evernote.com/security","locator":"Security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Evernote is ISO 27001 certified, as of November 2025."},{"key":"admin_ai_controls","value":"Not stated for admins. The privacy policy says AI Features can be managed or disabled in account settings, but the Enterprise page and agreement describe no organisation-wide admin switch.","status":"not_published","url":"https://evernote.com/legal/enterprise","locator":"Enterprise Agreement, Admin Console; Enterprise page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: Enterprise is sold by quote only (contact the sales team for a demo and customised quote).","status":"not_published","url":"https://evernote.com/teams","locator":"Enterprise page, Get started","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Contact our team for a product demo and customized quote"}]}]},{"slug":"factorial","name":"Factorial","vendor":"Everyday Software, S.L. (Factorial)","category":"documents-hr-and-finance","plans":[{"id":"T592","plan":"Core, per-user plan","tier":"business","price":{"label":"From €8 / user / mo","amount":8,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Factorial says it uses pre-trained AI models, does not fine-tune or train them on customer data, and contractually bars its model providers from training on customer inputs or outputs.","status":"verified","url":"https://trust.factorial.co","locator":"Trust Center > AI > AI Training Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Factorial uses pre-trained AI models and does not fine-tune or train models on customer data."},{"key":"training_opt_out","value":"Nothing to do: Factorial states it does not train on customer data and its model providers are contractually barred from it; it says customers would be notified and asked for consent first if that changed.","status":"verified","url":"https://trust.factorial.co","locator":"Trust Center > AI > AI Training Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Factorial's approach to training were to change, customers would be notified in advance and explicit consent would be requested."},{"key":"eu_residency_option","value":"EU hosting is the stated default; no separate EU setting or other region choice is described.","status":"verified","url":"https://factorialhr.com/privacy","locator":"5. Do we share your personal data? Do we make international data transfers?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When we process your data, it is hosted in the EU and processed within the territory of the EU"},{"key":"default_data_location","value":"EU: Factorial says data is hosted and processed within the EU; the hosting provider is not named in the documents read.","status":"verified","url":"https://factorialhr.com/privacy","locator":"5. Do we share your personal data? Do we make international data transfers?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When we process your data, it is hosted in the EU and processed within the territory of the EU"},{"key":"dpa","value":"Yes. The Data Processing Agreement is an inseparable part of the Terms; customers who need one sign it through a link Factorial provides and receive a copy signed by both parties.","status":"verified","url":"https://factorialhr.com/terms-of-use","locator":"10.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Processing Agreement is an inseparable part of these Terms and Conditions"},{"key":"subprocessor_list","value":"No public list found; the privacy policy says sub-processors are listed in the Processing Assignment Agreement or can be requested by email.","status":"not_published","url":"https://factorialhr.com/privacy","locator":"Section on data processors / sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Everyday Software, S.L., Barcelona, Spain)","status":"verified","url":"https://factorialhr.com/terms-of-use","locator":"1.1 Welcome","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EVERYDAY SOFTWARE, S.L., a Spanish company with registered office at Carrer de Llacuna, 56"},{"key":"data_retention","value":"A customer can ask to delete data at any time. From 30 days after cancellation takes effect, data is blocked (available only to public authorities) for 1 year, then destroyed. Download it before cancellation. Retention of AI inputs is not stated; AI providers do not retain task data per the trust centre.","status":"verified","url":"https://factorialhr.com/terms-of-use","locator":"10.5","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After 30 days from the effective date of cancellation of the service data will remain blocked for a period of one (1) year"},{"key":"certifications","value":"ISO/IEC 27001:2022, SOC 2 Type 2, SOC 3 and Spain's ENS RD311/2022 High level (4 named); reports are available on request.","status":"verified","url":"https://trust.factorial.co","locator":"Trust Center > Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ENS RD311/2022 HIGH ISO/IEC 27001:2022 SOC 2 Type 2 SOC 3"},{"key":"admin_ai_controls","value":"Not stated; the terms and privacy policy do not describe an organisation-wide switch for AI features.","status":"not_published","url":"https://factorialhr.com/terms-of-use","locator":"10.13 AI Features and Use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From €8 per user per month (German price page, 'ab 8 €'); billing basis and VAT are not shown, plans are quoted individually.","status":"verified","url":"https://factorialhr.de/preise","locator":"Hero: Factorial startet ab 8 € pro Monat und User","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Factorial startet ab 8 € pro Monat und User"}]}]},{"slug":"fastbill","name":"FastBill","vendor":"FastBill GmbH","category":"documents-hr-and-finance","plans":[{"id":"T604","plan":"Pro","tier":"business","price":{"label":"€30 / mo","amount":30,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the privacy policy, terms and homepage.","status":"not_published","url":"https://www.fastbill.com/datenschutz","locator":"Datenschutzerklärung, AGB and homepage (no AI or model-training clause)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"training_opt_out","value":"Not published. No model-training use is described, so FastBill names no training opt-out.","status":"not_published","url":"https://www.fastbill.com/datenschutz","locator":"Datenschutzerklärung and AGB (no training clause or opt-out)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"eu_residency_option","value":"Data is stated to be stored on servers in Germany by default (marketing pages only). No region setting or choice is described.","status":"vendor_statement","url":"https://www.fastbill.com/","locator":"Homepage, \"Hosting in Deutschland\"; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alle Daten werden sicher auf Servern in Deutschland gespeichert."},{"key":"default_data_location","value":"Germany. The homepage and pricing page state that all data is stored on servers in Germany. The privacy policy and terms name no hosting provider.","status":"vendor_statement","url":"https://www.fastbill.com/","locator":"Homepage, \"Hosting in Deutschland\"; pricing page, \"Sicherheit und Datenschutz\"","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alle Daten werden sicher auf Servern in Deutschland gespeichert."},{"key":"dpa","value":"Not published. No data processing agreement (AVV) or request route appears on the privacy policy, terms, pricing page or homepage.","status":"not_published","url":"https://www.fastbill.com/datenschutz","locator":"Datenschutzerklärung, AGB, Preise page and homepage searched for Auftragsverarbeitung/AVV (no hit)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not published as a list. Individual tools are named (Google Analytics, MailChimp, Typeform, Mouseflow, LinkedIn, AWIN) but there is no sub-processor register.","status":"not_published","url":"https://www.fastbill.com/datenschutz","locator":"Datenschutzerklärung, cookies and tracking sections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, FastBill GmbH, Frankfurt am Main)","status":"verified","url":"https://www.fastbill.com/impressum","locator":"Impressum, provider details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"FastBill GmbH Brüsseler Str. 1-3 60327 Frankfurt am Main"},{"key":"data_retention","value":"Invoice-relevant documents are kept up to 10 years under tax law (up to 30 years for enforceable claims). After contract end, customer content is deleted three months later, with export possible in that window.","status":"verified","url":"https://www.fastbill.com/agb","locator":"AGB, 13.8 'Vertragsdauer / Kündigung / Löschung des Accounts'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"löscht der Anbieter vom Kunden eingepflegte Inhalte drei Monate nach Beendigung des Vertragsverhältnisses"},{"key":"certifications","value":"Not published. The privacy policy, terms and imprint name no ISO, SOC 2 or other security certification.","status":"not_published","url":"https://www.fastbill.com/datenschutz","locator":"Datenschutzerklärung, AGB and Impressum checked for certification names","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"admin_ai_controls","value":"No AI feature is described for FastBill, so there is no AI control for an administrator to set.","status":"not_published","url":"https://www.fastbill.com/preise","locator":"Preise page feature lists; Datenschutz and AGB (no AI feature found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"€30 per month, or €27 per month with annual billing, excluding VAT. Includes 3 users. Premium is quoted from €59 but is sold through a demo.","status":"verified","url":"https://www.fastbill.com/preise","locator":"Preise page, Pro plan block","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Pro Zusätzliche Automatisierungen und eine reibungslose Zusammenarbeit im Team 30 € mtl. 27 € mtl."}]}]},{"slug":"fathom","name":"Fathom","vendor":"Fathom","category":"meetings-and-notes","plans":[{"id":"T62","plan":"Team","tier":"business","price":{"label":"$15 / user / mo","amount":15,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form, unless someone opts out: Fathom uses de-identified customer data to improve its own AI models; its AI providers (Anthropic, OpenAI, Google) may not train on it","status":"verified","url":"https://trust.fathom.video/faq","locator":"FAQ 'Do you let AI providers train on customer data?'","url2":"https://www.fathom.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Each user can opt out in User Settings (fathom.video/customize); on Team Edition an admin can opt out all users in Organization Settings","status":"verified","url":"https://trust.fathom.video/faq","locator":"FAQ 'Do you let AI providers train on customer data?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://trust.fathom.video/faq","locator":"FAQ 'Where do you store data?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: all data is stored in the US","status":"verified","url":"https://trust.fathom.video/faq","locator":"FAQ 'Where do you store data?'","url2":"https://www.fathom.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Fathom publishes a DPA (last updated 5 May 2026) that supplements its standard terms, and signs one for EU/UK customers on request via trust@fathom.video","status":"verified","url":"https://www.fathom.ai/dpa","locator":"Cover page ('supplemental to… the Fathom standard terms')","url2":"https://trust.fathom.video/faq","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 30 entries, 29 in the US and 1 in Belgium; AI providers: Anthropic, OpenAI, ElevenLabs, Fireworks, Modal and Voyage AI; hosting on Google Cloud","status":"verified","url":"https://trust.fathom.video/subprocessors","locator":"Subprocessors list (all pages)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Fathom.video; EU-US DPF, Swiss-US DPF, UK Extension; non-HR data)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fathom'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Recordings and data are kept indefinitely until the user deletes them or the account; after account deletion, backups are cleared within 7 more days. Custom retention rules (e.g. purge after 2 years) are offered on a higher Team Edition plan","status":"verified","url":"https://trust.fathom.video/faq","locator":"FAQs 'How long do you store meeting recordings…' and 'What happens to my data if I delete my account?'","url2":"https://www.fathom.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II (report and bridge letter); HIPAA and GDPR listed","status":"verified","url":"https://trust.fathom.video/","locator":"Compliance tiles and documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Team admins can opt every user out of model training; other organisation-wide AI switches are not described","status":"verified","url":"https://trust.fathom.video/faq","locator":"FAQ 'Do you let AI providers train on customer data?' (Organization Settings)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 15 per user/month billed annually, USD 19 monthly, minimum 2 users","status":"not_published","url":"https://www.fathom.ai/pricing","locator":"Plan card 'Team'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"fellow","name":"Fellow","vendor":"Fellow Insights Inc.","category":"meetings-and-notes","plans":[{"id":"T391","plan":"Business","tier":"business","price":{"label":"$15 / user / mo","amount":15,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Fellow states it never uses meeting data to train AI models; the sub-processor page repeats that customer data is not used to train AI models.","status":"verified","url":"https://help.fellow.ai/en/articles/8461666-fellow-ai-features","locator":"Security and privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fellow never uses your meeting data to train AI models. All AI features are covered by Fellow's SOC 2 Type II, HIPAA, and GDPR compliance."},{"key":"training_opt_out","value":"Nothing to do: Fellow states it never uses meeting data to train AI models. Admins can separately switch off third-party AI features (Workspace Settings > Security > Artificial Intelligence).","status":"verified","url":"https://help.fellow.ai/en/articles/8461666-fellow-ai-features","locator":"Security and privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fellow never uses your meeting data to train AI models."},{"key":"eu_residency_option","value":"Not stated: no EU hosting option found in the privacy policy, help centre or sub-processor page; data is hosted in Canada.","status":"not_published","url":"https://fellow.app/privacy-policy","locator":"Privacy policy, International Data Transfers; help centre Security & Compliance; sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Canada: hosted on Amazon Web Services in the Canada Central region.","status":"verified","url":"https://help.fellow.ai/en/articles/4302231-security-and-compliance","locator":"Fellow Server Infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fellow hosts its infrastructure on Amazon Web-Services (AWS) in the Canada Central region."},{"key":"dpa","value":"GDPR-compliant data processing agreements are mentioned in the help centre; how one is concluded for the Business plan is not described (pricing page lists 'Custom contracts' only on Enterprise).","status":"verified","url":"https://help.fellow.ai/en/articles/4302231-security-and-compliance","locator":"GDPR Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GDPR compliant data processing agreements, Fellow has an on staff Data Protection Officer"},{"key":"subprocessor_list","value":"Yes, public list at https://fellow.ai/fellow-app-sub-processors (last updated 13 Oct 2026): 27 entries in 5 groups (26 distinct companies; Google appears twice). AI/model providers: Anthropic, OpenAI, Google, Groq, Together.ai, Exa.ai; plus Recall AI, Deepgram, AssemblyAI, Fly.io for recording and transcription.","status":"verified","url":"https://fellow.ai/fellow-app-sub-processors","locator":"AI-Related Service Providers (Optional)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following sub-processors provide services specific to AI-related functionality within the Fellow platform."},{"key":"dpf_status","value":"No listing found for search term 'Fellow Insights'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fellow Insights' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Transcripts and summaries are kept until the note is deleted; recordings have no time limit. Auto-delete schedules are Enterprise only; members can delete a meeting's artifacts. Admin-requested deletions can remain in backups up to 30 days.","status":"verified","url":"https://help.fellow.ai/en/articles/8137902-fellow-note-taker-security-privacy","locator":"How long will our calls and transcriptions be stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Transcripts and summaries are stored indefinitely, for as long as the meeting note itself remains on Fellow (that is, until it is deleted)."},{"key":"certifications","value":"SOC 2 Type II (1 certification; report under NDA). It also states HIPAA and GDPR compliance, which are not certifications.","status":"verified","url":"https://help.fellow.ai/en/articles/4302231-security-and-compliance","locator":"SOC 2 Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our latest SOC 2 Type II report covers the Security and Confidentiality criteria and is valid for 12 months."},{"key":"admin_ai_controls","value":"Yes. Admins can switch off third-party AI features for the whole workspace (Workspace Settings > Security > Artificial Intelligence).","status":"verified","url":"https://fellow.app/privacy-policy","locator":"Service Providers related to Fellow's AI services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"can be controlled by administrators in your organization with a toggle in your Workspace settings in the Platform (Workspace Settings -> Security -> Artificial Intelligence)"},{"key":"price_eur","value":"Shown in USD only: $15 per user/month billed annually ($23 billed monthly)","status":"not_published","url":"https://fellow.app/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"felo-enterprise","name":"Felo Enterprise","vendor":"Felo株式会社 (Felo Inc.), Tokyo","category":"assistants","plans":[{"id":"T331","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Felo states that user content (prompts, uploaded files, answers) is not used as training data for the service's AI models unless the customer gives explicit consent.","status":"verified","url":"https://felo.ai/enterprise/privacy-policy","locator":"Felo Enterprise Privacy Policy (Japanese), section 1, end of list of personal data collected","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"コミュニケーション情報:当社とコミュニケーションを取る場合、お客様の送信内容に含まれるお名前、連絡先情報、送信されたメッセージの内容など\nなお、上記のユーザーコンテンツは、お客様の明示的な同意がある場合を除き、本サービスのAIモデルの学習データとして利用いたしません。\n## 2. 個人情報の管理について"},{"key":"training_opt_out","value":"Nothing to do by default: user content is not used for training unless the customer explicitly consents. No opt-out setting is described.","status":"verified","url":"https://felo.ai/enterprise/privacy-policy","locator":"Felo Enterprise Privacy Policy (Japanese), section 1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"コミュニケーション情報:当社とコミュニケーションを取る場合、お客様の送信内容に含まれるお名前、連絡先情報、送信されたメッセージの内容など\nなお、上記のユーザーコンテンツは、お客様の明示的な同意がある場合を除き、本サービスのAIモデルの学習データとして利用いたしません。\n## 2. 個人情報の管理について"},{"key":"eu_residency_option","value":"Not stated; no EU data-region option is mentioned.","status":"not_published","url":"https://felo.ai/enterprise","locator":"Felo Enterprise page, Enterprise privacy policy and terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the Enterprise terms and privacy policy name no country, region or hosting provider.","status":"not_published","url":"https://felo.ai/enterprise/privacy-policy","locator":"Felo Enterprise Privacy Policy and terms, full text read","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; the Enterprise terms and privacy policy do not mention a data processing agreement.","status":"not_published","url":"https://felo.ai/enterprise/terms","locator":"Felo Enterprise terms (Japanese) and Enterprise privacy policy, full text read","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list. The privacy policy only says handling of personal information can be outsourced to contractors under contract.","status":"not_published","url":"https://felo.ai/enterprise/privacy-policy","locator":"Felo Enterprise Privacy Policy, section 3 (outsourcing)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Felo'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Felo' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period published. The terms say Felo has no obligation to store submitted text, answers or history; the page says search history is visible to others only if the customer shares it.","status":"not_published","url":"https://felo.ai/enterprise/terms","locator":"Felo Enterprise terms, Article 10 (para 7), and Enterprise page 'Data Retention' tile","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Not stated; no security certification is named on the Enterprise page, privacy policy or terms.","status":"not_published","url":"https://felo.ai/enterprise","locator":"Felo Enterprise page ('Enhanced Security' tile), privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for AI features. The page lists user management (add, remove, set access rights) and single sign-on, but no admin switch for AI features.","status":"not_published","url":"https://felo.ai/enterprise","locator":"Felo Enterprise page, 'User Management' and 'Single Sign-On' tiles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the plan prices on the Felo Enterprise page are loaded by script and were not readable.","status":"not_captured","url":"https://felo.ai/enterprise","locator":"Felo Enterprise page, 'Choose the Plan That Suits You'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"figma","name":"Figma","vendor":"Figma, Inc.","category":"design-images-and-video","plans":[{"id":"T111","plan":"Professional","tier":"business","price":{"label":"€16 / mo","amount":16,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. On Starter and Professional, content training is on by default: Figma may use customer content, de-identified and aggregated, to train its AI models until an admin turns it off","status":"verified","url":"https://www.figma.com/ai/our-approach/","locator":"Section 'Managing AI settings'","url2":"https://www.figma.com/legal/ai-terms/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Yes. A team admin turns off the Content training setting; new content and edits after that date are not used, but earlier content may already have been used","status":"verified","url":"https://www.figma.com/legal/ai-terms/","locator":"Sections 'Training Figma AI' and 'Controlling AI Settings' (effective 24 Jun 2026)","url2":"https://www.figma.com/ai/our-approach/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Professional: choosing the hosting location is only for Enterprise plans","status":"verified","url":"https://www.figma.com/sub-processors/","locator":"Row 'Amazon Web Services, Inc.'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (AWS); a different hosting location can only be selected on Enterprise plans","status":"verified","url":"https://www.figma.com/sub-processors/","locator":"Row 'Amazon Web Services, Inc.' ('United States (or, for Enterprise plans, the hosting location selected)')","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Figma's DPA (last updated 30 Mar 2026) forms part of the agreement covering use of the Figma Platform","status":"verified","url":"https://www.figma.com/legal/dpa/","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 52 rows: 15 hosting and infrastructure, 9 AI model providers (including Anthropic, OpenAI, Google, Microsoft and AWS), 15 for the Figma Weave AI product, 13 for support; plus 15 Figma companies; nearly all in the US","status":"verified","url":"https://www.figma.com/sub-processors/","locator":"Page 'Figma Sub-processors' (last updated 22 Sep 2026)","url2":"https://www.figma.com/legal/dpa/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Figma, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Figma'","url2":"https://www.figma.com/legal/dpa/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer content is kept for the term; at the end, Figma deletes or returns it within 30 days at the customer's choice","status":"verified","url":"https://www.figma.com/legal/dpa/","locator":"Section 5 'Deletion and Return of Customer Personal Data'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2 and SOC 3; ISO/IEC 27001:2022, 27017, 27018:2019, 27701 and 42001; BSI C5; TISAX; EU Cloud Code of Conduct; CSA; FedRAMP Authorized","status":"verified","url":"https://www.figma.com/security/","locator":"Compliance sections","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: admins can turn off content training, but the switch that turned AI features off was removed on 24 Jul 2025 except on Enterprise (teams that turned AI off during the beta stay off)","status":"verified","url":"https://www.figma.com/ai/our-approach/","locator":"Section 'Managing AI settings' (paragraph on the beta setting)","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 16 per full seat/month billed annually, including 3,000 AI credits a month; VAT basis not stated","status":"verified","url":"https://www.figma.com/pricing/","locator":"Plan card 'Professional' with 'Annual' selected","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"fillout","name":"Fillout","vendor":"Restly, Inc. (d.b.a. Zite), operating Fillout","category":"research-forms-and-storage","plans":[{"id":"T630","plan":"Business","tier":"business","price":{"label":"$75 / mo","amount":75,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. Privacy policy only says Google Workspace data is not used to train generalized AI models; nothing on form responses or prompts.","status":"not_published","url":"https://www.fillout.com/privacy","locator":"Privacy Policy, Google Workspace APIs paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"User data obtained through Google Workspace APIs will not be used to develop, improve, or train generalized AI and/or machine learning models."},{"key":"training_opt_out","value":"Not stated. No setting or request process for training is described.","status":"not_published","url":"https://www.fillout.com/privacy","locator":"Privacy Policy, help/gdpr, help/security, help/ai-forms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Only on the Team and Enterprise plans, on request by email or chat; the pricing page does not list a Team plan and does not name Business, so EU hosting for Business is not confirmed.","status":"verified","url":"https://www.fillout.com/help/deployment-region","locator":"Deployment region > Switch to EU hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After upgrading to the Team or Enterprise plan (if you aren’t already on one), email support@fillout.com or start a chat on our website to request EU hosting."},{"key":"default_data_location","value":"United States by default for form submission data (hosted on AWS via Render).","status":"verified","url":"https://www.fillout.com/help/deployment-region","locator":"Deployment region > Overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, form submission data is stored and processed in the United States."},{"key":"dpa","value":"Yes. The standard DPA is available to any customer on any plan at main.fillout.com/dpa, and includes the EU Standard Contractual Clauses.","status":"verified","url":"https://www.fillout.com/help/gdpr","locator":"Fillout and GDPR-Compliant Forms > Requesting a DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"our standard DPA is available to any customer, on any plan, at main.fillout.com/dpa"},{"key":"subprocessor_list","value":"Yes, public: https://www.fillout.com/help/subprocessors. 18 rows for Fillout. AI providers: OpenAI (US) and Microsoft Azure (EU) for transcription, opt-in only.","status":"verified","url":"https://www.fillout.com/help/subprocessors","locator":"Fillout (by Zite) Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI AI + transcription US (does not apply for EU submission hosting customers)"},{"key":"dpf_status","value":"No listing found for search term 'Fillout', 'Restly', 'Zite'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fillout', 'Restly', 'Zite' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer can delete forms, responses or the account at any time; Fillout deletes them from servers and backups within 45 days of deletion or a request.","status":"verified","url":"https://www.fillout.com/help/gdpr","locator":"Fillout and GDPR-Compliant Forms > Privacy requests and exports","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fillout will permanently delete forms, individual form responses, or your user data from our servers and backups, if deleted in Fillout or requested from privacy@fillout.com, within 45 days."},{"key":"certifications","value":"1 named: SOC 2 Type 2.","status":"verified","url":"https://www.fillout.com/help/security","locator":"Security overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"are SOC 2 Type 2 compliant"},{"key":"admin_ai_controls","value":"Not on this plan. An admin can switch off all AI features organisation-wide (Settings > Security), but only on the Enterprise plan.","status":"verified","url":"https://www.fillout.com/help/disable-ai","locator":"Turn off AI features, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can turn off AI features for everyone in the organization from Settings → Security."},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: $75 per month billed annually ($900 a year), or $1,068 a year ($89 per month) billed monthly.","status":"not_published","url":"https://www.fillout.com/pricing","locator":"Pricing page, Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"fireflies","name":"Fireflies","vendor":"Fireflies.ai","category":"meetings-and-notes","plans":[{"id":"T39","plan":"Pro","tier":"personal","price":{"label":"$10 / user / mo","amount":10,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Fireflies does not use personal information for AI model training and contractually bars its vendors from doing so","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Use of information (last updated 28 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Fireflies says it does not use personal data to train large language models","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Section on US state privacy rights","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Pro: 'Private storage' at a preferred location is an Enterprise feature","status":"verified","url":"https://fireflies.ai/pricing","locator":"Enterprise card, 'Private storage'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States and other countries","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"International Transfers","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Click-to-sign DPA form (enter the counterparty's legal name)","status":"verified","url":"https://fireflies.ai/dpa","locator":"DPA signing page","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 17 entries; 16 in the US, 1 (Baseten) without a location; AI providers include OpenAI, Anthropic, Groq, Perplexity, Baseten and ElevenLabs","status":"verified","url":"https://trust.fireflies.ai/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fireflies'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active and deleted within 30 days after it is closed; users can delete single meetings; automatic deletion after a set period is Enterprise only","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Section 'Data Retention'","url2":"https://guide.fireflies.ai/articles/7870593373-learn-about-the-auto-delete-meeting-feature","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II and ISO/IEC 42001:2023; HIPAA with a BAA only for Enterprise with Private Storage","status":"verified","url":"https://trust.fireflies.ai/","locator":"Section 'Compliance & Certifications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly: workspace admins can decide who uses AI Skills, whether the AI Personal Assistant is on and what meeting data is kept; the guide does not state which of these settings Pro includes","status":"verified","url":"https://guide.fireflies.ai/articles/3422594586-team-settings-complete-guide-workspace-admins","locator":"Sections 'Recording & Privacy settings' and AI features settings","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 10 per seat/month billed annually (USD 18 monthly)","status":"not_published","url":"https://fireflies.ai/pricing","locator":"Plan card 'Pro' with 'Annual' selected","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T10","plan":"Business","tier":"business","price":{"label":"$19 / user / mo","amount":19,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Fireflies does not use personal information for AI model training and contractually bars vendors from doing so","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Use of information (last updated 28 Sep 2026)","url2":"https://fireflies.ai/security","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Fireflies says it does not collect, use or sell personal data to train large language models","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Section on US state privacy rights ('We do not collect, use, or sell personal data for the purpose of training large language models')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Business. 'Private storage' at a preferred location is an Enterprise feature (USD 39 per seat/month, annual only)","status":"verified","url":"https://fireflies.ai/pricing","locator":"Enterprise card, 'Private storage'","url2":"https://fireflies.ai/security","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States and other countries","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"International Transfers","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Click-to-sign DPA form (enter the counterparty's legal name)","status":"verified","url":"https://fireflies.ai/dpa","locator":"DPA signing page","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 17 entries; 16 located in the US, 1 (Baseten) without a location; LLM providers include OpenAI, Anthropic, Groq, Perplexity, Baseten, ElevenLabs","status":"verified","url":"https://trust.fireflies.ai/subprocessors","locator":"Subprocessors table, '1-10 of 17 results'","url2":"https://fireflies.ai/privacy-policy","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fireflies'","url2":"https://fireflies.ai/privacy-policy","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Recordings and account data are kept while the account is active and deleted within 30 days after it is closed; users can delete single meetings. Automatic deletion after a set period is Enterprise only. Third-party AI vendors keep no meeting content after processing","status":"verified","url":"https://fireflies.ai/privacy-policy","locator":"Section 'Data Retention'","url2":"https://guide.fireflies.ai/articles/7870593373-learn-about-the-auto-delete-meeting-feature","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II and ISO/IEC 42001:2023; HIPAA with a BAA only for Enterprise customers using Private Storage","status":"verified","url":"https://trust.fireflies.ai/","locator":"Section 'Compliance & Certifications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Workspace admins decide who can create and use AI Skills, whether the AI Personal Assistant is on, and whether meetings are auto-recorded and which of audio, transcript and summary are kept","status":"verified","url":"https://guide.fireflies.ai/articles/3422594586-team-settings-complete-guide-workspace-admins","locator":"Sections 'Recording & Privacy settings' and the AI features settings","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 19 per seat/month billed annually; USD 29 monthly","status":"not_published","url":"https://fireflies.ai/pricing","locator":"Business card","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"folk","name":"folk","vendor":"Folk Inc.","category":"sales-marketing-and-support","plans":[{"id":"T495","plan":"Standard","tier":"business","price":{"label":"€22 / user / mo","amount":22,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. folk states its AI features never train large language models on your data.","status":"verified","url":"https://help.folk.app/en/articles/15691546-how-folk-s-ai-features-use-your-conversational-data","locator":"How your data is handled","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Never used for training. Your data is not used to train any large language models (LLMs)."},{"key":"training_opt_out","value":"Nothing to do: folk states it does not use customer data to train AI models. Every AI feature can also be turned off.","status":"verified","url":"https://help.folk.app/en/articles/15691546-how-folk-s-ai-features-use-your-conversational-data","locator":"How your data is handled","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Never used for training. Your data is not used to train any large language models (LLMs)."},{"key":"eu_residency_option","value":"Yes, by default: platform servers are in Ireland and there is no separate setting. Some sub-processors (e.g. OpenAI, Apollo) are in the US, so not all processing stays in the EU.","status":"verified","url":"https://help.folk.app/en/articles/5007534-security-privacy","locator":"International data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"While our platform servers are located in Ireland, some of our authorized sub-processors operate outside the European Union, including in the United States."},{"key":"default_data_location","value":"Ireland, European Union (Amazon Web Services).","status":"verified","url":"https://help.folk.app/en/articles/5007534-security-privacy","locator":"Data hosting & international transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"folk's platform servers are located in Ireland, within the European Union, as specified in Article 9 of our Data Processing Agreement."},{"key":"dpa","value":"Yes. folk has a Data Processing Agreement defining its responsibilities as processor (hosting in Ireland is set in its Article 9, sub-processors in Appendix 2). How it is signed is not described.","status":"verified","url":"https://help.folk.app/en/articles/5007534-security-privacy","locator":"GDPR compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our Data Processing Agreement defines our respective responsibilities when processing personal data."},{"key":"subprocessor_list","value":"Yes. The privacy policy has a table of 26 processors with region and opt-out flag; the full list is in DPA Appendix 2. AI/model providers in the table: OpenAI (USA), Perplexity (USA), ElevenLabs (USA); enrichment: Apollo, Datagma, People Data Labs, Prospeo, DropContact.","status":"verified","url":"https://www.folk.app/privacy-policy","locator":"5. Recipient of Personal Data (processor table)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The recipients of Personal Data are the following: Processor Type of data Reason Region Can opt out TurboPuffer Contact data Search EU No"},{"key":"dpf_status","value":"No listing found for search term 'Folk'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Folk' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data kept while active. After a deletion request: removed from databases within 7 days, from backups within 730 days, from logs within 930 days. Call transcripts (if enabled) are kept indefinitely; call audio is not kept.","status":"verified","url":"https://www.folk.app/privacy-policy","locator":"8. Data retention, security, and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"from Our databases within 7 days after the deletion request date; from Our database backups within 730 days after the deletion request date;"},{"key":"certifications","value":"2 named: SOC 2 Type 1 completed (Type 2 in progress, report under NDA) and an annual CASA security assessment through Google's App Defense Alliance. Internal benchmarks (PCI DSS, AWS) are not certifications.","status":"verified","url":"https://help.folk.app/en/articles/5007534-security-privacy","locator":"Certifications & compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"folk has completed its SOC 2 Type 1 audit and is pursuing SOC 2 Type 2."},{"key":"admin_ai_controls","value":"Yes: folk says every AI feature can be turned off and enrichment providers like Perplexity can be disabled in settings. Who may do it (admin or user) is not stated.","status":"verified","url":"https://help.folk.app/en/articles/5007534-security-privacy","locator":"AI features & your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Every AI feature can be turned off."},{"key":"price_eur","value":"€22 per member/month billed yearly (€27 billed monthly) for Standard; VAT treatment not shown.","status":"verified","url":"https://www.folk.app/pricing","locator":"Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Standard Popular $24 22€/member/month $288 259€ billed yearly"}]}]},{"slug":"fonio","name":"fonio","vendor":"fonio.ai (fonio GmbH)","category":"phone-and-voice","plans":[{"id":"T70","plan":"1,000-minute plan","tier":"business","price":{"label":"€99 / mo","amount":99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated: fonio's DPA limits processing to providing the agreed service, but neither the DPA nor the terms mention AI training","status":"not_published","url":"https://www.fonio.ai/en/dpa","locator":"Section 2.4 ('The purpose of the processing is the contractually agreed provision of services')","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Not published: no training statement or setting is described","status":"not_published","url":"https://www.fonio.ai/en/dpa","locator":"Section 2.4","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"EU by default","status":"verified","url":"https://www.fonio.ai/en/dpa","locator":"Appendix 3, main providers","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"EU: hosting at Hetzner (Nuremberg, Falkenstein, Helsinki) and OVH (Germany, France); telephony via Twilio's Ireland region; AI providers used through EU regions or EU endpoints","status":"verified","url":"https://www.fonio.ai/en/dpa","locator":"Appendix 3 'Sub-processors' (version 16 Sep 2026), server locations","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. fonio's DPA (6 Aug 2026) applies to all clients and is part of the terms; German version prevails","status":"verified","url":"https://a.storyblok.com/f/293491369270379/x/fe75f3b08b/fonio-agb-en-06-08-2026-docx.pdf","locator":"Contract documents list ('Data Processing Agreement (DPA) … fonio.ai/dpa all Clients')","url2":"https://www.fonio.ai/en/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public in DPA Appendix 3 (16 Sep 2026): 10 main providers (Hetzner, OVH, Twilio Ireland, Voxbone, LiveKit, Soniox, OpenAI Ireland, Inworld AI, Mailgun, New Relic) and fallback providers including Deepgram, Google, ElevenLabs, Nylas and LangChain","status":"verified","url":"https://www.fonio.ai/en/dpa","locator":"Appendix 3 'Main Providers' and 'Fallback Providers'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, fonio GmbH, Vienna); its US sub-processors rely on the DPF or SCCs per Appendix 3","status":"verified","url":"https://www.fonio.ai/en/dpa","locator":"DPA cover page ('Data processor fonio GmbH … Wien, Austria')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period for call data is stated; after the contract ends, clients can export data for 30 days and fonio destroys data 30 days after termination unless the client instructs otherwise; Twilio keeps no audio","status":"verified","url":"https://www.fonio.ai/en/dpa","locator":"Section 7 (deletion and return) and Appendix 3 (Twilio: zero data retention)","url2":"https://a.storyblok.com/f/293491369270379/x/fe75f3b08b/fonio-agb-en-06-08-2026-docx.pdf","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"None of its own listed; fonio shows 'GDPR compliant' and 'EU AI Act compliant' badges and cites its hosts' certifications (Hetzner BSI C5, OVH ISO 27001)","status":"not_published","url":"https://www.fonio.ai/en/privacy-policy","locator":"Footer badges","url2":"https://www.fonio.ai/en/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not described in the public documents","status":"not_published","url":"https://www.fonio.ai/en/pricing","locator":"Plan features","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 99 per month billed yearly, or EUR 119 monthly, for 1,000 minutes and one phone number (extra numbers EUR 9/month); VAT basis not stated","status":"verified","url":"https://www.fonio.ai/en/pricing","locator":"AI Phone Assistant plan cards","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"formstack","name":"Formstack Forms","vendor":"Intellistack, LLC (formerly Formstack, LLC), Fishers, Indiana","category":"research-forms-and-storage","plans":[{"id":"T631","plan":"","tier":"business","price":{"label":"$83 / mo","amount":83,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per Intellistack's Legal FAQ: it does not use customer content or form data to train or improve AI models. The FAQ says it is informational and not part of the contract.","status":"verified","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > AI Functionality, question 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Intellistack does not use customer content or form data to train or improve AI models within any of its products."},{"key":"training_opt_out","value":"Nothing to do: the Legal FAQ (informational, not part of the contract) says it does not train AI models on customer content or form data.","status":"verified","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > AI Functionality, question 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Intellistack does not use customer content or form data to train or improve AI models within any of its products."},{"key":"eu_residency_option","value":"Not stated. Only a general line that hosting is regionally appropriate; no EU setting, plan or request process is described.","status":"not_published","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > Privacy & Security, questions 2 and 8","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This does not affect data storage, which remains within the contracted region."},{"key":"default_data_location","value":"Not stated as a country. Hosted in AWS and Microsoft Azure data centres chosen by the customer's region and compliance needs; the privacy policy says the company is in the United States.","status":"not_published","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > Privacy & Security, question 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is hosted in secure, regionally appropriate AWS and Microsoft Azure data centers, based on the customer’s region and compliance requirements."},{"key":"dpa","value":"Yes. The DPA is part of the Software Services Agreement and is pre-signed by Intellistack; the customer accepts it via an executable link or by emailing a completed copy to legal@intellistack.com.","status":"verified","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > Privacy & Security, question 5; DPA 'How to execute this DPA'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes. The DPA is incorporated into our Software Services Agreement and available at intellistack.com/legal."},{"key":"subprocessor_list","value":"Yes, but only as a PDF in the Trust Center (https://trust.intellistack.com/). The PDF could not be read, so the count and AI providers are not captured.","status":"not_captured","url":"https://trust.intellistack.com/","locator":"Trust Center > Featured Documents > Sub-Processors (pdf)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Intellistack; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Intellistack'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period published. Data is kept while the service is provided; after the contract ends Intellistack may permanently delete it at its discretion, so download your data first.","status":"verified","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Software Services Agreement 7.4 Effect of Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following termination, Intellistack shall have no obligation with respect to storage of Customer Data and may, in its sole discretion, permanently delete Customer Data in accordance with its internal policies and procedures."},{"key":"certifications","value":"Trust Center names SOC 2 Type II, HIPAA, PCI, GDPR, CCPA, TX-RAMP and three DPF badges (9 badges); documents also include an ISO 27001 engagement summary letter.","status":"verified","url":"https://trust.intellistack.com/","locator":"Trust Center > Badges","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"CCPA EU-US DPF GDPR HIPAA PCI SOC 2 Type II Swiss-US DPF TX-RAMP UK-US DPF"},{"key":"admin_ai_controls","value":"Yes. In Formstack Forms, AI ('Forms AI') is optional and an Org Admin can turn it on or off in account settings.","status":"verified","url":"https://vault.pactsafe.io/s/e3ac42ea-21ac-4fd3-8f4b-20a55a3eaefc/legal.html?g=19","locator":"Legal, Privacy & Security FAQ > AI Functionality, question 1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In Formstack Forms, AI (known as “Forms AI”) is optional and can be turned on or off by an Org Admin in account settings."},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: from $83 per month billed annually ($99 per month on monthly billing), 1 builder user, 25 forms.","status":"not_published","url":"https://www.formstack.com/pricing","locator":"Pricing page, Forms plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"foxit-ai","name":"Foxit AI Assistant","vendor":"Foxit Software Inc. (Fremont, USA) and Foxit Europe GmbH (Berlin)","category":"documents-hr-and-finance","plans":[{"id":"T585","plan":"Subscription","tier":"personal","price":{"label":"$4.99 / mo","amount":4.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Foxit says it does not, and does not let its subprocessors, use customer documents, prompts or AI outputs to train or fine-tune AI models unless the customer expressly authorises it.","status":"verified","url":"https://www.foxit.com/company/ai-assistant-security-privacy/","locator":"Purpose limitation; Use of customer content","url2":"https://www.foxit.com/company/privacy-policy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Foxit does not—and does not authorize or instruct its subprocessors to—use customer documents, prompts, AI outputs, or other customer content to train or fine-tune AI or machine learning models unless the customer expressly authorizes that use."},{"key":"training_opt_out","value":"Nothing to do: Foxit states it does not train on customer content unless you expressly authorise it. Storing chat histories is a separate preference you can switch off.","status":"verified","url":"https://www.foxit.com/company/ai-assistant-security-privacy/","locator":"Purpose limitation","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Foxit does not—and does not authorize or instruct its subprocessors to—use customer documents, prompts, AI outputs, or other customer content to train or fine-tune AI or machine learning models unless the customer expressly authorizes that use."},{"key":"eu_residency_option","value":"Yes, where regional deployment is supported: cloud AI Assistant and Workspace data is routed to the customer's assigned regional instance, and regions may include the EU. Account email and password stay in the US; some provider processing can fall outside the region. No customer-facing region setting is described.","status":"verified","url":"https://www.foxit.com/company/ai-assistant-security-privacy/","locator":"Processing locations and international transfers","url2":"https://www.foxit.com/company/privacy-policy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where regional deployment is supported, customer business data is routed to the customer's assigned regional instance and is logically isolated from business data in other regional instances."},{"key":"default_data_location","value":"For EEA, UK and Swiss customers, content is stored on a local server (Foxit servers are in the US, Germany, Canada, Australia and Japan); email and password are held in the US. AI processing on Azure runs in the same region as the request.","status":"verified","url":"https://www.foxit.com/company/privacy-policy/","locator":"10. Server locations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For customers from the European Economic Area, the UK, Switzerland, Canada, Australia, or Japan, your information will be stored on the local server"},{"key":"dpa","value":"Not stated; no data processing agreement for customers found in the privacy policy, terms of service or trust center.","status":"not_published","url":"https://www.foxit.com/company/privacy-policy/","locator":"Privacy policy, terms of service, trust center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No full public sub-processor list found. The AI Assistant security page names four principal providers: Microsoft Azure and Google Cloud (AI models), Exa (web search), AWS (hosting). The privacy policy also names Azure OpenAI, Document Intelligence, OCR and Text to Speech.","status":"not_published","url":"https://www.foxit.com/company/privacy-policy/","locator":"7.16 Azure AI Services; privacy policy, terms, trust center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Foxit'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Foxit' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Documents sent to Azure AI are stored temporarily and deleted within 24 hours (Language service up to 48 hours). Chat histories are kept only as long as needed; you can choose not to store them or ask for deletion.","status":"verified","url":"https://www.foxit.com/company/privacy-policy/","locator":"7.16 Azure AI Services","url2":"https://www.foxit.com/ai/pricing/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"such data and extracted results will be temporarily stored in Azure Storage in the same region as the request and will be deleted within 24 hours"},{"key":"certifications","value":"SOC 2 Type 2 (1 certification named). The trust center also lists GDPR support, HIPAA readiness and accessibility/procurement items (TAA, Section 508, VPAT).","status":"verified","url":"https://www.foxit.com/trust-center/","locator":"Certifications and Attestations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Security, availability, confidentiality, and privacy trust services criteria."},{"key":"admin_ai_controls","value":"Not stated; the Foxit Admin Console pools and allocates paid AI credits among members, but no admin switch to turn AI off is described.","status":"not_published","url":"https://www.foxit.com/ai/pricing/","locator":"FAQ: How does credit pooling work for teams?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $4.99 per month or $49.99 per year for Foxit AI Assistant, with 2,000 AI credits a month.","status":"not_published","url":"https://www.foxit.com/ai/pricing/","locator":"FAQ: How many AI credits come with a Foxit account?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Foxit AI Assistant subscribers receive 2,000 AI credits per month for $4.99 per month or $49.99 per year."}]}]},{"slug":"framer","name":"Framer Pro","vendor":"Framer B.V.","category":"code-and-app-builders","plans":[{"id":"T543","plan":"site plan","tier":"business","price":{"label":"$30 / mo","amount":30,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless AI training is switched off in the Workspace settings: on non-Enterprise plans Framer may use AI Inputs and Outputs to train its AI models. Its third-party model providers may not train on them.","status":"verified","url":"https://www.framer.com/legal/ai-notice","locator":"7.3 Customers on a non-Enterprise plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless AI model training is disabled in the applicable Workspace settings, Customers on a non-Enterprise plan grant Framer a worldwide, non-exclusive license to use their Inputs and Outputs to train and improve Framer's AI models. Where AI training is disabled"},{"key":"training_opt_out","value":"Turn off AI training in the Workspace settings; Framer then stops using that Workspace's Inputs and Outputs for training going forward. Enterprise plans are not trained on.","status":"verified","url":"https://www.framer.com/legal/ai-notice","locator":"7.3 Customers on a non-Enterprise plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where AI training is disabled in the applicable Workspace settings, Framer will not use Inputs or Outputs from that Workspace to train Framer's AI models going forward. ## Disclaimer 8.1"},{"key":"eu_residency_option","value":"Not stated; no setting to keep data in the EU is described on the security page, DPA or AI notice.","status":"not_published","url":"https://www.framer.com/legal/security","locator":"Data Security; DPA and AI notice also checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Hosted on AWS in the United States, with additional hosting infrastructure in Europe and Asia-Pacific. A default region per customer is not stated.","status":"verified","url":"https://www.framer.com/legal/security","locator":"Data Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All of Framer’s services are hosted in Amazon Web Services (AWS) facilities in the United States, with additional hosting infrastructure across Europe and Asia-Pacific, and global acceleration across 200+ edge"},{"key":"dpa","value":"Yes: a DPA with Framer B.V. is incorporated into the Terms of Service.","status":"verified","url":"https://www.framer.com/legal/data-processing-addendum","locator":"Opening clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) is a part of, governed by, and incorporated by reference into the Terms of Service or the Master Subscription Agreement, as applicable (“Agreement”), between: Framer"},{"key":"subprocessor_list","value":"A sub-processor page exists in Framer's Trust Center (Vanta), which needs a browser to read; no count or AI providers captured.","status":"not_captured","url":"https://www.framer.com/legal/ai-notice","locator":"5.1 Third-Party Model","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Framer B.V., Amsterdam)","status":"verified","url":"https://www.framer.com/legal/ai-notice","locator":"Purpose and scope","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This artificial intelligence (“AI”) notice (“AI Notice”) is applicable to Framer B.V., a Dutch limited liability company, and its affiliates"},{"key":"data_retention","value":"On written request after termination Framer irreversibly and securely deletes your Content; the DPA also deletes personal data on written request. Retention of AI inputs is not stated.","status":"verified","url":"https://www.framer.com/legal/terms-of-service","locator":"18.4 Effects","url2":"https://www.framer.com/legal/data-processing-addendum","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon written request, Framer will irreversibly and securely delete Content (including copies) except to the extent Framer is required to"},{"key":"certifications","value":"2 named: ISO 27001 and SOC 2 Type 2 (reports for Enterprise customers on request).","status":"verified","url":"https://www.framer.com/legal/security","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Framer has successfully completed the SOC 2 Type 2 audit."},{"key":"admin_ai_controls","value":"Partly: Workspace settings can switch AI model training off; a setting to turn AI features off organisation-wide is not described.","status":"not_published","url":"https://www.framer.com/legal/ai-notice","locator":"7.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $30 per month for the Pro site plan (yearly billing shown).","status":"not_published","url":"https://www.framer.com/pricing","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"frase","name":"Frase","vendor":"Copysmith AI, Inc. (operating Frase; terms name Frase, Inc.)","category":"sales-marketing-and-support","plans":[{"id":"T528","plan":"Professional","tier":"business","price":{"label":"$103 / mo","amount":103,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for generalized AI/ML models: Frase says it does not use Customer Data to train generalized models that learn from you for other customers; it does use anonymised, aggregated data to improve its services and for industry benchmarks.","status":"verified","url":"https://frase.io/company/terms","locator":"6. Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Frase does not use Customer Data to develop or train generalized artificial intelligence or machine learning models"},{"key":"training_opt_out","value":"Nothing to do for generalized model training, which the terms say Frase does not do. To stop your data feeding anonymised industry benchmarks, email support@frase.io (takes effect within 24 hours).","status":"verified","url":"https://frase.io/company/terms","locator":"6.c Opt-Out","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can opt your account out of benchmark contribution at any time by emailing support@frase.io"},{"key":"eu_residency_option","value":"Not stated; no EU data location option found.","status":"not_published","url":"https://frase.io/company/privacy","locator":"Privacy policy; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no country or hosting provider named for customer data.","status":"not_published","url":"https://frase.io/company/privacy","locator":"Privacy policy; terms; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for this plan; the terms mention a Data Processing Addendum only for enterprise customers, and none is published.","status":"not_published","url":"https://frase.io/company/terms","locator":"6.c Opt-Out","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"or, for enterprise customers, through your Data Processing Addendum"},{"key":"subprocessor_list","value":"Not captured: no sub-processor list on frase.io pages; the trust centre could not be read.","status":"not_captured","url":"https://trust.copysmith.ai/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Copysmith', 'Frase'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Copysmith', 'Frase' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account information is kept while the account is active and a reasonable period afterwards; team-managed accounts keep content as the organisation's administrator requires. No fixed number of days.","status":"verified","url":"https://frase.io/company/privacy","locator":"How Long We Keep Your Personal Information: Account Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services."},{"key":"certifications","value":"1 named: SOC 2 Type II (attested); GDPR compliance is claimed but is not a certificate.","status":"verified","url":"https://www.frase.io/security","locator":"Security & Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Frase is SOC 2 Type II attested and GDPR compliant."},{"key":"admin_ai_controls","value":"Not stated; the pricing page mentions an autonomy setting for publishing but no organisation-wide switch for AI features.","status":"not_published","url":"https://www.frase.io/pricing","locator":"Professional plan; terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $103 per month billed yearly ($129 per month on monthly billing), 3 seats and 5 sites.","status":"not_published","url":"https://www.frase.io/pricing","locator":"Professional plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"freepik-ai","name":"Freepik AI","vendor":"Magnific AI, S.L.U. (formerly Freepik)","category":"design-images-and-video","plans":[{"id":"T570","plan":"Premium+","tier":"personal","price":{"label":"€27 / mo","amount":27,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for uploaded images and voices: the policy says they are never used to train Magnific's or its AI providers' models. Text prompts and generated outputs fall under a service-improvement purpose (right to object); training on them is not mentioned. Pricing page: 'No model training on your data'.","status":"verified","url":"https://www.magnific.com/legal/privacy","locator":"4. Privacy Policy for AI Suite Services, purposes","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Under no circumstances will we use your images or voices, or those of third parties that you upload to our platform, to train or improve our artificial intelligence models or those of third-party providers."},{"key":"training_opt_out","value":"Nothing to do for uploaded images and voices: the vendor states it never trains on them. For text prompts and outputs used for service improvement, the policy gives a right to object (data-protection contact rpd@magnific.com); no in-app switch is described.","status":"verified","url":"https://www.magnific.com/legal/privacy","locator":"4. Privacy Policy for AI Suite Services, purposes; 8. rights (right to object)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You have the right to object to this processing based on our legitimate interests."},{"key":"eu_residency_option","value":"Not stated; no EU data-residency setting found. The policy says the user decides which third-party model to use, including where it processes data.","status":"not_published","url":"https://www.magnific.com/legal/privacy","locator":"Policy section 4 (AI Suite) and section 10","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no storage country or hosting provider is named. The policy says data can be transferred outside the EU and model providers process it where they are located.","status":"not_published","url":"https://www.magnific.com/legal/privacy","locator":"Policy sections 4 and 10 (International Transfers)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, on request: Individual and Business plan users can ask for a DPA by emailing the data-protection address and giving account details.","status":"verified","url":"https://www.magnific.com/legal/privacy","locator":"4. Privacy Policy for AI Suite Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Users of Individual and Business, and plans who require the formalization of a Data Processing Agreement (DPA) may request it by sending a communication to rpd@magnific.com"},{"key":"subprocessor_list","value":"No public list. The policy says the list of providers can be requested by email; model providers act as sub-processors and keep data up to 30 days. No model provider is named.","status":"not_published","url":"https://www.magnific.com/legal/privacy","locator":"Section 5 recipients; section 4 (AI Suite)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These providers render a service to us as sub-processors and personal data is retained for a maximum of 30 days after the generation of the Output."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Magnific AI, S.L.U., Málaga, Spain)","status":"verified","url":"https://www.magnific.com/legal/privacy","locator":"Data controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Magnific AI, S.L.U., with Tax ID B-93183366 and registered office at 13 Molina Lario Street, 5th floor, 29015 Málaga, Spain."},{"key":"data_retention","value":"Uploaded images and audio are deleted immediately after generation. Prompts and outputs are kept for the life of the contract, then blocked for the legal limitation period. Model providers keep data up to 30 days.","status":"verified","url":"https://www.magnific.com/legal/privacy","locator":"4. AI Suite, Retention Period","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Images and audio files uploaded by the User are deleted immediately after the generation of the synthetic content based on them."},{"key":"certifications","value":"Not stated; no security certification found in the legal pages. The security page returned 403 and needs a browser.","status":"not_published","url":"https://www.magnific.com/legal/privacy","locator":"Privacy policy, terms of use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide AI switch described for the Individual plan. The Business plan page returned 403.","status":"not_published","url":"https://www.freepik.com/pricing","locator":"Pricing page, Premium+ feature list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 27 per month when billed annually (EUR 36 on monthly billing), prices exclude VAT. Premium+ on the Individual tab; the Teams tab was not readable.","status":"verified","url":"https://www.freepik.com/pricing","locator":"Pricing, Individual tab, Premium+","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Best value For creatives who need unlimited generations and full AI access €36€27/monthBilled annually"}]}]},{"slug":"freshdesk","name":"Freshdesk","vendor":"Freshworks Inc. (Delaware, USA)","category":"phone-and-voice","plans":[{"id":"T444","plan":"Pro","tier":"business","price":{"label":"$55 / user / mo","amount":55,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the customer opts out: using the AI services counts as consent to AI Training on Customer Data and AI Output. Freshworks says it will not use or permit Customer Data to train third-party hosted generative models, including Microsoft Azure OpenAI.","status":"verified","url":"https://www.freshworks.com/terms/supplemental-terms/","locator":"4.c AI Training Consent","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By using the AI Services, unless Customer opts-out as further set forth below and in the Documentation Customer grants Freshworks a royalty-free license to use its Customer Data and AI Output for AI Training"},{"key":"training_opt_out","value":"Email support@freshworks.com to opt out of Collaborative Models, or of all AI Training (this turns off AI services that train on customer data). An admin can also switch AI Services off entirely in the administrative console.","status":"verified","url":"https://www.freshworks.com/terms/supplemental-terms/","locator":"4.d Opt-Out","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers who wish to opt out of their Customer Data being used to train both Collaborative Models and Custom Models may do so by contacting support@freshworks.com"},{"key":"eu_residency_option","value":"Yes, EU is one of five hosting regions and is picked by location or plan; the page does not say how to choose it on the Pro plan.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"Infrastructure & Services Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"resides in corresponding data center facilities in the mentioned region based on location or choice(plan) of the Controller"},{"key":"default_data_location","value":"Amazon Web Services data centres in one of five regions (US, EU, AUS, IND, ME), chosen by the customer's location or plan; the default for a given account is not stated.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"Infrastructure & Services Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"resides in corresponding data center facilities in the mentioned region based on location or choice(plan) of the Controller"},{"key":"dpa","value":"Yes. The DPA is part of the terms and applies on acceptance; a signed copy can be requested from the DPA page.","status":"verified","url":"https://www.freshworks.com/terms/","locator":"Data Security and Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The parties will comply with the terms of the DPA, which is incorporated into this Agreement by this reference"},{"key":"subprocessor_list","value":"Public list at https://www.freshworks.com/privacy/sub-processor/ (effective 30 Sep 2026): 26 third-party rows (20 companies) plus 8 Freshworks group entities. Freshdesk AI uses Microsoft Azure OpenAI; Google Vertex with Anthropic models is listed for FireHydrant only.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"List of Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Freshworks commits to keep this list updated regularly"},{"key":"dpf_status","value":"Active (Freshworks, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Freshworks'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer can download or delete data anytime. After closing the account there is a 14-day export window, then Freshworks may keep data up to 3 months before deleting it. In-service retention periods are not stated.","status":"verified","url":"https://www.freshworks.com/terms/","locator":"Data Export and Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Beyond such Data Export Period, Freshworks reserves the right to retain Customer data for up to three (3) months before deleting all Customer Data"},{"key":"certifications","value":"Not captured: the security page sends readers to the Freshworks Trust Center, which needs a browser.","status":"not_captured","url":"https://trust.freshworks.com/","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes: the sub-processor list says customers can enable or disable the AI services through their admin console.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"Microsoft Corporation row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers will have the ability to enable or disable the services via their admin console."},{"key":"price_eur","value":"Shown in USD only: $55 per agent/month, billed annually (Pro plan; Freddy AI Copilot is a $29 per agent/month add-on).","status":"not_published","url":"https://www.freshworks.com/freshdesk/pricing/","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"freshsales","name":"Freshsales","vendor":"Freshworks Inc.","category":"sales-marketing-and-support","plans":[{"id":"T497","plan":"Growth","tier":"business","price":{"label":"$9 / user / mo","amount":9,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless you opt out. By using AI Services you license Freshworks to use your data and AI output to train its AI models (de-identified). It says it will not let customer data train third-party hosted models such as Azure OpenAI.","status":"verified","url":"https://www.freshworks.com/terms/supplemental-terms/","locator":"4(c) AI Training Consent","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"unless Customer opts-out as further set forth below and in the Documentation Customer grants Freshworks a royalty-free license to use its Customer Data and AI Output for AI Training and expressly consents to such AI Training."},{"key":"training_opt_out","value":"Email support@freshworks.com to opt out of training Collaborative Models or of all AI Training (stops within 7 business days; AI services that train on your data are then turned off). An admin can switch AI Services off in the administrative console.","status":"verified","url":"https://www.freshworks.com/terms/supplemental-terms/","locator":"4(d)(ii) Opt Out of All AI Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers who wish to opt out of their Customer Data being used to train both Collaborative Models and Custom Models may do so by contacting support@freshworks.com and indicating they wish to opt out of all AI Training."},{"key":"eu_residency_option","value":"Yes, an EU region exists for Freshsales: the sub-processor table lists AWS data-centre regions US, EU, AUS, IND, ME for Freshsales. How the region is chosen is not stated.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"List of Sub-processors, Amazon Web Services row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Primary cloud infrastructure provider for Freshworks, where all SaaS applications are hosted."},{"key":"default_data_location","value":"Not stated as a default. The DPA says storage is either in the EU or outside it, depending on the Freshworks product; the AWS regions listed are US, EU, AUS, IND, ME.","status":"not_published","url":"https://www.freshworks.com/data-processing-addendum/","locator":"Section 5(c) Location of Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data that Freshworks processes for Customer as a Processor may be stored in the EU or outside of the EU, depending on the Freshworks product."},{"key":"dpa","value":"Yes. Freshworks provides all customers a DPA covering its obligations under privacy laws; the text is published at freshworks.com/data-processing-addendum/.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"Agreements","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Freshworks provides all customers a data processing agreement (DPA) that covers its obligations under applicable privacy legislations."},{"key":"subprocessor_list","value":"Yes: https://www.freshworks.com/privacy/sub-processor/ lists 26 sub-processor rows plus 8 group companies; 14 rows apply to Freshsales. AI provider for Freshsales: Microsoft (Azure OpenAI; US, EU, IND, AUS). Google Vertex/Anthropic appear for FireHydrant only.","status":"verified","url":"https://www.freshworks.com/privacy/sub-processor/","locator":"Sub-processors page intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Freshworks uses sub-processors (listed below), to assist in providing services as described in our Terms of Service or a similar services agreement customers may have signed with us."},{"key":"dpf_status","value":"Active (Freshworks, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Freshworks'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After the account closes, data can be exported for 14 days; Freshworks may keep it up to 3 more months before deleting; it cannot be recovered after deletion. You can download or delete data any time during the term.","status":"verified","url":"https://www.freshworks.com/terms/","locator":"Data Export and Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Beyond such Data Export Period, Freshworks reserves the right to retain Customer data for up to three (3) months before deleting all Customer Data in the normal course of operation"},{"key":"certifications","value":"Not captured: Freshworks' security page sends readers to its Trust Center for certifications, which needs a browser.","status":"not_captured","url":"https://www.freshworks.com/security/","locator":"Freshworks Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. An admin can turn off AI Services at any time in the administrative console (fees still apply for the term).","status":"verified","url":"https://www.freshworks.com/terms/supplemental-terms/","locator":"4(d)(iii) Opt Out of AI Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers who wish to turn off AI Services may do so at any time and at their sole discretion by navigating to the administrative console within the Services and turning off such AI Services."},{"key":"price_eur","value":"Shown in USD only: Growth is $9 per user/month billed annually.","status":"not_published","url":"https://www.freshworks.com/crm/pricing/","locator":"Freshsales plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$9/user/month, billed annuallyFor startups and SMBs"}]}]},{"slug":"front","name":"Front","vendor":"FrontApp, Inc.","category":"writing-and-email","plans":[{"id":"T363","plan":"Professional","tier":"business","price":{"label":"$65 / user / mo","amount":65,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in a limited way, while an admin has AI Features switched on: Front may use that data to improve its services and AI instructions (pricing FAQ: 'further train your model', kept per company). Its AI providers are barred from training foundation models on it","status":"verified","url":"https://help.front.com/en/articles/2729408","locator":"FAQ > How does AI Features use my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we may use the data you share with us (like text or other content) through AI Features to improve the services we provide to you as well."},{"key":"training_opt_out","value":"An admin turns off 'AI Features' in Settings; this stops new data from being processed through the AI features and removes access to them","status":"verified","url":"https://help.front.com/en/articles/2729408","locator":"FAQ > How do I enable or disable Front's AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you can turn off the AI Features in your settings at any time."},{"key":"eu_residency_option","value":"Yes: an EU Service Region can be chosen for the account (security page, listed under 'Enterprise features'); whether Professional includes it is not stated","status":"verified","url":"https://front.com/security","locator":"Enterprise features > Regional Data Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We support data hosting options in the U.S. or the EU."},{"key":"default_data_location","value":"Amazon Web Services, in the United States or the EU depending on the Service Region chosen for the account; the default is not stated","status":"verified","url":"https://front.com/legal/list-of-subprocessors","locator":"Third Party Subprocessors > footnote 1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you choose the United States Service Region the subprocessor location is primarily the United States"},{"key":"dpa","value":"Yes: a public DPA supplements and forms part of the SaaS Agreement with FrontApp, Inc. and includes EU Standard Contractual Clauses","status":"verified","url":"https://front.com/legal/data-processing-addendum","locator":"DPA, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"supplements and forms part of the Software-as-a-Service Agreement between FrontApp, Inc."},{"key":"subprocessor_list","value":"Yes, public at https://front.com/legal/list-of-subprocessors (effective 13 Jul 2026): 18 rows (15 third parties, 3 Front group entities). AI providers: OpenAI, Azure/Microsoft, Amazon AWS, Google, Anthropic (customer support)","status":"verified","url":"https://front.com/legal/list-of-subprocessors","locator":"Front Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A subprocessor is a third-party entity engaged by Front to perform services"},{"key":"dpf_status","value":"Active (FrontApp, Inc; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'FrontApp'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"AI providers keep nothing after each request. After the contract ends Front returns or deletes customer personal data per customer instructions (legal-hold exceptions); deletion requests are generally processed within 30 days; backups kept 7 days","status":"verified","url":"https://front.com/legal/data-processing-addendum","locator":"DPA > Deletion or return of Customer Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon expiration or earlier termination of the Agreement, Front shall return and/or delete all Customer Personal Data"},{"key":"certifications","value":"SOC 2 Type II and ISO 27001 (2 certifications; reports available on request)","status":"verified","url":"https://front.com/security","locator":"Compliance ready","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We’re proud to be SOC 2 Type II and ISO 27001 certified, ensuring that client data is processed in a secure manner."},{"key":"admin_ai_controls","value":"Yes: a company administrator toggles 'AI Features' on or off in Settings for the organisation","status":"verified","url":"https://help.front.com/en/articles/2729408","locator":"FAQ > How do I enable or disable Front's AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To enable Front’s AI Features, your company administrator can go to Settings and toggle on “AI Features.”"},{"key":"price_eur","value":"Shown in USD only: $65 per seat/month, billed annually (Professional, up to 50 seats; VAT not shown)","status":"not_published","url":"https://front.com/pricing","locator":"Pricing > Professional","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"fyxer","name":"Fyxer","vendor":"Fyxer AI Limited","category":"writing-and-email","plans":[{"id":"T116","plan":"Team","tier":"business","price":{"label":"$64 / user / mo","amount":64,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Fyxer's own models: its terms bar the AI model providers from training on user data, and let Fyxer train machine-learning algorithms on aggregated, anonymised usage data (data about how the service is used)","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Clauses 4.2 (Usage Data) and 'Language Model Providers'","url2":"https://www.fyxer.com/security","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not published: no setting is documented","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Clause 4.2","url2":"https://www.fyxer.com/security","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Schedule 1","url2":"https://www.fyxer.com/security","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: the terms allow transfers outside the EEA wherever Fyxer's sub-processors operate","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Schedule 1, 'Transfer of data outside the EEA'","url2":"https://www.fyxer.com/security","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. A Data Processing Agreement is Schedule 1 of Fyxer's Terms of Use, with Fyxer AI Limited as processor","status":"verified","url":"https://app.fyxer.com/terms-of-use","locator":"Schedule 1 (Data Processing Agreement)","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not public: Fyxer provides its list of sub-processors on request","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Schedule 1, Sub-Processors clause","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (UK vendor, Fyxer AI Limited; the DPF covers US organisations). Search 'Fyxer' returned no results","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Fyxer' returned no results","url2":"https://app.fyxer.com/terms-of-use","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: after the agreement ends Fyxer deletes or returns personal data within a reasonable time at the user's written request","status":"not_published","url":"https://app.fyxer.com/terms-of-use","locator":"Schedule 1, deletion clause","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II and ISO 27001 (vendor statement); HIPAA and GDPR compliance claimed","status":"vendor_statement","url":"https://www.fyxer.com/security","locator":"Security page FAQ","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not published as an AI switch: the product is the AI assistant; the security page mentions central admin controls for permissions, security settings and usage policies","status":"not_published","url":"https://www.fyxer.com/security","locator":"Paragraph on centralized admin controls","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 64 per person/month billed annually (USD 99 monthly)","status":"not_published","url":"https://www.fyxer.com/pricing","locator":"Plan card 'Team'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"gamma","name":"Gamma","vendor":"Gamma Tech, Inc.","category":"design-images-and-video","plans":[{"id":"T88","plan":"Business","tier":"business","price":{"label":"€35 / user / mo","amount":35,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Gamma does not train on content from Team or Business plans; other plans are trained on unless privacy controls for AI training are on","status":"verified","url":"https://gamma.app/terms","locator":"Section 4.5 'AI Model Training' (terms effective 9 Sep 2025)","url2":"https://gamma.app/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off on Business; on Free, Plus, Pro and Ultra, training stops only if the plan's AI-training privacy control is turned on","status":"verified","url":"https://gamma.app/terms","locator":"Section 4.5 'AI Model Training'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://gamma.app/pricing","locator":"Business and Enterprise features","url2":"https://gamma.app/subprocessors","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: hosting on AWS and Google in the US; data may be transferred to the US or other countries","status":"verified","url":"https://gamma.app/subprocessors","locator":"Rows 'Amazon Web Services' and 'Google'","url2":"https://gamma.app/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Gamma's Data Processing Addendum applies where personal data is processed (terms section 4.8)","status":"verified","url":"https://gamma.app/terms","locator":"Section 4.8 'Data Processing Addendum'","url2":"https://trust.gamma.app/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 36 entries, nearly all in the US; 13 AI providers including OpenAI, Anthropic, Google, Microsoft, Perplexity, Black Forest Labs, Ideogram, Runway and Leonardo (Australia)","status":"verified","url":"https://gamma.app/subprocessors","locator":"Table 'Sub-processor | Purpose | Location'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Gamma'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Gamma' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: personal information is kept as long as needed for its purposes, legal requirements and fraud prevention","status":"not_published","url":"https://gamma.app/privacy","locator":"Section 'Retention' (policy effective 10 Apr 2025)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II (2025 report, documentation on request)","status":"verified","url":"https://trust.gamma.app/","locator":"Compliance section","url2":"https://gamma.app/pricing","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Business adds SSO and 'advanced data controls'; advanced admin controls and connector and API governance are Enterprise","status":"verified","url":"https://gamma.app/pricing","locator":"Business and Enterprise feature lists","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 35 per seat/month billed annually (EUR 420 per seat per year); VAT basis not stated","status":"verified","url":"https://gamma.app/pricing","locator":"Tab 'Business', card 'Business'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"gemini","name":"Gemini app","vendor":"Google","category":"assistants","plans":[{"id":"T30","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. For users 18 and over, Keep Activity is on by default, and Google uses that activity to improve its services, including training generative AI models, with human reviewers reading some chats","status":"verified","url":"https://support.google.com/gemini/answer/13278892?hl=en","locator":"Section 'Turn off Keep Activity' ('If you're 18 or over, Keep Activity is on by default')","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off Keep Activity: gemini.google.com > Activity > Turn off (or Turn off and delete activity). Chats are then still kept for up to 72 hours and are not used for training unless the user sends feedback; temporary chats are never used for training","status":"verified","url":"https://support.google.com/gemini/answer/13278892?hl=en","locator":"Section 'Turn off Keep Activity'","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No. Data regions are a Workspace admin feature; personal accounts have no region setting","status":"verified","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Data regions article (Workspace admin)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: Google maintains servers around the world and may process data outside the user's country","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section on data transfers ('We maintain servers around the world')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. On a personal account Google Ireland is the controller under Google's consumer terms; Google's processing terms (the Cloud Data Processing Addendum) apply to Workspace accounts","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section 'Data controller'","url2":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No list for personal accounts. Google's sub-processor list covers Workspace; the privacy policy says only that affiliates and trusted service providers process data for Google","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section 'For external processing'","url2":"https://workspace.google.com/terms/subprocessors.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC' (checked 16 Oct 2026 for Workspace)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Activity is auto-deleted after 18 months by default (3 months, 36 months or never are options); with Keep Activity off, 72 hours. Chats picked for human review are kept, disconnected from the account, for up to 3 years even after deletion","status":"verified","url":"https://support.google.com/gemini/answer/13594961?hl=en","locator":"Section 'How long we retain your data' and Keep Activity section","url2":"https://support.google.com/gemini/answer/13278892?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed for personal accounts. Google documents Gemini's SOC, ISO and FedRAMP certifications for Workspace use","status":"not_published","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'Does using Gemini impact any existing compliance certifications?' (Workspace hub)","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal account has no admin; the user manages Keep Activity, Connected Apps, Memory and public links","status":"verified","url":"https://support.google.com/gemini/answer/13594961?hl=en","locator":"Section listing Gemini Apps settings","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 0","status":"verified","url":"https://one.google.com/about/google-ai-plans/","locator":"Plan cards: Google AI Plus, Pro, Ultra (page served in German from Germany)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T31","plan":"Google AI Pro","tier":"personal","price":{"label":"€21.99 / mo","amount":21.99,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. For users 18 and over, Keep Activity is on by default, and Google uses that activity to improve its services, including training generative AI models, with human reviewers reading some chats","status":"verified","url":"https://support.google.com/gemini/answer/13278892?hl=en","locator":"Section 'Turn off Keep Activity' ('If you're 18 or over, Keep Activity is on by default')","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off Keep Activity: gemini.google.com > Activity > Turn off (or Turn off and delete activity). Chats are then still kept for up to 72 hours and are not used for training unless the user sends feedback; temporary chats are never used for training","status":"verified","url":"https://support.google.com/gemini/answer/13278892?hl=en","locator":"Section 'Turn off Keep Activity'","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No. Data regions are a Workspace admin feature; personal accounts have no region setting","status":"verified","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Data regions article (Workspace admin)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: Google maintains servers around the world and may process data outside the user's country","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section on data transfers ('We maintain servers around the world')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. On a personal account Google Ireland is the controller under Google's consumer terms; Google's processing terms (the Cloud Data Processing Addendum) apply to Workspace accounts","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section 'Data controller'","url2":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No list for personal accounts. Google's sub-processor list covers Workspace; the privacy policy says only that affiliates and trusted service providers process data for Google","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section 'For external processing'","url2":"https://workspace.google.com/terms/subprocessors.html","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC' (checked 16 Oct 2026 for Workspace)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Activity is auto-deleted after 18 months by default (3 months, 36 months or never are options); with Keep Activity off, 72 hours. Chats picked for human review are kept, disconnected from the account, for up to 3 years even after deletion","status":"verified","url":"https://support.google.com/gemini/answer/13594961?hl=en","locator":"Section 'How long we retain your data' and Keep Activity section","url2":"https://support.google.com/gemini/answer/13278892?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed for personal accounts. Google documents Gemini's SOC, ISO and FedRAMP certifications for Workspace use","status":"not_published","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'Does using Gemini impact any existing compliance certifications?' (Workspace hub)","url2":"https://support.google.com/gemini/answer/13594961?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal account has no admin; the user manages Keep Activity, Connected Apps, Memory and public links","status":"verified","url":"https://support.google.com/gemini/answer/13594961?hl=en","locator":"Section listing Gemini Apps settings","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 21.99 per month","status":"verified","url":"https://one.google.com/about/google-ai-plans/","locator":"Plan cards: Google AI Plus, Pro, Ultra (page served in German from Germany)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"gemini-enterprise","name":"Gemini Enterprise","vendor":"Google LLC (Google Cloud)","category":"assistants","plans":[{"id":"T335","plan":"Business edition","tier":"business","price":{"label":"$21 / user / mo","amount":21,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Google says prompts, outputs and training data in the Business, Standard and Plus editions are not used to train Google models or models for any other customer.","status":"vendor_statement","url":"https://cloud.google.com/gemini-enterprise/faq","locator":"Gemini Enterprise app FAQ, 'Who owns the data and does Google use my data for training models?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data—including prompts, outputs, and training—aren’t used to train Google models or models for any other customer"},{"key":"training_opt_out","value":"Nothing to do: Google states the Business edition does not train on customer data, and no setting is described.","status":"vendor_statement","url":"https://cloud.google.com/gemini-enterprise/faq","locator":"Gemini Enterprise app FAQ, training question","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data—including prompts, outputs, and training—aren’t used to train Google models or models for any other customer"},{"key":"eu_residency_option","value":"Not stated for the Business edition. The FAQ lists data residency under the Standard and Plus editions, which offer an 'eu' multi-region.","status":"not_published","url":"https://cloud.google.com/gemini-enterprise/faq","locator":"Gemini Enterprise app FAQ, 'What cloud compliance requirements does Gemini Enterprise app meet?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for the Business edition. For Standard and Plus editions customers choose an EU, US or global location; Business edition documentation could not be reached.","status":"not_published","url":"https://docs.cloud.google.com/gemini/enterprise/docs/locations","locator":"Data residency page (Standard/Plus), Business edition page, FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for the Business edition. Gemini Enterprise is listed as a Google Cloud service and the Cloud Data Processing Addendum covers Cloud services under a customer agreement, but no page ties the Business self-serve sign-up to it.","status":"not_published","url":"https://cloud.google.com/terms/data-processing-addendum","locator":"Cloud Data Processing Addendum and Google Cloud Services Summary (read together); Business edition help centre not reachable","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes: Google Cloud Platform Subprocessors list at cloud.google.com/terms/subprocessors. Counted 37 third-party rows (support, labeling and hosting firms) and 73 Google group rows. No external AI model providers appear. List covers all Cloud services, not Gemini Enterprise alone.","status":"verified","url":"https://cloud.google.com/terms/subprocessors","locator":"Google Cloud Platform Subprocessors, Third-Party and Google Group tables","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services."},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for the Business edition: no chat or content retention period found. The Cloud Data Processing Addendum (end-of-term deletion within 30-day recovery plus up to 180 days) is not confirmed to apply to the Business edition.","status":"not_published","url":"https://cloud.google.com/terms/data-processing-addendum","locator":"Cloud Data Processing Addendum, section 6.2 Return or Deletion When Term Ends","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"7 named: ISO 27001, ISO 27017, ISO 27018, PCI DSS, and SOC 1, SOC 2 and SOC 3 reports, plus penetration testing; Gemini Enterprise (including Agentspace) is marked in scope for all of them.","status":"verified","url":"https://cloud.google.com/security/compliance/services-in-scope","locator":"Google Cloud Platform Services in Scope by Compliance Program, row 'Gemini Enterprise (including Agentspace)'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following Services fall within the scope of one or more of: Google's ISO 27001 Certification, ISO 27017 Certification, ISO 27018 Certification, PCI DSS Certification, SOC 1 Report, SOC 2 Report and SOC 3 Report and Penetration Testing Report."},{"key":"admin_ai_controls","value":"Limited. Admins can add or remove team members, control which connectors teams can use, enable or disable chat sharing, and manage billing. No switch to turn AI features off is described for the Business edition.","status":"verified","url":"https://cloud.google.com/gemini-enterprise/business","locator":"Gemini Enterprise Business edition page, 'Basic admin and governance controls'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can add or remove team members, control team access to connectors, enable or disable chat sharing, and manage billing."},{"key":"price_eur","value":"Shown in USD only: starting at $21 per seat per month for the Business edition. Billing basis (monthly or annual) and VAT not stated on the page.","status":"not_published","url":"https://cloud.google.com/gemini-enterprise/business","locator":"Gemini Enterprise Business edition page, header","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Starting at $21 per seat per month"}]}]},{"slug":"gemini-workspace","name":"Gemini in Google Workspace","vendor":"Google","category":"assistants","plans":[{"id":"T04","plan":"Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Workspace does not use customer data to train models without the customer's permission or instruction","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Privacy Hub (last updated 6 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Google does not use Workspace customer data to train its models without the customer's permission or instruction","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Privacy commitments at the top of the hub","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Partial on this plan: 'Fundamental' data regions pin Gemini prompts/responses at rest to Europe; processing in use stays in-region only with Enterprise data regions (Enterprise Plus or add-on) or Assured Controls","status":"verified","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Editions table and covered-data table, footnotes (updated 13 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"No region fixed by default; data regions are an opt-in admin policy. Privacy Hub states no processing location","status":"not_published","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Data regions overview (updated 13 Oct 2026)","url2":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Cloud Data Processing Addendum (CDPA) covers Gemini prompts and responses","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Privacy Hub, CDPA statements","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 14 third-party entities (all support firms) for Workspace core services, plus 45 of their affiliates and 45 Google affiliates; last modified 23 Jul 2026","status":"verified","url":"https://workspace.google.com/terms/subprocessors.html","locator":"Third-Party Subprocessors section and sub-tables","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Set by admins. Gemini in Docs, Gmail and other apps: prompts and responses kept 90 days to indefinitely; Gemini app: up to 36 months, or up to 72 hours when conversation history is off","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Table 'Gemini data retention' and FAQ 'How long are prompts saved?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018 and 42001, FedRAMP High; supports HIPAA workloads. Gemini Notebook and Gemini in Chrome are not yet covered","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'Does using Gemini impact any existing compliance certifications?' and the Notebook/Chrome FAQs","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. The Gemini app is on by default; admins can turn it off for users and switch Gem sharing, conversation sharing, Gemini Notebook and beta features on or off","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'As an admin, can I turn Gemini on and off for users?' and the admin settings list","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 13.60 per user/month with 1-year commitment; EUR 16.20 flexible","status":"verified","url":"https://workspace.google.com/pricing?hl=de","locator":"Business Standard card, annual switch on/off","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"gemini-notebook","name":"Gemini Notebook","vendor":"Google","category":"assistants","plans":[{"id":"T49","plan":"Personal account","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No, unless the user sends feedback: then Google may review the full interaction, including queries, uploads and responses","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off. Not sending feedback keeps notebooks out of training and human review","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No region setting for personal accounts","status":"verified","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Data regions article (Workspace admin only)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: Google maintains servers around the world and may process data outside the user's country","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section on data transfers ('We maintain servers around the world')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. On a personal account the Google Terms of Service and Privacy Policy apply, with Google Ireland as controller in the EEA","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data' (which terms apply)","url2":"https://policies.google.com/privacy?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No list for personal accounts; the privacy policy says affiliates and trusted providers process data for Google","status":"verified","url":"https://policies.google.com/privacy?hl=en","locator":"Section 'For external processing'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC' (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated for personal notebooks; users delete sources and notebooks themselves","status":"not_published","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Help article (full text)","url2":"https://policies.google.com/privacy?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None. Google states Gemini Notebook does not yet support ISO, SOC or FedRAMP compliance","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'Does Gemini Notebook support ISO, SOC, HIPAA, or FedRAMP compliance?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal account has no admin","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'What you need'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 0 with a personal Google account; higher limits come with Google AI plans (Google AI Pro: EUR 21.99 per month)","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Availability' ('available in browser to all users above the age of consent')","url2":"https://one.google.com/about/google-ai-plans/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T50","plan":"Workspace Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Workspace users' uploads, queries and responses are not reviewed by humans and not used to train AI models","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data' (Workspace paragraph)","url2":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Workspace data is not used for training","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data' (Workspace paragraph)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated for Gemini Notebook","status":"not_published","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Data regions article","url2":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for Gemini Notebook. Workspace data regions are opt-in and Google does not say whether notebooks are covered","status":"not_published","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Retention table, row 'Gemini Notebook'","url2":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, through Workspace: the Google Workspace Terms apply to qualified editions, and uploaded files and notebooks follow the Cloud Data Processing Addendum","status":"verified","url":"https://support.google.com/notebooklm/answer/16164461?hl=en","locator":"Section 'Learn how Gemini Notebook protects your data' (which terms apply)","url2":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public as part of Workspace: 14 third-party entities (support firms) plus their affiliates and Google affiliates","status":"verified","url":"https://workspace.google.com/terms/subprocessors.html","locator":"Third-Party Subprocessors section","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC' (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Prompts and responses are not kept after the session ends; uploaded files and notebooks follow the CDPA deletion terms, and users can delete or export them","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Table 'Gemini data retention', row 'Gemini Notebook'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None. Google states Gemini Notebook does not support ISO, SOC or FedRAMP compliance and is not covered by its HIPAA BAA, unlike Gemini in Workspace apps","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"FAQ 'Does Gemini Notebook support ISO, SOC, HIPAA, or FedRAMP compliance?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Admins turn Gemini Notebook on or off for users; work accounts need an admin to enable it","status":"verified","url":"https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Admin settings list ('Turn Gemini Notebook on or off for users')","url2":"https://support.google.com/notebooklm/answer/16164461?hl=en","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Included in Google Workspace Business Standard: EUR 13.60 per user/month with a 1-year commitment, EUR 16.20 flexible","status":"verified","url":"https://workspace.google.com/pricing?hl=de","locator":"Business Standard card (checked 16 Oct 2026)","url2":"https://support.google.com/notebooklm/answer/16164461?hl=en","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"genspark","name":"Genspark","vendor":"MainFunc Inc. (Genspark Inc.)","category":"assistants","plans":[{"id":"T330","plan":"Team plan","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. Only Google Workspace data is covered: the privacy policy says it is not used to train generalized AI or ML models. No statement for other customer content.","status":"not_published","url":"https://genspark.ai/privacy","locator":"Privacy Policy, third-party services section (Google Workspace APIs); also read Terms 'User Content'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We explicitly affirm that Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models."},{"key":"training_opt_out","value":"Not stated; no setting or request route to stop training is described.","status":"not_published","url":"https://genspark.ai/privacy","locator":"Privacy Policy and Terms, full text searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data-region option found in the Terms or Privacy Policy.","status":"not_published","url":"https://genspark.ai/privacy","locator":"Privacy Policy and Terms, full text searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Microsoft Azure; the policy also says data can be stored and processed in the United States. No specific Azure region is named.","status":"verified","url":"https://genspark.ai/privacy","locator":"Privacy Policy, security section and 'Transferring Data Abroad'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data will be stored on Microsoft Azure in accordance with its applicable policies and requirements"},{"key":"dpa","value":"Not stated in the Terms or Privacy Policy; no data processing agreement is mentioned.","status":"not_published","url":"https://genspark.ai/terms","locator":"Terms of Service and Privacy Policy, full text searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found. The privacy policy names OpenAI, Anthropic (AI queries), Stripe (payments) and Microsoft Azure (hosting) in running text.","status":"not_published","url":"https://genspark.ai/privacy","locator":"Privacy Policy, third-party services section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'MainFunc', 'Genspark'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'MainFunc', 'Genspark' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data is kept while the account is active; after closing the account it is deleted from servers within 30 days. Users can also request deletion.","status":"verified","url":"https://genspark.ai/privacy","locator":"Privacy Policy, Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you close your account, we will delete your account data from our servers within 30 days."},{"key":"certifications","value":"Not stated; no security certification (SOC 2, ISO 27001 etc.) found in the Terms or Privacy Policy.","status":"not_published","url":"https://genspark.ai/privacy","locator":"Privacy Policy and Terms, full text searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the Terms only say Team and enterprise plan users manage user access and permissions. No admin switch for AI features described.","status":"not_published","url":"https://genspark.ai/terms","locator":"Terms of Service, Account section (Team plan and enterprise plan users are responsible for managing user access and permissions)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page returns 403 to non-browser fetch.","status":"not_captured","url":"https://genspark.ai/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"getresponse","name":"GetResponse Email Marketing","vendor":"GetResponse S.A.","category":"sales-marketing-and-support","plans":[{"id":"T510","plan":"Marketer","tier":"business","price":{"label":"€44.28 / mo","amount":44.28,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: the terms state the AI solutions chosen ensure the model does not learn from content the customer provides.","status":"verified","url":"https://www.getresponse.com/legal","locator":"Terms of Service, 10. Artificial intelligence (AI)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The AI solutions we have selected ensure that the model does not learn from the content provided by the Customer."},{"key":"training_opt_out","value":"Nothing to do: the terms state the model does not learn from customer content.","status":"verified","url":"https://www.getresponse.com/legal","locator":"Terms of Service, 10. Artificial intelligence (AI)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The AI solutions we have selected ensure that the model does not learn from the content provided by the Customer."},{"key":"eu_residency_option","value":"Not stated; no EU data residency setting or option found.","status":"not_published","url":"https://www.getresponse.com/legal/privacy","locator":"Privacy policy, terms, DPA, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for core account data; the privacy policy says recipients are mainly in the EEA, and the DPA gives locations only for four sub-processors.","status":"not_published","url":"https://www.getresponse.com/legal/privacy","locator":"Privacy policy transfers section; DPA Annex 3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, part of the terms: accepting the Terms of Service incorporates the Data Processing Agreement as an integral part; no separate signing.","status":"verified","url":"https://www.getresponse.com/legal","locator":"Terms of Service, data processing section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Accepting these Terms of Service you engage GetResponse in processing of the personal data necessary to provide you with the Service on terms and conditions stipulated in Data Processing Agreement"},{"key":"subprocessor_list","value":"Yes, listed in Annex 3 of the DPA (https://www.getresponse.com/legal/data-processing-agreement): 4 entries (ClickMeeting, Google Cloud Poland, Microsoft Ireland, Vonage). Only AI provider listed: Microsoft Ireland (Azure OpenAI course-creator AI); terms also name OpenAI.","status":"verified","url":"https://www.getresponse.com/legal/data-processing-agreement","locator":"Annex 3 - List of GetResponse's sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Client in particular agrees to the sub-processors listed in Annex 3."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, GetResponse S.A., Gdansk, Poland)","status":"verified","url":"https://www.getresponse.com/legal/privacy","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our contact details: GetResponse S.A. (Polish joint-stock company), Grunwaldzka 413, 80-309 Gdansk, Poland."},{"key":"data_retention","value":"Paid account: data kept 120 days after deactivation for reactivation, then deleted from the main database and kept encrypted in backups for another 120 days. DPA allows copying data up to 60 days after deactivation. AI prompt retention not stated.","status":"verified","url":"https://www.getresponse.com/legal/privacy","locator":"Privacy policy, how long we store data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you deactivate your Free Account, we’ll store your Data for 30 days and when you deactivate your Paid Account, we’ll store your Data for 120 days"},{"key":"certifications","value":"PCI DSS (payment data) is the only certification named; no ISO 27001 or SOC 2 named in the page text.","status":"verified","url":"https://www.getresponse.com/security","locator":"PCI DSS Certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GetResponse is PCI DSS certified, demonstrating that we meet stringent requirements for protecting payment data and maintaining secure systems and processes."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to turn AI features off found.","status":"not_published","url":"https://www.getresponse.com/legal","locator":"Terms section 10 AI; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€44.28 per month when billed annually (€54 per month billed monthly); prices shown are net amounts, local taxes may apply. Depends on the plan's contact list size.","status":"verified","url":"https://www.getresponse.com/pricing","locator":"Marketer plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Paid annually, save up to €117 a year"}]}]},{"slug":"github-copilot","name":"GitHub Copilot","vendor":"GitHub (Microsoft)","category":"code-and-app-builders","plans":[{"id":"T82","plan":"Business","tier":"business","price":{"label":"$19 / user / mo","amount":19,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. GitHub does not use Copilot Business or Enterprise data to train AI models; its Data Protection Agreement prohibits it without customer authorisation","status":"verified","url":"https://copilot.github.trust.page/","locator":"FAQ 'Does GitHub use Copilot Business or Enterprise data to train AI models?'","url2":"https://github.com/features/copilot#faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Business data is not used for training","status":"verified","url":"https://copilot.github.trust.page/","locator":"FAQ on training","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No EU option documented for Copilot Business on github.com","status":"not_published","url":"https://github.com/customer-terms/github-data-protection-agreement","locator":"Section 'Data Transfers and Location'","url2":"https://github.com/features/copilot/plans","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States or any country where GitHub or its sub-processors operate; Copilot sends inputs to GitHub's Azure tenant or another model provider","status":"verified","url":"https://github.com/customer-terms/github-data-protection-agreement","locator":"Section 'Data Transfers and Location'","url2":"https://copilot.github.trust.page/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Copilot Business data is covered by the GitHub Data Protection Agreement","status":"verified","url":"https://copilot.github.trust.page/","locator":"FAQ on training ('covered by GitHub's Data Protection Agreement')","url2":"https://github.com/customer-terms/github-data-protection-agreement","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 25 third-party entries, nearly all processing in the US; AI inference by Microsoft Azure, OpenAI, Anthropic, Google Cloud, AWS, xAI, Fireworks and Cerebras; plus GitHub subsidiaries","status":"verified","url":"https://github.com/subprocessors","locator":"Table 'Third Party Subprocessors'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (GitHub; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'GitHub'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period for prompts and suggestions is stated in the Trust Center or DPA read; feedback data is kept 'as long as necessary', and customer data is deleted or returned after the services end","status":"not_published","url":"https://copilot.github.trust.page/","locator":"FAQ 'What personal data does GitHub Copilot process?'","url2":"https://github.com/customer-terms/github-data-protection-agreement","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"Copilot Business is covered by GitHub's SOC 2 Type 2 report and ISO 27001 certificate; a separate SOC 2 Type 1 exists for Copilot Business; ISO/IEC 42001 is being extended across Copilot","status":"verified","url":"https://copilot.github.trust.page/","locator":"FAQ 'What third party testing and certifications does GitHub Copilot have?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. Admins manage seats and Copilot policies (for example code review for members without a licence), usage limits and whether paid usage is allowed; the Business plan lists access control, budget control and governance","status":"verified","url":"https://github.com/features/copilot#faq","locator":"FAQs on policy management and admin controls","url2":"https://github.com/features/copilot/plans","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 19 per user/month, including 1,900 credits per user","status":"not_published","url":"https://github.com/features/copilot/plans","locator":"Tab 'For businesses', card 'Business'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"glean","name":"Glean","vendor":"Glean Technologies, Inc.","category":"assistants","plans":[{"id":"T322","plan":"Enterprise","tier":"enterprise","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The AI Addendum says Glean will not use customer data to train or fine-tune any AI model; for services using Glean's own model key, its model providers are contractually barred too.","status":"verified","url":"https://www.glean.com/legal/ai-addendum","locator":"Section 3a No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Glean will not use Customer Data to train, re-train, improve, or fine-tune any AI Models."},{"key":"training_opt_out","value":"Nothing to do: Glean's AI Addendum states it will not use customer data for training.","status":"verified","url":"https://www.glean.com/legal/ai-addendum","locator":"Section 3a No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Glean will not use Customer Data to train, re-train, improve, or fine-tune any AI Models."},{"key":"eu_residency_option","value":"Not stated. The sub-processor page says customers may select a different cloud provider and location, but no EU region, setting or plan is named in the pages read.","status":"not_published","url":"https://www.glean.com/legal/subprocessors","locator":"Subprocessors table, footnote","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"*Customers have discretion to select a different Cloud Service Provider and location."},{"key":"default_data_location","value":"Not stated as one default. The sub-processor page lists every provider in the United States (AWS, Google and Microsoft carry a note that customers may select a different cloud provider and location).","status":"verified","url":"https://www.glean.com/legal/subprocessors","locator":"Subprocessors table, footnote","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"*Customers have discretion to select a different Cloud Service Provider and location."},{"key":"dpa","value":"Yes. Glean publishes a form DPA with EU standard clauses; it takes effect when the customer signs it.","status":"verified","url":"https://glean.com/legal/dpa/","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA becomes effective on the date that the Customer signs the DPA."},{"key":"subprocessor_list","value":"Yes (https://www.glean.com/legal/subprocessors, updated July 28, 2026): 20 third-party entries plus 1 affiliate (Glean India). AI/model providers: OpenAI, Anthropic, Google, Microsoft, AWS, Baseten, Fireworks.ai, Groq, Modal, Snowflake.","status":"verified","url":"https://www.glean.com/legal/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic PBC LLM Provider United States Baseten Labs, Inc. LLM Provider United States"},{"key":"dpf_status","value":"Active (Glean Technologies Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Glean Technologies'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Glean mirrors the retention period the customer sets in its connected apps; its own metadata logs are kept up to 30 days. After termination Glean deletes customer personal data. Model providers keep nothing (zero-day retention) when Glean's own model key is used.","status":"verified","url":"https://glean.com/legal/dpa/","locator":"Annex I.B retention criteria","url2":"https://www.glean.com/legal/ai-addendum","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data importer mirrors the data retention period that data exporter has set as a policy in their respective applications"},{"key":"certifications","value":"6 named on the security page: ISO 42001, ISO 27001, SOC 2 Type II, plus HIPAA, TX-RAMP Level 2 and GDPR.","status":"verified","url":"https://www.glean.com/security","locator":"Enterprise security and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 42001 HIPAA TX-RAMP Level 2 SOC 2 Type II ISO 27001 GDPR"},{"key":"admin_ai_controls","value":"Not stated in the contract pages read. Marketing navigation mentions usage controls and an AI gateway, but no admin setting to switch AI features off is described.","status":"not_published","url":"https://www.glean.com/security","locator":"Security page and AI Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"No price published: Glean is sold through sales demos only and the pricing page redirects to the home page.","status":"not_published","url":"https://www.glean.com/pricing","locator":"Pricing page (redirects to home page, Get a demo)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"glideos","name":"GlideOS","vendor":"Typeguard, Inc. (dba Glide)","category":"code-and-app-builders","plans":[{"id":"T541","plan":"Pro","tier":"business","price":{"label":"$125 / mo","amount":125,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless an opt-out exists for the account type and has been used: Glide may train AI on your content and app structure, excluding app data values that relate to an identifiable person. Whether Pro has an opt-out is not stated.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/terms","locator":"Your Content","url2":"https://www.glideapps.com/legal/glide-os/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless your account type grants you the ability to opt out of artificial intelligence training and you have done so, you agree that Glide has the right to use Your Content and the structure and configuration of your Applications to"},{"key":"training_opt_out","value":"Not stated: the terms say an opt-out exists only where the account type grants one, but no page names the plan, menu or email to use it.","status":"not_published","url":"https://www.glideapps.com/legal/glide-os/terms","locator":"Your Content; privacy policy AI section; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Partly: the sub-processor page says customers can configure the data region in which the AI providers operate. No EU hosting for app data is described; the privacy policy says the services are hosted in the U.S.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/subprocessors","locator":"LLM / AI Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers can configure the data region in which these providers operate and may restrict GlideOS to a specific set of providers."},{"key":"default_data_location","value":"United States: the privacy policy says the services are hosted and operated in the U.S. The subprocessor list names Cloudflare (runtime) and Neon (databases).","status":"verified","url":"https://www.glideapps.com/legal/glide-os/privacy","locator":"International transfers","url2":"https://www.glideapps.com/legal/glide-os/subprocessors","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States (“U.S.”) through"},{"key":"dpa","value":"Yes: an EU and UK Data Processing Addendum (processor form) supplements the terms; a copy for signature is sent on request to dpo@glideapps.com.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/dpa","locator":"Top of page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you'd like us to send you a copy of this DPA for signature, please email dpo@glideapps.com with the subject \"Request for DPA.\" EU"},{"key":"subprocessor_list","value":"Yes: https://www.glideapps.com/legal/glide-os/subprocessors (updated 29 Sep 2026), 23 entries, 20 companies. AI providers: Anthropic, Google, OpenAI, DeepSeek, Moonshot AI, Z.ai, xAI, OpenRouter, Cloudflare Workers AI.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/subprocessors","locator":"LLM / AI Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GlideOS uses Third-Party providers of large language models and related AI services throughout the product, including to power the GlideOS agent and other AI-assisted"},{"key":"dpf_status","value":"No listing found for search term 'typeguard'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'typeguard' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Unused customer data is deleted after 30 days, and data is erased automatically when you delete the app; Glide offers an export feature. Retention of AI prompts and chats is not separately stated.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/dpa","locator":"Technical and organisational measures: limited data retention; portability and erasure","url2":"https://www.glideapps.com/security-center","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unused Customer data is deleted after 30 days."},{"key":"certifications","value":"SOC 2 Type 2 (1 certification named).","status":"verified","url":"https://www.glideapps.com/security-center","locator":"Frequently asked questions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes, Glide is SOC 2 Type 2 certified."},{"key":"admin_ai_controls","value":"Partly: customers can restrict GlideOS to a specific set of AI providers, as the sub-processor list referenced by the DPA states. No organisation-wide switch to turn AI features off is published.","status":"verified","url":"https://www.glideapps.com/legal/glide-os/subprocessors","locator":"LLM / AI Subprocessors section","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Customers can configure the data region in which these providers operate and may restrict GlideOS to a specific set of providers."},{"key":"price_eur","value":"Shown in USD only: $125 per month for the Pro plan (starts at 5 team members, 500 credits).","status":"not_published","url":"https://www.glideapps.com/pricing","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"gmail-gemini-workspace","name":"Gmail with Gemini","vendor":"Google Cloud EMEA Limited (contracting entity for EMEA Workspace customers; Google LLC for the US and other regions)","category":"writing-and-email","plans":[{"id":"T374","plan":"Google Workspace Business Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Google will not use customer data to train or fine-tune its generative AI models behind Workspace without the customer's prior permission or instruction. Optional feedback is also not used for training.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"training_opt_out","value":"Nothing to do: Google contractually commits not to train on customer data without the customer's permission or instruction, so there is no setting to switch off.","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Model training and data usage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Workspace does not use customer data for training models without customer's prior permission or instruction."},{"key":"eu_residency_option","value":"Yes, partly. Business Standard includes Fundamental Data Regions: an admin can pin Gmail content and Gemini app prompts at rest to Europe. Keeping processing in use in Europe needs Enterprise Data Regions (Enterprise Plus or add-on).","status":"verified","url":"https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions?hl=en","locator":"Supported editions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business Standard Fundamental Data Regions*"},{"key":"default_data_location","value":"No fixed region by default. Unless an admin selects a Data Region (US or Europe), Google may store or process data wherever it or its subprocessors have facilities.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"1.3 Limitations (Data Regions)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google may store or process any Customer Data that is not covered by the Data Regions Policy wherever Google or its Subprocessors maintain facilities"},{"key":"dpa","value":"Yes. The Cloud Data Processing Addendum is incorporated into the Workspace agreement and covers customer data, including Gemini prompts.","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Cloud Data Processing Addendum (including its appendices, the \"Addendum\") is incorporated into the Agreement(s)"},{"key":"subprocessor_list","value":"Yes: https://workspace.google.com/terms/subprocessors.html (last modified Oct 19, 2026). 14 third-party entities (support and security-review firms) plus separate Google-affiliate tables; no outside AI model providers listed.","status":"verified","url":"https://workspace.google.com/terms/subprocessors.html","locator":"Third-Party Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services and Cloud Identity Services."},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Gemini prompts and responses in Workspace: kept 90 days to indefinite, set by admins; users can delete them unless admins block it. Deleted data is removed within a maximum of 180 days; generated content in Gmail follows normal deletion terms.","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Gemini data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts and responses 90 days to indefinite, as determined by admins"},{"key":"certifications","value":"Google names SOC 1/2/3 plus ISO 9001, 27001, 27701, 27017, 27018 and 42001 (9 items) and FedRAMP High authorization for Gemini; Gemini Notebook is not yet covered.","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"Does using Gemini impact any existing compliance certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Gemini has attained SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018, and 42001 certifications. Gemini has FedRAMP High authorization."},{"key":"admin_ai_controls","value":"Yes. On supported editions, admins can enable or disable Gemini features and the side panel in Gmail (and Drive, Docs, Meet, Chat); the Gemini app can be switched off for users.","status":"verified","url":"https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub?hl=en","locator":"As an admin, can I turn Gemini on and off for users?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Additionally, for supported Workspace editions, admins can enable or disable Gemini features and the side panel in the following Workspace services: Gmail"},{"key":"price_eur","value":"13.60 EUR per user per month, excluding tax (Business Standard, max 300 users; all plans billed monthly). The page has a toggle 'Jährlich (16 % sparen bei einjähriger Vertragsdauer)', so the commitment term behind 13.60 is not clear from the text. Intro offer: 50% off for 3 months, new customers only, first 20 users.","status":"verified","url":"https://workspace.google.com/pricing?hl=de","locator":"Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ab dem 02.02.2027 Für alle Nutzer 13,60 € • Der Preis gilt pro Nutzer und pro Monat und beinhaltet keine Steuern"}]}]},{"slug":"gong","name":"Gong","vendor":"Gong.io Inc.","category":"meetings-and-notes","plans":[{"id":"T396","plan":"per-user licence, quote-based","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated in the contract. Gong's trust-page FAQ says customer data is never used to train generative AI models, but its privacy policy lists using content processed through the service to improve products with AI and machine learning.","status":"not_published","url":"https://www.gong.io/legal/privacy-policy","locator":"Privacy policy, purposes of processing (Customer, User, Professional and Prospect personal data); trust page FAQ; terms; DPA","url2":"https://www.gong.io/platform/trust","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"No opt-out described. Gong's trust page says customer data is never used to train generative AI, so nothing to switch off for that; the privacy policy's AI/machine-learning product-improvement purpose has no opt-out stated.","status":"vendor_statement","url":"https://www.gong.io/platform/trust","locator":"FAQ: Is customer data used to train generative AI?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No. Your data is never used to train generative AI models, and it’s never shared with or exposed to the public domain."},{"key":"eu_residency_option","value":"Yes. New customers can choose to store data in EU data centres (AWS); the default is the US. The page does not say which plans or how it is requested.","status":"verified","url":"https://help.gong.io/docs/faqs-for-security-privacy-and-compliance","locator":"Where is our data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"New Gong customers can decide to store their data in data centers in either the US or EU."},{"key":"default_data_location","value":"United States by default (AWS); EU storage on AWS is available to new customers.","status":"verified","url":"https://help.gong.io/docs/faqs-for-security-privacy-and-compliance","locator":"Where is our data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"New Gong customers can decide to store their data in data centers in either the US or EU. The default storage location is in the US."},{"key":"dpa","value":"Yes. The Gong DPA is incorporated into the Terms and Conditions by reference and prevails over them on data protection; no separate signing needed.","status":"verified","url":"https://www.gong.io/legal/terms-and-conditions","locator":"8.1 Protection of Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The terms of the Gong Data Processing Addendum (“DPA”) are hereby incorporated by reference and govern Gong’s Processing of Personal Data included in Customer Data."},{"key":"subprocessor_list","value":"Yes, public list at https://www.gong.io/legal/sub-processors: 9 entries. AI/cloud providers: Amazon Web Services, Google Cloud EMEA, Microsoft Ireland (application AI functionality); no other model vendor named.","status":"verified","url":"https://www.gong.io/sub-processors/","locator":"Sub Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This page provides the name, purpose and location for each Sub-processor."},{"key":"dpf_status","value":"Active (Gong; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Gong'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Up to 3 years or the contract duration, whichever is shorter; a custom period can be requested (admins configure retention). All data is permanently deleted 30 days after contract termination.","status":"verified","url":"https://www.gong.io/platform/trust","locator":"FAQ: What is Gong's data retention policy?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, Gong retains customer data for up to three years or the duration of your contract — whichever is shorter."},{"key":"certifications","value":"6 certifications named: SOC 2 Type 2, ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701; the trust page also lists PCI DSS SAQ-D and a CSA STAR registry entry.","status":"verified","url":"https://www.gong.io/platform/trust","locator":"Our commitment to compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO/IEC 27001:2022 Information Security Management System (ISMS) ISO/IEC 27017 Information security controls for cloud services"},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide switch to turn Gong's AI features off was found in the trust page, privacy policy, terms or help security article (admins can set data-collection and retention rules).","status":"not_published","url":"https://www.gong.io/platform/trust","locator":"FAQ: Can I control what data Gong collects and processes?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: quote-based. The pricing page says licences are priced per user plus a platform fee depending on user count; no amounts or named self-serve plans.","status":"not_published","url":"https://www.gong.io/pricing","locator":"Get the scoop on Gong pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"google-chat","name":"Google Chat","vendor":"Google LLC","category":"workspace-and-projects","plans":[{"id":"T472","plan":"Google Workspace Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Workspace does not use customer data, including prompts, to train Google's generative AI models without the customer's prior permission or instruction.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Privacy hub: Model training and data usage, 'Does Google use my data (including prompts) to train generative AI models?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Workspace does not use customer data for training models without customer's prior permission or instruction."},{"key":"training_opt_out","value":"Nothing to do: Google states Workspace does not train its generative AI models on customer data without the customer's permission or instruction.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Privacy hub: Model training and data usage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Workspace does not use customer data for training models without customer's prior permission or instruction."},{"key":"eu_residency_option","value":"Yes. Business Standard is a supported edition for data regions: admin can choose European Union or United States for covered Workspace data at rest. Business Starter is not supported.","status":"verified","url":"https://support.google.com/a/answer/7630496","locator":"Data regions, supported editions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Standard and Business Plus;"},{"key":"default_data_location","value":"Not a single named country: data is spread over Google data centers around the globe, some outside the EEA, and Google says it cannot name the exact data center.","status":"verified","url":"https://support.google.com/a/answer/60762","locator":"How Google protects your organization's security and privacy, 'Where does Google store my data?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google's infrastructure is strategically distributed across multiple data centers around the globe."},{"key":"dpa","value":"Yes. The Cloud Data Processing Addendum is incorporated into the Workspace agreement and takes effect when the customer accepts it (opt-in online in the Admin console).","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Cloud Data Processing Addendum, 1. Overview and Addendum Effective Date","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Cloud Data Processing Addendum (including its appendices, the “Addendum”) is incorporated into the Agreement(s) (as defined below) between Google and Customer."},{"key":"subprocessor_list","value":"Yes, public: https://workspace.google.com/terms/subprocessors/ . Core Services table has 14 third-party entities (support and risk-review outsourcers) and 45 Google group entities (59 in total, plus listed affiliates of the third parties). No AI model providers listed.","status":"verified","url":"https://workspace.google.com/terms/subprocessors.html","locator":"Subprocessors page: Third-Party Subprocessors and Google Group Subprocessors (Core Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services"},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept until deleted. Admins set Gemini chat retention (auto-delete after e.g. 3 months, 18 months or 3 years, or keep indefinitely). Google deletes within 180 days after a customer deletion and after up to 30 days' recovery when the term ends.","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Cloud Data Processing Addendum, 6. Data Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer instructs Google to delete all remaining Customer Data (including existing copies) from Google’s systems at the end of the Term."},{"key":"certifications","value":"9 named for Gemini in Workspace: SOC 1, SOC 2, SOC 3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018 and 42001 (plus FedRAMP High).","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Privacy hub: 'Does using Gemini impact any existing compliance certifications'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Gemini has attained SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018, and 42001 certifications."},{"key":"admin_ai_controls","value":"Yes. Admins can turn the Gemini app off for users, and on supported editions switch Gemini features and the side panel on or off in Gmail, Drive, Docs, Meet and Chat.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Privacy hub: 'As an admin, can I turn Gemini on and off for users?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins manage access to the Gemini app and can choose to disable the service."},{"key":"price_eur","value":"€13.60 per user/month, excluding tax (annual-commitment price shown; plans billed monthly; first-3-months 50% promotion also shown). Chat is included in every Workspace plan.","status":"verified","url":"https://workspace.google.com/intl/en/pricing","locator":"Pricing page, Business Standard card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Feb 2, 2027 - Onwards For all users €13.60 • Price is per user/month and does not include tax"}]}]},{"slug":"google-drive-workspace","name":"Google Drive","vendor":"Google LLC (Google Workspace)","category":"research-forms-and-storage","plans":[{"id":"T640","plan":"Google Workspace Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Google's Workspace Service Specific Terms (12.11) say it will not use Customer Data to train or fine-tune its generative AI models behind Workspace's generative AI services without the customer's prior permission or instruction.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"https://support.google.com/a/answer/15706919","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"training_opt_out","value":"Nothing to switch off: the Workspace Service Specific Terms (12.11) bar Google from training or fine-tuning its generative AI models on Customer Data without the customer's prior permission or instruction.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"https://support.google.com/a/answer/15706919","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"eu_residency_option","value":"Yes. An admin can set a data region of Europe (the EU) for covered Workspace data at rest; Business Standard is a listed edition. Choosing the region for processing too needs Enterprise Plus or Frontline Plus. Gemini Notebook is not covered.","status":"verified","url":"https://support.google.com/a/answer/7630496","locator":"Choose a geographic location for your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your location options are the United States, European Union (labeled Europe in the Google Admin console), or No preference."},{"key":"default_data_location","value":"No single default country: Google may process customer data in any country where Google or its subprocessors have facilities, unless an admin sets a data region (US or Europe).","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Section 10.1 Data Storage and Processing Facilities","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Data may be processed in any country where Google or its Subprocessors maintain facilities."},{"key":"dpa","value":"Yes. The Cloud Data Processing Addendum is incorporated into the Google Workspace agreement between Google and the customer, so it applies as part of the terms.","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Cloud Data Processing Addendum, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is incorporated into the Agreement(s) (as defined below) between Google and Customer."},{"key":"subprocessor_list","value":"Yes, public at https://workspace.google.com/terms/subprocessors/ : 108 rows (14 third-party support and security firms, 49 of their affiliates, 45 Google group entities). No outside AI model provider appears in it.","status":"verified","url":"https://workspace.google.com/terms/subprocessors/","locator":"Third-Party Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services and Cloud Identity Services."},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Gemini in Workspace chats are kept 90 days to indefinitely as admins set; Gemini app chats up to 36 months as admins set; users can delete chats unless admins block it. Deleted data is removed within 180 days; after the term ends, 30-day recovery then deletion within 180 days.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Gemini data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"90 days to indefinite, as determined by admins"},{"key":"certifications","value":"For Gemini in Workspace: SOC 1/2/3 and ISO 9001, 27001, 27701, 27017, 27018 and 42001 (9 named), plus FedRAMP High. Gemini Notebook and Gemini in Chrome are not covered.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Does using Gemini impact any existing compliance certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Gemini has attained SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018, and 42001 certifications."},{"key":"admin_ai_controls","value":"Yes. Admins can switch the Gemini app off for users, and for supported editions can enable or disable Gemini features and the side panel in Workspace services.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"As an admin, can I turn Gemini on and off for users?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins manage access to the Gemini app and can choose to disable the service."},{"key":"price_eur","value":"EUR 13.60 per user/month excluding tax for the Standard (Business Standard) card, all prices in EUR, billed monthly. The page also shows a 16% saving with a one-year commitment and an introductory discount for new customers; which rate EUR 13.60 is was not stated.","status":"verified","url":"https://workspace.google.com/pricing","locator":"Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Price is per user/month and does not include tax"}]}]},{"slug":"google-forms","name":"Google Forms","vendor":"Google LLC (Mountain View, USA)","category":"research-forms-and-storage","plans":[{"id":"T626","plan":"Google Workspace Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Google's Workspace terms (12.11 Training Restriction) say it will not use Customer Data to train or fine-tune its generative AI models without the customer's prior permission or instruction. Forms is a Workspace core service.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"https://support.google.com/a/answer/15706919","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"training_opt_out","value":"Nothing to do: the Workspace terms bar training on Customer Data unless the customer gives prior permission or instruction.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"https://support.google.com/a/answer/15706919","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"eu_residency_option","value":"Yes. On Business Standard an admin can set a data region of European Union or United States; Google Forms text, images, responses and draft responses are covered by Fundamental Data Regions. Business Starter is not supported.","status":"verified","url":"https://support.google.com/a/answer/9223653","locator":"Data covered by data regions, Google Forms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google Forms Text, embedded images, responses, and draft responses"},{"key":"default_data_location","value":"Not a single named country: Google's infrastructure is spread across data centres around the globe, and no default country is named for Forms responses.","status":"verified","url":"https://support.google.com/a/answer/60762","locator":"Where does Google store my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google's infrastructure is strategically distributed across multiple data centers around the globe."},{"key":"dpa","value":"Yes. The Cloud Data Processing Addendum is incorporated into the Workspace agreement; the customer accepts it online in the Admin console.","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Cloud Data Processing Addendum, overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Cloud Data Processing Addendum (including its appendices, the “Addendum”) is incorporated into the Agreement(s) (as defined below) between Google and Customer."},{"key":"subprocessor_list","value":"Yes, public at https://workspace.google.com/terms/subprocessors/: Core Services table has 14 third-party entities and 45 Google group entities (59 in total). It names no AI model providers.","status":"verified","url":"https://workspace.google.com/intl/en/terms/subprocessors/","locator":"Third-Party Subprocessors (Core Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services"},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept until the customer deletes it. After a deletion Google removes the data within a maximum of 180 days; at the end of the term it also deletes remaining customer data. No Forms-specific retention period is published.","status":"verified","url":"https://workspace.google.com/terms/dpa_terms.html","locator":"Cloud Data Processing Addendum, 6.1 Deletion by Customer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days"},{"key":"certifications","value":"Not captured for Forms itself: the Workspace certification list loads with JavaScript. Google's Gemini-in-Workspace page names SOC 1/2/3 and ISO 9001, 27001, 27701, 27017, 27018, 42001 (9) for Gemini only.","status":"not_captured","url":"https://workspace.google.com/security/","locator":"Security page, certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Admins can turn the Gemini app off for users, and on supported editions switch Gemini features on or off in Gmail, Drive, Docs, Meet and Chat; Google Forms is not named in that list.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Privacy hub: As an admin, can I turn Gemini on and off for users?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins manage access to the Gemini app and can choose to disable the service."},{"key":"price_eur","value":"EUR 13.60 per user per month, excluding tax (Business Standard). Google Forms is included, with no separate price. A first-3-months 50% promotion is also shown.","status":"verified","url":"https://workspace.google.com/intl/en/pricing","locator":"Business Standard card, price details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Price is per user/month and does not include tax"}]}]},{"slug":"google-workspace-translate","name":"Google Translate in Google Workspace","vendor":"Google LLC (Google Workspace)","category":"writing-and-email","plans":[{"id":"T353","plan":"Business Standard","tier":"business","price":{"label":"€13.60 / user / mo","amount":13.6,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for generative AI: Google will not train or fine-tune its Workspace generative AI models on your data without your prior permission. The Translate document feature itself is not named in the terms.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"training_opt_out","value":"Nothing to do for Workspace generative AI: Google needs your prior permission or instruction to train on your data. No setting is described for Translate itself.","status":"verified","url":"https://workspace.google.com/terms/service-terms/","locator":"12.11 Training Restriction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction."},{"key":"eu_residency_option","value":"Yes: an admin can set a data region policy (Europe or United States) for covered data at rest such as Gmail, Drive and Docs; included in Business Standard at no extra cost. The default is 'No preference'. Processing in-region is not offered on this plan.","status":"verified","url":"https://support.google.com/a/answer/7630496","locator":"Choose a geographic location for your data: supported editions, location options, Step 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Standard and Business Plus;"},{"key":"default_data_location","value":"Not stated in the terms and DPA read; customer data sits in Google data centres without a named default country.","status":"not_published","url":"https://cloud.google.com/terms/data-processing-addendum","locator":"Cloud Data Processing Addendum; Workspace terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: the Cloud Data Processing Addendum is part of the Workspace agreement and governs how Google handles Customer Data.","status":"verified","url":"https://workspace.google.com/intl/en/terms/premier_terms/","locator":"5.2 Protection of Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google will only access, use, and otherwise process Customer Data in accordance with the Cloud Data Processing Addendum"},{"key":"subprocessor_list","value":"Yes: https://workspace.google.com/terms/subprocessors/ (last modified 19 Oct 2026). Core Services list 14 third-party firms (technical support, security review) and 45 Google group entities. No outside AI model provider is listed.","status":"verified","url":"https://workspace.google.com/terms/subprocessors/","locator":"Third-Party Subprocessors and Google Group Subprocessors tables (Core Services and Cloud Identity)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services and Cloud Identity Services."},{"key":"dpf_status","value":"Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Google LLC'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"You can delete data in the product; Google then deletes it within 180 days at most. After the term ends, a recovery period of up to 30 days applies and deletion completes within 180 days.","status":"verified","url":"https://cloud.google.com/terms/data-processing-addendum","locator":"6. Data Deletion, 6.1 and 6.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After a recovery period of up to 30 days from that date, Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days"},{"key":"certifications","value":"Google names audits and certifications on https://workspace.google.com/security/, but the certification list is loaded by JavaScript and was not readable here.","status":"not_captured","url":"https://workspace.google.com/security/","locator":"Certifications, audits, and assessments","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Admins can turn the Gemini app and Gemini features on or off for the organisation. No separate off-switch for Translate document was found.","status":"verified","url":"https://support.google.com/a/answer/15706919","locator":"Admin Help navigation: Gemini App","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Turn the Gemini App on or off"},{"key":"price_eur","value":"€13.60 per user per month, excluding tax, annual commitment (introductory 50% off for the first 3 months for new customers).","status":"verified","url":"https://workspace.google.com/pricing.html","locator":"Business Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Price is per user/month and does not include tax"}]}]},{"slug":"gorgias","name":"Gorgias Helpdesk","vendor":"Gorgias Inc., San Francisco, CA, USA","category":"phone-and-voice","plans":[{"id":"T445","plan":"Pro","tier":"business","price":{"label":"$300 / mo","amount":300,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: Gorgias may use Customer Data and outputs to build and improve its own internal AI models. It will not use Customer Data to train third-party providers' models, which operate with zero data retention.","status":"verified","url":"https://www.gorgias.com/legal/terms-of-service","locator":"4.2 Machine Learning and Artificial Intelligence; Output","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output (as defined below), solely to build and improve our internal machine learning and other artificial intelligence models"},{"key":"training_opt_out","value":"Not stated. The terms give no way to stop Gorgias using Customer Data for its internal AI models.","status":"not_published","url":"https://www.gorgias.com/legal/terms-of-service","locator":"4.2 Machine Learning and Artificial Intelligence; Output","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated. Google Cloud is listed with an EU location but no option to keep an account in the EU is described.","status":"not_published","url":"https://www.gorgias.com/legal/list-of-data-subprocessors","locator":"1. Infrastructure Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated. The sub-processor list shows Google Cloud Platform hosting in the United States, European Union and Australia, with no default named.","status":"not_published","url":"https://www.gorgias.com/legal/list-of-data-subprocessors","locator":"1. Infrastructure Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The Data Processing Agreement forms part of the Master Subscription Agreement.","status":"verified","url":"https://www.gorgias.com/legal/data-processing-agreement","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"forms part of the Gorgias’ Master Subscription Agreement (the “Agreement”) between the applicable Gorgias customer which is a party to such Agreement"},{"key":"subprocessor_list","value":"Public list at https://www.gorgias.com/legal/list-of-data-subprocessors: 25 rows (4 infrastructure, 16 feature-specific, 5 Gorgias affiliates). OpenAI is the AI provider listed.","status":"verified","url":"https://www.gorgias.com/legal/list-of-data-subprocessors","locator":"2. Feature Specific Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAi AI research and deployment company United States"},{"key":"dpf_status","value":"No listing found for search term 'Gorgias'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Gorgias' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Within 90 days after the agreement ends Gorgias returns and deletes the customer's personal data; deletion requests go to support@gorgias.com. In-service retention is not stated.","status":"verified","url":"https://www.gorgias.com/legal/data-processing-agreement","locator":"Return or deletion of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Gorgias shall, promptly and in any event within 90 days of expiration or termination of the Agreement"},{"key":"certifications","value":"SOC 2 Type II (report on request) and HIPAA compliance (report on request). Two named.","status":"verified","url":"https://www.gorgias.com/security","locator":"A few things that help keep your helpdesk secure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type II Certification Request the report"},{"key":"admin_ai_controls","value":"Not stated. No organisation-wide switch for AI features found in the legal or security pages.","status":"not_published","url":"https://www.gorgias.com/legal/terms-of-service","locator":"4.2; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $300 per month, billed annually ($3,600 a year), for 2,000 tickets a month; priced by ticket volume, not per user.","status":"not_published","url":"https://www.gorgias.com/pricing","locator":"Pro plan (structured data in the page)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"grain","name":"Grain","vendor":"Grain Intelligence, Inc.","category":"meetings-and-notes","plans":[{"id":"T387","plan":"Starter","tier":"business","price":{"label":"$19 / user / mo","amount":19,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for the vendor; the support security article says its LLM providers retain no customer data in generating summaries","status":"not_published","url":"https://support.grain.com/en/articles/4256976-security","locator":"AI and third-party data sharing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated: no opt-out for AI training is described","status":"not_published","url":"https://support.grain.com/en/articles/4256976-security","locator":"Looked at support security article, privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: security page names USA hosting only and no EU option","status":"not_published","url":"https://grain.com/security","locator":"Looked at security, privacy, support articles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: all software is hosted on AWS in the USA","status":"verified","url":"https://grain.com/security","locator":"Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Grain hosts all its software in Amazon Web Services (AWS) facilities in the USA."},{"key":"dpa","value":"Not stated: no customer data processing addendum found in the privacy policy, terms or security pages","status":"not_published","url":"https://grain.com/privacy-policy","locator":"Looked at privacy policy, terms, security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes, public list at grain.com/grain-subprocessors: 18 entries (7 with access to recordings or payment data, 11 with basic data); AI providers: Anthropic, OpenAI, AssemblyAI, Rev AI","status":"verified","url":"https://grain.com/grain-subprocessors","locator":"Data Processors with access to sensitive customer information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following processors have access to video/audio streams, recordings of meetings, and/or payment information:"},{"key":"dpf_status","value":"No listing found for search term 'Grain Intelligence'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Grain Intelligence' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Admins can set a workspace-wide auto-deletion period for recordings and anyone can delete individual recordings at any time; no default period stated","status":"verified","url":"https://support.grain.com/en/articles/4256976-security","locator":"User control over data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Set workspace-wide auto-deletion policies to automatically delete recordings after a defined period."},{"key":"certifications","value":"1 named: SOC 2 Type II","status":"verified","url":"https://grain.com/security","locator":"SOC 2 Type II Certified","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Grain is SOC 2 Type II certified."},{"key":"admin_ai_controls","value":"Not stated: workspace settings include a Desktop Capture toggle; no switch for AI features; bring-your-own-LLM is Enterprise only","status":"not_published","url":"https://support.grain.com/en/articles/5729180-workspace-settings","locator":"Looked at workspace settings, plans, BYOLLM","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $19 per seat per month billed annually appears on the pricing page, but the saved text does not label which plan it belongs to","status":"not_published","url":"https://grain.com/pricing","locator":"Plan cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"grammarly","name":"Grammarly","vendor":"Superhuman Platform Inc. (Grammarly)","category":"writing-and-email","plans":[{"id":"T37","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. On Grammarly Free, Product Improvement and Training is on by default: Grammarly may use what you write, including content processed by its AI, to train its models","status":"verified","url":"https://support.grammarly.com/hc/en-us/articles/25555503115277-Product-Improvement-and-Training-Control","locator":"Tab 'Grammarly Free, Grammarly Premium, and single-user Grammarly Pro accounts' ('on for individual users by default')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Yes. Turn off 'Product Improvement and Training' at account.grammarly.com/security/privacy; content is then not used for training or product improvement","status":"verified","url":"https://support.grammarly.com/hc/en-us/articles/25555503115277-Product-Improvement-and-Training-Control","locator":"'How do I turn Product Improvement and Training on or off?' (Free and Premium)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://superhuman.com/legal/dpa","locator":"Whole DPA","url2":"https://www.grammarly.com/privacy-policy","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the Superhuman Platform, Grammarly included, is hosted on AWS in the US","status":"verified","url":"https://superhuman.com/legal/dpa","locator":"Exhibit B, Section 1 and the Grammarly service-specific measures","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. For individual users the data controller is Superhuman Platform Inc. under its privacy policy; the Data Privacy Addendum is for business customers","status":"verified","url":"https://www.grammarly.com/privacy-policy","locator":"Section 'Data Controller'","url2":"https://superhuman.com/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public for business customers: one list for the whole Superhuman Platform, 20 third parties, all in the US; individual users get recipient categories in the privacy policy","status":"verified","url":"https://superhuman.com/legal/subprocessors","locator":"Section 'Third-party Sub-processors'","url2":"https://www.grammarly.com/privacy-policy","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Superhuman Platform Inc., formerly Grammarly, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Superhuman'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: personal data is kept as long as needed to provide the products, meet legal obligations, resolve disputes and for other legitimate purposes","status":"not_published","url":"https://www.grammarly.com/privacy-policy","locator":"Section 'Security and Retention' (effective 6 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 27701:2019 (company-wide)","status":"verified","url":"https://www.grammarly.com/security","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: Free is a personal plan with no admin","status":"verified","url":"https://www.grammarly.com/plans","locator":"Plan card 'Free'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Free (EUR 0)","status":"verified","url":"https://www.grammarly.com/plans","locator":"Plan card 'Free'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T20","plan":"Pro (team, bought online)","tier":"business","price":{"label":"€12 / mo","amount":12,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for multi-user teams bought on the website: Product Improvement and Training starts on and an admin can switch it off. Pro, Business and Enterprise bought through Sales start off","status":"verified","url":"https://support.grammarly.com/hc/en-us/articles/25555503115277-Product-Improvement-and-Training-Control","locator":"Team account tabs","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"An admin must act: for multi-user Pro bought on the website, 'Product Improvement and Training' starts on; an admin turns it off for the whole organisation at account.grammarly.com/admin/data_settings. Only admins can change it","status":"verified","url":"https://support.grammarly.com/hc/en-us/articles/25555503115277-Product-Improvement-and-Training-Control","locator":"Tab 'Multi-user Grammarly Pro accounts purchased through the Grammarly website'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://www.superhuman.com/legal/dpa","locator":"Full DPA text","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (hosting on AWS and/or GCP in the US)","status":"verified","url":"https://www.superhuman.com/legal/dpa","locator":"Section 9(a), Exhibit B","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The Superhuman Data Privacy Addendum (effective 8 Jul 2026) is incorporated by reference into the Customer Business Agreement","status":"verified","url":"https://www.grammarly.com/terms/customer-business-agreement","locator":"Section 3.2","url2":"https://www.superhuman.com/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 20 third parties, all USA; AI: Anthropic, Azure, OpenAI, Baseten; undated; 30 days' notice to customers who opt in through a form","status":"verified","url":"https://superhuman.com/legal/subprocessors","locator":"Sub-processor table","url2":"https://www.superhuman.com/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Superhuman Platform Inc., formerly Grammarly, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Superhuman'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: personal data is kept as long as needed to provide the products, meet legal obligations, resolve disputes and other legitimate purposes, varying by data type and settings","status":"not_published","url":"https://www.grammarly.com/privacy-policy","locator":"Section 'Security and Retention'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 27701:2019","status":"verified","url":"https://www.grammarly.com/security","locator":"Section 'Enterprise-grade attestation and regulatory compliance'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. On Pro, admins can turn generative AI off for the team: admin Home > Organization > Feature access, set AI assistant, Strategic suggestions and Paragraph-level rewrites to Off","status":"verified","url":"https://support.grammarly.com/hc/en-us/articles/18192682302605-Turn-off-generative-AI-for-your-team","locator":"Steps (included in Grammarly Pro, Plus, Business, Enterprise and Education)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 12 per month shown for Pro (billing period and per-seat basis not stated on the card)","status":"verified","url":"https://www.grammarly.com/plans","locator":"Pro card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"granola","name":"Granola","vendor":"Granola","category":"meetings-and-notes","plans":[{"id":"T63","plan":"Business","tier":"business","price":{"label":"$14 / user / mo","amount":14,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form, unless the user opts out: Granola trains on anonymised data; only Enterprise has training off by default. Third parties such as OpenAI and Anthropic may not train on it","status":"verified","url":"https://www.granola.ai/security","locator":"Section 'Model training'","url2":"https://www.granola.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Each user opts out in their Granola account settings; a workspace-wide opt-out is an Enterprise feature","status":"verified","url":"https://www.granola.ai/privacy","locator":"AI training paragraph ('which you can opt-out of within your Granola account settings')","url2":"https://www.granola.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://www.granola.ai/pricing","locator":"Plan comparison (no region option)","url2":"https://www.granola.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: AWS servers located primarily in the US; Granola operates from the US and the UK","status":"verified","url":"https://www.granola.ai/privacy","locator":"Section on where data is processed","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, on request: a DPA is 'available upon request' and marked available on every plan","status":"verified","url":"https://www.granola.ai/security","locator":"Section 'GDPR'","url2":"https://www.granola.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 16 entries, 15 in the US and 1 in the UK; AI and transcription: Anthropic, OpenAI, Google Cloud, xAI, AssemblyAI, Deepgram, Braintrust, Parallel and Fireworks; hosting on AWS","status":"verified","url":"https://trust.granola.ai/subprocessors","locator":"Subprocessors list (all pages)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Granola'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Granola' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Audio is not stored: it is transcribed live (desktop) or from a temporary cache (mobile). Transcripts and notes stay until deleted; each user can set transcript retention and auto-deletion","status":"verified","url":"https://www.granola.ai/security","locator":"Section 'No stored recordings'","url2":"https://www.granola.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II (2025 and 2026 reports); GDPR and HIPAA listed (HIPAA workspaces on Enterprise only)","status":"verified","url":"https://trust.granola.ai/","locator":"Compliance tiles and documents","url2":"https://www.granola.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Limited. Business has centralised billing and user management; workspace-wide training opt-out, retention policy, sharing settings and admin controls for MCP, API and integrations are Enterprise only","status":"verified","url":"https://www.granola.ai/pricing","locator":"Plan comparison, 'Trust & Control' and admin rows","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 14 per user/month","status":"not_published","url":"https://www.granola.ai/pricing","locator":"Plan card 'Business'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"greenhouse","name":"Greenhouse Recruiting","vendor":"Greenhouse Software, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T611","plan":"Core","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Partly. Greenhouse may use AI inputs and outputs, only in anonymized, de-identified form, to improve and train its own machine-learning models; it says it will not use Personal Data to train models. Its third-party AI providers are barred from training on customer data.","status":"verified","url":"https://www.greenhouse.com/ai-terms","locator":"5. Improving AI Features; 6(c) No Third-Party Training","url2":"https://www.greenhouse.com/ai-principles","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Notwithstanding the foregoing, Greenhouse will not use Personal Data to train machine learning models."},{"key":"training_opt_out","value":"No separate training opt-out. AI Features are optional: the customer can stop using them at any time (and switch them off at organisation level); the anonymized-training licence applies to AI Features the customer uses.","status":"verified","url":"https://www.greenhouse.com/ai-terms","locator":"2(e) Risks and Limitations","url2":"https://www.greenhouse.com/ai-recruiting","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer acknowledges that AI Features are optional features of the Greenhouse Services and that Customer is free to stop using AI Features at any time."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found in the security page, DPA, MSA or sub-processor list. Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.","status":"not_published","url":"https://www.greenhouse.com/security","locator":"Security page, DPA, MSA, sub-processors page (searched for residency, region, EU hosting)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cross-border data transfers subject to EU-US DPF, UK Extension to the EU-U.S. DPF or Swiss-US DPF"},{"key":"default_data_location","value":"Not stated per customer. The sub-processor list gives AWS (server infrastructure and data hosting) locations as United States, Germany and Australia, without saying which customers sit where.","status":"not_published","url":"https://www.greenhouse.com/subprocessors-in-use","locator":"Amazon Web Services, Inc. (AWS) row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Server infrastructure and data hosting"},{"key":"dpa","value":"Yes. A standard DPA is published and is incorporated into the Master Subscription Agreement; Greenhouse is the processor. It is a form the customer completes and signs.","status":"verified","url":"https://www.greenhouse.com/data-processing-addendum","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"THIS DATA PROCESSING ADDENDUM (“DPA”) is incorporated into, and is subject to the terms and conditions of, the Master Subscription Agreement or other written or electronic agreement"},{"key":"subprocessor_list","value":"Yes, public at https://www.greenhouse.com/subprocessors-in-use: 30 rows (28 companies; Google appears 3 times). AI providers: Anthropic PBC and OpenAI OpCo, LLC (hosting large language models), Glean (internal AI), Recall.ai (transcription).","status":"verified","url":"https://www.greenhouse.com/subprocessors-in-use","locator":"Name of Subprocessor table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Service provider for hosting large language models. Uses include AI product features and internal operational support purposes"},{"key":"dpf_status","value":"Active (Greenhouse Software Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Greenhouse Software'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer sets its own retention rules in the app and can delete data at any time. All personal data is deleted automatically 90 days after the contract ends (or earlier on request); deleted data stays in backups for up to 30 days.","status":"verified","url":"https://www.greenhouse.com/data-processing-addendum","locator":"Annex II: Measures for ensuring limited data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All personal data in Controller’s account is automatically deleted ninety (90) days following expiration or termination of the services agreement, or earlier upon Controller request"},{"key":"certifications","value":"5 named: ISO 27001:2022, ISO 27701:2019, ISO 42001:2023, SOC 1 Type 2, SOC 2 Type 2 (annual audits).","status":"verified","url":"https://www.greenhouse.com/security","locator":"Global compliance standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certified for ISO 27001:2022, ISO 27701:2019 and ISO 42001:2023"},{"key":"admin_ai_controls","value":"Yes. Customers can enable or disable any AI feature at the organisation level.","status":"vendor_statement","url":"https://www.greenhouse.com/ai-recruiting","locator":"FAQ: Is AI recruiting software secure and compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers can enable or disable any AI feature at the org level."},{"key":"price_eur","value":"Not published: pricing is custom per customer; the page shows no amounts for Core, Plus or Pro, only 'a Greenhouse expert can recommend the right plan and provide custom pricing'.","status":"not_published","url":"https://www.greenhouse.com/pricing","locator":"FAQ: How does Greenhouse pricing work?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Greenhouse pricing is customized based on your company’s hiring needs."}]}]},{"slug":"grok","name":"Grok","vendor":"SpaceXSI (xAI)","category":"assistants","plans":[{"id":"T46","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: SpaceXSI may use prompts, searches, uploads and Grok's responses to train its models; Private Chat is excluded","status":"verified","url":"https://x.ai/legal/faq","locator":"FAQ 'Does SpaceXSI use my content for model training?'","url2":"https://x.ai/legal/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"The user deselects 'Improve the model': on grok.com under Settings > Data, in the app under Settings > Data Controls. Only new conversations are affected; Private Chat (ghost icon) is never used for training. Grok inside X has its own setting in X","status":"verified","url":"https://x.ai/legal/faq","locator":"FAQ 'How do I select whether my content is used for model training?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No EU option documented","status":"not_published","url":"https://x.ai/legal/faq","locator":"Consumer FAQ (full text)","url2":"https://x.ai/legal/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated. SpaceXSI describes itself as a US-based company; its published sub-processors are in the US apart from a UK subsidiary","status":"not_published","url":"https://x.ai/legal/privacy-policy","locator":"'About' paragraph","url2":"https://x.ai/legal/subprocessor-list","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"No. The consumer privacy policy applies, with SpaceXSI as controller; it states it does not cover data processed for business customers","status":"verified","url":"https://x.ai/legal/privacy-policy","locator":"Opening scope paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"No list specific to consumers. The privacy policy names categories of service providers (hosting, cloud, analytics, content delivery, support, payments); SpaceXSI's public sub-processor list has 24 entries, 23 in the US","status":"verified","url":"https://x.ai/legal/privacy-policy","locator":"Section on disclosure 'To our contracted service providers'","url2":"https://x.ai/legal/subprocessor-list","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search terms 'xAI', 'X.AI' or 'SpaceX'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Searches 'xAI', 'X.AI', 'SpaceX' each returned 'Query returned no results' (control search 'Zapier' returned its listing)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Conversations stay until the user deletes them; deleted chats and Private Chats are removed within 30 days unless de-identified or needed for safety or legal reasons","status":"verified","url":"https://x.ai/legal/faq","locator":"FAQ 'How long does SpaceXSI retain my information?'","url2":"https://x.ai/legal/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"None listed for the consumer service. SOC 2 is advertised for Grok Business; the Trust Center requires a sign-up form","status":"not_published","url":"https://x.ai/grok/business","locator":"Security & compliance list on the business page","url2":"https://trust.x.ai/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal account has no admin; the user manages training, personalisation and deletion","status":"verified","url":"https://x.ai/legal/faq","locator":"Sections on data controls and deletion","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Free use is available, including without an account; paid SuperGrok prices appear only after sign-in and were not captured","status":"verified","url":"https://x.ai/legal/faq","locator":"FAQs on use without logging in and on retention for unregistered users","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T47","plan":"Business","tier":"business","price":{"label":"$30 / user / mo","amount":30,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Grok Business lists 'No training', and SpaceXSI says it does not use business data, prompts or outputs to train its models","status":"verified","url":"https://x.ai/grok/business","locator":"Pricing card feature list ('No training')","url2":"https://x.ai/legal/faq-enterprise","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: business data is not used for training","status":"verified","url":"https://x.ai/grok/business","locator":"Pricing card ('No training')","url2":"https://x.ai/legal/faq-enterprise","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No EU option documented","status":"not_published","url":"https://x.ai/grok/business","locator":"Pricing and security sections","url2":"https://x.ai/legal/faq-enterprise","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated. SpaceXSI's sub-processors are all in the US except a UK subsidiary","status":"not_published","url":"https://x.ai/legal/subprocessor-list","locator":"Subprocessor table, column 'Location'","url2":"https://x.ai/legal/faq-enterprise","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. When personal data is submitted, SpaceXSI's DPA applies automatically and is incorporated into its Enterprise Terms of Service","status":"verified","url":"https://x.ai/legal/faq-enterprise","locator":"FAQ on the Data Processing Addendum","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 24 entries: 23 in the US (AWS, Google Cloud, Oracle, Cloudflare, MongoDB, Stripe and others) and a SpaceXSI subsidiary in the UK","status":"verified","url":"https://x.ai/legal/subprocessor-list","locator":"Subprocessor table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search terms 'xAI', 'X.AI' or 'SpaceX'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Searches 'xAI', 'X.AI', 'SpaceX' each returned 'Query returned no results' (control search 'Zapier' returned its listing)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Custom data retention is listed as a Grok Business feature; no default period for chats is stated. API inputs and outputs are deleted within 30 days unless agreed otherwise","status":"verified","url":"https://x.ai/grok/business","locator":"Pricing card feature list ('Custom data retention')","url2":"https://x.ai/legal/faq-enterprise","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type I and Type II; GDPR and CCPA compliance claimed. The Trust Center requires a sign-up form","status":"verified","url":"https://x.ai/grok/business","locator":"Badges at the top and 'Security & compliance' in the pricing card","url2":"https://trust.x.ai/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Grok Business includes role-based access control, team and seat management, SSO and SCIM, connectors and audit controls; switching individual AI features off is not described","status":"verified","url":"https://x.ai/grok/business","locator":"Pricing card feature list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 30 per user/month","status":"not_published","url":"https://x.ai/grok/business","locator":"Section 'Pricing', card 'Business'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"help-scout","name":"Help Scout","vendor":"Help Scout PBC","category":"writing-and-email","plans":[{"id":"T364","plan":"Plus","tier":"business","price":{"label":"$45 / user / mo","amount":45,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: de-identified, aggregated customer data is used to train and develop Help Scout's AI unless you opt out by email; it does not retrain OpenAI's base model","status":"verified","url":"https://www.helpscout.com/company/legal/terms-of-service/","locator":"Terms of Service > 5.4 AI Practices","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Help Scout may use Training Datasets to perform its obligations under these Terms and for any other lawful business purpose, including but not limited to data analysis and to train and develop Help Scout’s artificial intelligence offerings."},{"key":"training_opt_out","value":"Email help@helpscout.com to opt out of your data being used for training datasets; customers with a signed BAA are opted out automatically","status":"verified","url":"https://www.helpscout.com/company/legal/terms-of-service/","locator":"Terms of Service > 5.4 AI Practices","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer may opt out of having Customer Data used for creating Training Datasets at any time by emailing help@helpscout.com."},{"key":"eu_residency_option","value":"Not stated; no EU hosting option found","status":"not_published","url":"https://www.helpscout.com/company/legal/security/","locator":"Looked at: security, sub-processors, DPA, privacy policy, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: hosted in AWS; the sub-processor list shows AWS in the USA","status":"verified","url":"https://www.helpscout.com/company/legal/security/","locator":"Security > Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Help Scout is hosted in AWS and maintains high standards for availability, backups and recovery on behalf of its customers."},{"key":"dpa","value":"Yes: the Data Processing Amendment is incorporated by reference into the Terms of Service (no signature step stated)","status":"verified","url":"https://www.helpscout.com/company/legal/terms-of-service/","locator":"Terms of Service > 5.2 Personal Data and PHI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"which is incorporated by reference into this Agreement."},{"key":"subprocessor_list","value":"Yes, public at https://www.helpscout.com/company/legal/sub-processors/ (last revised Jan 2025): 20 entries. AI providers: OpenAI, Anthropic, Google, plus Freeplay (AI quality control) and Pinecone (vector store)","status":"verified","url":"https://www.helpscout.com/company/legal/sub-processors/","locator":"List of Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Below is a list of sub-processors we work with."},{"key":"dpf_status","value":"Active (Help Scout; EU-US DPF, UK Extension, re-certification under review)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Help Scout'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After account termination Help Scout deletes (or on request returns) personal data, normally no later than 90 days; no chat retention period during use is stated","status":"verified","url":"https://www.helpscout.com/company/legal/dpa/","locator":"DPA > Return and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon termination of your account, Help Scout will delete, or at customer's request, return all personal data"},{"key":"certifications","value":"SOC 2 Type 2 (Security and Availability), report on request; HIPAA compliance with a signed BAA (1 certification, 1 compliance claim)","status":"verified","url":"https://www.helpscout.com/company/legal/security/","locator":"Security > SOC2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Help Scout is SOC2 Type 2 certified for Security and Availability."},{"key":"admin_ai_controls","value":"Partly: AI Answers is off by default and enabled in Beacon settings; to remove all AI features from the account, contact Help Scout (no self-serve master switch stated)","status":"verified","url":"https://www.helpscout.com/company/legal/ai-transparency/","locator":"AI Transparency > Quick reference","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you’d like to fully remove access to AI features in your account, please reach out to help@helpscout.com for assistance."},{"key":"price_eur","value":"Shown in USD only: $45 per user/month (Plus plan; page has a monthly/annual toggle showing -16%, billing basis and VAT not stated beside the price)","status":"not_published","url":"https://www.helpscout.com/pricing","locator":"Pricing > Plus","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"helpcrunch","name":"HelpCrunch","vendor":"HelpCrunch Corporation, Wilmington, DE, USA","category":"phone-and-voice","plans":[{"id":"T442","plan":"Pro","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no training clause found in the privacy policy, terms or pricing page. The AI Editor is said to use OpenAI's GPT.","status":"not_published","url":"https://helpcrunch.com/privacy-policy.html","locator":"Whole policy; terms of service; pricing page; docs AI suite page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated. No training opt-out is described because no training practice is stated.","status":"not_published","url":"https://helpcrunch.com/privacy-policy.html","locator":"Whole policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Data is stated to be kept in the EU by default (2018 blog post); no separate residency setting or plan is described.","status":"vendor_statement","url":"https://helpcrunch.com/blog/helpcrunch-becomes-gdpr-compliant/","locator":"GDPR changes list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We keep all our data on the territory of the EU."},{"key":"default_data_location","value":"The EU, according to a 2018 company blog post; the privacy policy and terms do not state a location.","status":"vendor_statement","url":"https://helpcrunch.com/blog/helpcrunch-becomes-gdpr-compliant/","locator":"GDPR changes list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We keep all our data on the territory of the EU."},{"key":"dpa","value":"Yes, on request: HelpCrunch says customers can ask by email to sign its DPA (statement from a 2018 GDPR blog post).","status":"vendor_statement","url":"https://helpcrunch.com/blog/helpcrunch-becomes-gdpr-compliant/","locator":"We're looking into our vendors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Note! If you want to sign the DPA with HelpCrunch or request any details about it, just email us at"},{"key":"subprocessor_list","value":"Not stated. No public sub-processor list found.","status":"not_published","url":"https://helpcrunch.com/privacy-policy.html","locator":"Privacy policy section 5; terms of service; GDPR blog post","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'HelpCrunch'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'HelpCrunch' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Cancelled accounts are permanently deleted after 6 months and can be restored within that time; a customer can ask for immediate deletion (2018 blog post).","status":"vendor_statement","url":"https://helpcrunch.com/blog/helpcrunch-becomes-gdpr-compliant/","locator":"Right to erasure / cancelling","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All the canceled accounts will be completely and permanently deleted after 6 months."},{"key":"certifications","value":"Not stated. No security certifications named in the pages read.","status":"not_published","url":"https://helpcrunch.com/privacy-policy.html","locator":"Privacy policy; terms; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. No organisation-wide AI switch described.","status":"not_published","url":"https://helpcrunch.com/pricing.html","locator":"Pricing page AI sections; docs AI suite page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Price not captured: the pricing page sets prices with sliders that load only in a browser.","status":"not_captured","url":"https://helpcrunch.com/pricing.html","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"heygen","name":"HeyGen","vendor":"HeyGen Technology Inc.","category":"design-images-and-video","plans":[{"id":"T117","plan":"Business","tier":"business","price":{"label":"$149 / mo","amount":149,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. HeyGen says data of non-enterprise customers may be used to train and enhance the models behind its services; only enterprise customers' data is excluded. Users can opt out by email","status":"verified","url":"https://security.heygen.com/","locator":"Trust centre FAQ 'Does HeyGen train its models on my data?'","url2":"https://www.heygen.com/terms","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Yes, by email: users can ask HeyGen to opt them out of training using the contact address in the privacy policy; no setting is documented","status":"verified","url":"https://www.heygen.com/privacy","locator":"Section on using input to train and enhance models ('You may request to opt-out … by contacting us')","url2":"https://security.heygen.com/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://www.heygen.com/security","locator":"Whole page","url2":"https://www.heygen.com/data-processing-addendum","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: HeyGen's services are hosted on AWS in the US","status":"verified","url":"https://www.heygen.com/security","locator":"Infrastructure section","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, for organisations: when the terms are accepted for an entity, HeyGen's Data Processing Addendum governs personal data in the content uploaded","status":"verified","url":"https://www.heygen.com/terms","locator":"Clause on Data Processing Addendum ('where you agree to these terms on behalf of an entity')","url2":"https://www.heygen.com/data-processing-addendum","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 20 entries, 19 in the US and BytePlus in Singapore; AI from Anthropic, OpenAI, xAI, Google, Microsoft Azure, ElevenLabs, fal, Cartesia and Gladia","status":"verified","url":"https://security.heygen.com/","locator":"Trust centre section 'Subprocessors' (View all)","url2":"https://www.heygen.com/data-processing-addendum","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (HeyGen Technology Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'HeyGen'","url2":"https://www.heygen.com/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: HeyGen keeps data as long as needed by listed criteria; under the DPA it deletes or returns customer personal data on written request","status":"not_published","url":"https://www.heygen.com/privacy","locator":"Retention section","url2":"https://www.heygen.com/data-processing-addendum","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II (report on request; SOC 3 report listed)","status":"verified","url":"https://security.heygen.com/","locator":"Trust centre compliance and documents sections","url2":"https://www.heygen.com/security","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not published: the product itself is AI video generation; Business adds role controls and SSO but no AI on/off setting is described","status":"not_published","url":"https://www.heygen.com/pricing","locator":"Plan card 'Business'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 149 per month (monthly view selected), including 1,500 credits; extra seats USD 20 per seat/month","status":"not_published","url":"https://www.heygen.com/pricing","locator":"Tab 'For Businesses', plan card 'Business'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"hibob","name":"HiBob","vendor":"Hi Bob Ltd. (HiBob; the contracting entity varies by region)","category":"documents-hr-and-finance","plans":[{"id":"T591","plan":"Bob platform, quote-based","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. HiBob states customer data processed by its AI features is not used to train AI models, and its AI service providers may not train their models on it.","status":"verified","url":"https://www.hibob.com/hibob-ai-terms/","locator":"2. Data Usage and Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Data processed by HiBob AI Features is not used to train artificial intelligence models."},{"key":"training_opt_out","value":"Nothing to do for training: HiBob states AI customer data is not used to train models. Admins can also switch individual AI features on or off in the AI Settings page, and HiBob says the platform can be run without AI features.","status":"verified","url":"https://www.hibob.com/privacy/ai-trust-center/","locator":"Opt-out control for AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can selectively disable or enable features through the AI Settings page."},{"key":"eu_residency_option","value":"Hosting is in the EU by default (AWS Ireland and Germany), and the sub-processor list shows EU processing locations; no separate EU setting or non-EU region choice is described.","status":"verified","url":"https://www.hibob.com/privacy/security/","locator":"Data Hosting Location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"HiBob uses AWS data centers in Ireland (main) and Germany (backup)."},{"key":"default_data_location","value":"EU: Amazon Web Services data centres in Ireland (main) with Germany (backup).","status":"verified","url":"https://www.hibob.com/privacy/security/","locator":"What is HiBob doing to meet security standards? Data Hosting Location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"HiBob uses AWS data centers in Ireland (main) and Germany (backup)."},{"key":"dpa","value":"Yes. A Data Processing Addendum is an integral part of the Subscription Terms, pre-signed by HiBob and available for counter-signature by the customer.","status":"verified","url":"https://www.hibob.com/privacy/data-processing-addendum/","locator":"Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Protection Addendum has been pre-signed by an authorized signatory on behalf of HiBob and is available for execution by counter-signature"},{"key":"subprocessor_list","value":"Yes, public at https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/ (Nov 2025): 8 group affiliates and 23 third-party rows (19 companies) across core, optional and module-specific lists. AI providers named: OpenAI, Microsoft (Azure OpenAI), Amazon Web Services (hosted AI models).","status":"verified","url":"https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/","locator":"HiBob Subsidiaries and Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following tables provide information regarding HiBob’s corporate affiliates and third-party Sub-processors that may have access to Personal Data"},{"key":"dpf_status","value":"Active (Hibob; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Hi Bob'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer data sent to AI providers is not stored or logged. After the contract ends HiBob deletes personal data of authorised users within 30 days, and the customer can request a copy within 14 days of termination. In-term retention periods not stated.","status":"verified","url":"https://www.hibob.com/privacy/customer-subscription-terms/","locator":"12.4 Effects of Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"HiBob shall in accordance with its DPA, delete Personal Data held about any Authorized User within thirty (30) days from the date of termination."},{"key":"certifications","value":"ISO 27001, ISO 27018, ISO 42001, SOC 1 Type 2 and SOC 2 Type 2 (5 named); HIPAA and GDPR compliance also listed.","status":"verified","url":"https://www.hibob.com/privacy/ai-trust-center/","locator":"Encryption at every step","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"HiBob follows industry best practices, including ISO 27001, ISO27018, ISO42001, HIPAA, GDPR, SOC2 type 2, and SOC1 type 2"},{"key":"admin_ai_controls","value":"Yes. Admins can selectively disable or enable AI features through the AI Settings page and restrict access to specific features by role.","status":"verified","url":"https://www.hibob.com/privacy/ai-trust-center/","locator":"Opt-out control for AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can selectively disable or enable features through the AI Settings page."},{"key":"price_eur","value":"No public price; HiBob quotes per employee after a pricing request, and says pricing may vary by region.","status":"not_published","url":"https://www.hibob.com/pricing-plans/","locator":"FAQ: How much does HiBob cost?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"hirevue","name":"HireVue platform","vendor":"HireVue, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T617","plan":"enterprise subscription","tier":"enterprise","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in part: the MSA lets HireVue keep and use usage data derived from the customer's use, which can include aggregated customer data, for internal research and development 'including training and product improvement'. The clause does not name AI models. No opt-out is stated.","status":"verified","url":"https://legal.hirevue.com/legal-center/master-services-agreement","locator":"Hirevue Data Usage Rights","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Hirevue may collect, use and retain data derived from Customer’s use of the Services (“Usage Data”) for purposes of its internal research and development, including training and product improvement."},{"key":"training_opt_out","value":"Not stated; no setting or request to stop the usage-data training right in the MSA is described.","status":"not_published","url":"https://legal.hirevue.com/legal-center/master-services-agreement","locator":"Hirevue Data Usage Rights; DPA; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: no setting or plan for EU-only storage is described. The sub-processor page mentions a 'customer’s selected AWS region' for Amazon Bedrock, and the security page says HireVue is co-located in the US and Europe.","status":"not_published","url":"https://legal.hirevue.com/legal-center/subprocessors","locator":"Amazon Bedrock row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data remains within the customer’s selected AWS region."},{"key":"default_data_location","value":"Not stated per customer. The security page says HireVue is co-located in the US and Europe; the DPA allows processing in the US and other countries where affiliates and sub-processors operate.","status":"not_published","url":"https://www.hirevue.com/platform/enterprise-security-compliance","locator":"Ready to scale","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Hirevue is co-located in the U.S. and Europe to serve clients in 180+ countries worldwide."},{"key":"dpa","value":"Yes. A DPA is published and forms part of the written agreement; HireVue is processor and standard contractual clauses are included.","status":"verified","url":"https://legal.hirevue.com/legal-center/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) forms part of and is supplemental to the written agreement (“Agreement”) between HireVue, Inc."},{"key":"subprocessor_list","value":"Yes, public at https://legal.hirevue.com/legal-center/subprocessors (version 5.0, 24 Aug 2026): 28 entries. AI-related: Anthropic (via AWS Bedrock), Amazon Bedrock, OpenAI (AI Interviewer), ElevenLabs (voice), Google Cloud (speech-to-text), Brainfish AI.","status":"verified","url":"https://legal.hirevue.com/legal-center/subprocessors","locator":"Approved Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI Embedding and large language model services used to support AI Interviewer functionality."},{"key":"dpf_status","value":"Active (HireVue, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'HireVue'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer data is stored for two years from first storage, after which HireVue may delete it; retention periods are customer-configurable. HireVue deletes all customer data promptly on written request. At contract end it deletes or returns personal data, except backups.","status":"verified","url":"https://legal.hirevue.com/legal-center/master-services-agreement","locator":"Data Retention and Export","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer hereby directs Hirevue to store Customer Data and Materials during the applicable Subscription Term for two (2) years from the date of initial storage"},{"key":"certifications","value":"4 named: ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type 2 (annual), FedRAMP authorization.","status":"verified","url":"https://www.hirevue.com/platform/enterprise-security-compliance","locator":"Industry standard security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Hirevue is certified to ISO/IEC 27001:2022 for Information Security Management and ISO/IEC 27701:2019 for Privacy Information Management."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features is described in the MSA, DPA, security page or AI page.","status":"not_published","url":"https://legal.hirevue.com/legal-center/master-services-agreement","locator":"MSA, DPA, security page, AI in hiring page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: HireVue is sold to enterprises through sales and order documents; no pricing page or plan names are published, only 'Request Demo'.","status":"not_published","url":"https://www.hirevue.com/platform/enterprise-security-compliance","locator":"Security page and site navigation (no pricing page found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"hootsuite","name":"Hootsuite","vendor":"Hootsuite Inc.","category":"sales-marketing-and-support","plans":[{"id":"T518","plan":"Professional","tier":"business","price":{"label":"€199 / user / mo","amount":199,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, by Hootsuite itself: the AI terms let it use Customer Content and AI outputs to develop and improve its AI features, including its machine-learning technologies. Third-party AI providers may not train on them, and nothing is shared with other customers.","status":"verified","url":"https://hootsuite.com/legal/ai-terms","locator":"2(c) Service Improvements","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we may use Customer Content and Outputs to develop and improve the features of the AI-Powered Services (including our machine-learning technologies)"},{"key":"training_opt_out","value":"Not captured: the Hootsuite trust centre lists a public PDF named 'AI Functionality Opt-out Options' that this check could not read. The AI Terms and privacy policy describe no opt-out.","status":"not_captured","url":"https://trustcenter.hootsuite.com/","locator":"Featured Documents: AI Functionality Opt-out Options (PDF)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated for this plan; privacy page says data is housed in the United States and no EU hosting option is described.","status":"not_published","url":"https://www.hootsuite.com/trust-center/privacy","locator":"Where Your Data is Located; security practices; plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: content is hosted in AWS data centres in the United States.","status":"verified","url":"https://www.hootsuite.com/trust-center/privacy","locator":"Where Your Data is Located","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your data is housed in secure data centres in the United States."},{"key":"dpa","value":"Yes, on request for self-serve plans: a pre-signed DPA is on the website and becomes binding once Hootsuite receives the customer's signed copy.","status":"verified","url":"https://hootsuite.com/legal/terms","locator":"Self-Serve Terms of Service, clause 15","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you may enter into a DPA by visiting www.hootsuite.com/legal/data-processing-addendum to access a pre-signed DPA. Once we receive your signed DPA, this becomes legally binding"},{"key":"subprocessor_list","value":"Yes, https://hootsuite.com/legal/subprocessor-list (updated Sept 21, 2026): 20 rows, 15 companies. AI providers: OpenAI, Microsoft, Google Cloud Canada; Talkwalker (affiliate) for AI-powered services.","status":"verified","url":"https://hootsuite.com/legal/subprocessor-list","locator":"Subprocessor List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subprocessor list last updated: September 21, 2026"},{"key":"dpf_status","value":"No listing found for search term 'Hootsuite'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Hootsuite' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as needed to provide the service; draft and published posts are retained while the customer uses it. Deleted or anonymised once no longer needed or on request; no fixed number of days; aggregated data is kept for analysis.","status":"verified","url":"https://www.hootsuite.com/legal/privacy","locator":"5. How long we retain your information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain information about you only for as long as necessary to provide and manage our Services, to manage our business, and for financial and legal purposes."},{"key":"certifications","value":"14 badges on the trust centre, of which 11 are certifications or attestations: ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type II, SOC 3, PCI, CSA STAR 1, Cyber Essentials, FedRAMP Li-SaaS, TX-RAMP. GDPR, CCPA and VPAT are compliance labels.","status":"verified","url":"https://trustcenter.hootsuite.com/","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GDPR ISO 27001:2022 ISO 27017 ISO 27018 ISO 27701 PCI SOC 2 Type II SOC 3"},{"key":"admin_ai_controls","value":"Not captured: the trust centre's 'AI Functionality Opt-out Options' PDF could not be read; the AI Terms and plans page show no admin switch.","status":"not_captured","url":"https://hootsuite.com/legal/ai-terms","locator":"AI Terms; plans page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 199 per user/month, billed annually, excluding taxes (Professional)","status":"verified","url":"https://www.hootsuite.com/plans?view=browser","locator":"Professional plan card and price footnote","url2":"","checkedOn":"2026-10-20","checkedFrom":"browser, Berlin (DE)","quote":"Prices displayed in EUR, based on annual billing, but do not include applicable taxes."}]}]},{"slug":"hostinger-ai-builder","name":"Hostinger AI Builder","vendor":"Hostinger International Ltd.","category":"code-and-app-builders","plans":[{"id":"T547","plan":"Unlimited","tier":"business","price":{"label":"$3.49 / mo","amount":3.49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Terms of Service say that by using the AI services you authorise Hostinger to store and use your Input and Output, including for the training and development of machine learning models. No opt-out is described.","status":"verified","url":"https://www.hostinger.com/legal/universal-terms-of-service-agreement","locator":"13. Artificial Intelligence (AI) Services, (v)","url2":"https://www.hostinger.com/legal/special-terms","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you authorize Hostinger to store and use Input and Output for the purposes of providing you with the Services, to develop and improve the Services, including as part of the design, training and development process for machine learning models."},{"key":"training_opt_out","value":"Not stated: the terms authorise training on AI Input and Output and no setting, request or email to stop it is described in the terms, special terms, privacy policy or DPA.","status":"not_published","url":"https://www.hostinger.com/legal/special-terms","locator":"AI Builder special terms; Terms of Service, privacy policy and DPA also searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated for AI Builder; no setting to keep data in the EU is described in the DPA, privacy policy or AI Builder terms.","status":"not_published","url":"https://www.hostinger.com/legal/dpa","locator":"Appendices; privacy policy and special terms also checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated as a default; the privacy policy says some servers are outside the EU/EEA (US, Brazil, Singapore, Indonesia). DPA sub-processors include AWS EMEA SARL and Google Cloud EMEA.","status":"not_published","url":"https://www.hostinger.com/legal/privacy-policy","locator":"11. Data transfers and use of third-party services","url2":"https://www.hostinger.com/legal/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Some of our servers are located outside EU or European Economic Area (EEA), such as US, Brazil, Singapore, Indonesia, therefore, depending on your choice"},{"key":"dpa","value":"Yes: a Data Processing Addendum annexed to the Terms of Service covers Hostinger AI Builder as a Covered Service.","status":"verified","url":"https://www.hostinger.com/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"and is annexed to and supplements our Terms of Service and any and all agreements governing"},{"key":"subprocessor_list","value":"Yes, inside the DPA (Appendix 3): 8 entries. AI providers: Anthropic Ireland, Limited and spectra tech, UAB (nexos.ai).","status":"verified","url":"https://www.hostinger.com/legal/dpa","locator":"Appendix 3 Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AMAZON WEB SERVICES EMEA SARL Google Cloud EMEA"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Hostinger International Limited, Larnaca, Cyprus)","status":"verified","url":"https://www.hostinger.com/legal/universal-terms-of-service-agreement","locator":"Contracting entity","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"HOSTINGER INTERNATIONAL LIMITED, Cyprus private limited company, registered address 61 Lordou Vironos str., 6023"},{"key":"data_retention","value":"Customer Data is deleted 30 days after the termination date; controls let you retrieve or delete data earlier. Retention of AI prompts is not stated.","status":"verified","url":"https://www.hostinger.com/legal/dpa","locator":"Appendix 1: deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deletion of Customer Data will take place thirty (30) days following Termination Date, subject to the terms of the particular"},{"key":"certifications","value":"Not captured: the trust centre (trust.hostinger.com) returned 403 to a server fetch; no certification is named in the DPA, privacy policy or terms.","status":"not_captured","url":"https://trust.hostinger.com/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the AI Builder special terms describe plans, input limits and build modes but no organisation-wide switch for AI.","status":"not_published","url":"https://www.hostinger.com/legal/special-terms","locator":"1. Overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $3.49 per month promotional price for the Unlimited plan on a 48-month term ($167.52 upfront), renewing at $16.99 per month; prices are listed without VAT.","status":"not_published","url":"https://www.hostinger.com/ai-builder","locator":"Pricing: Unlimited","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"hubspot","name":"HubSpot","vendor":"HubSpot","category":"sales-marketing-and-support","plans":[{"id":"T24","plan":"Starter","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: AI Model Training is on by default; a Super Admin can switch it off for future data. Third-party AI providers may not train on customer data","status":"verified","url":"https://knowledge.hubspot.com/account-management/hubspot-ai-mode-training","locator":"Help article (updated 8 Sep 2026)","url2":"https://knowledge.hubspot.com/hubspot-ai-cloud-infrastructure-frequently-asked-questions","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"A Super Admin must act: Settings > Account management > AI > Access tab, turn the 'AI Model Training' switch off (on by default). It applies to future data only; data already used cannot be removed from trained models","status":"verified","url":"https://knowledge.hubspot.com/account-management/hubspot-ai-mode-training","locator":"Section 'Opt out of HubSpot's AI model training in your AI settings' (updated 8 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: EU (Germany) data centre; paid Starter and above can change data centre later","status":"verified","url":"https://knowledge.hubspot.com/account-security/hubspot-cloud-infrastructure-and-data-hosting-frequently-asked-questions","locator":"Hosting regions and migration","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Assigned by sign-up location: US, Canada, Australia or EU (Germany); a sign-up from Germany is placed in the EU data centre","status":"verified","url":"https://knowledge.hubspot.com/account-security/hubspot-cloud-infrastructure-and-data-hosting-frequently-asked-questions","locator":"FAQ (updated 24 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA (last modified 16 Sep 2026) is incorporated into the Customer Terms of Service; DPF and SCCs","status":"verified","url":"https://legal.hubspot.com/dpa","locator":"Preamble, sections 11 and 13.1","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public (last modified 16 Sep 2026): 17 third-party companies; for EU accounts the AI providers process in the EEA (AWS, Google, OpenAI incl. Switzerland, Baseten from 16 Oct 2026); 30 days' notice to subscribers","status":"verified","url":"https://legal.hubspot.com/sub-processors-page","locator":"Infrastructure and feature-specific tables","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (HubSpot, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'HubSpot'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer data is kept for the subscription and deleted or returned when it ends, under HubSpot's product-specific procedures; HubSpot enforces zero data retention with its AI providers where possible","status":"verified","url":"https://legal.hubspot.com/dpa","locator":"Section 3.6 'Deletion or Return of Customer Personal Data'","url2":"https://knowledge.hubspot.com/account-security/hubspot-ai-cloud-infrastructure-frequently-asked-questions","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1 Type II, SOC 2 Type II and SOC 3; HIPAA; EU Cloud Code of Conduct; TRUSTe Certified Privacy. HubSpot cites ISO 27001 only for its hosting providers","status":"verified","url":"https://trust.hubspot.com/","locator":"Trust Center 'Badges'","url2":"https://legal.hubspot.com/security","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Admins can turn off or limit HubSpot's generative AI features and the data sent to AI providers in the account's AI settings (Account management > AI)","status":"verified","url":"https://knowledge.hubspot.com/account-security/hubspot-ai-cloud-infrastructure-frequently-asked-questions","locator":"FAQ 'Can I configure how generative AI features are used?'","url2":"https://knowledge.hubspot.com/account-management/hubspot-ai-mode-training","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured in EUR: hubspot.de pricing did not load on the check date; hubspot.com shows USD 20 per seat/month list, USD 7 for new customers","status":"not_captured","url":"https://www.hubspot.com/pricing/crm?currency=EUR","locator":"Starter card","url2":"https://www.hubspot.de/pricing/crm","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"humata","name":"Humata","vendor":"Tilda Technologies Inc. (DBA Humata), Austin, Texas, USA","category":"documents-hr-and-finance","plans":[{"id":"T587","plan":"Team","tier":"business","price":{"label":"$49 / user / mo","amount":49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. The security FAQ says Humata does not use user data to train its AI models. The terms give Humata a broad licence for \"service provision, promotion, and other purposes\" but do not mention training.","status":"verified","url":"https://www.humata.ai/security","locator":"FAQ: Will Humata train AI Models on my data?","url2":"https://www.humata.ai/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use any of the data provided by our users to train our AI models."},{"key":"training_opt_out","value":"Nothing to do: the security FAQ states Humata does not use user data to train its models. No opt-out setting is described.","status":"verified","url":"https://www.humata.ai/security","locator":"FAQ: Will Humata train AI Models on my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use any of the data provided by our users to train our AI models."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://www.humata.ai/security","locator":"Security page, privacy policy, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no storage country or region given. Humata names Amazon Web Services, Google Cloud Platform and Supabase for storage.","status":"not_published","url":"https://www.humata.ai/security","locator":"FAQ: Which Cloud Storage Services Does Humata Utilize?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; no data processing agreement found in the privacy policy, terms of service or security page.","status":"not_published","url":"https://www.humata.ai/privacy-policy","locator":"Privacy policy, terms of service, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found. The security FAQ names AWS, Google Cloud and Supabase for storage and machine learning, and the privacy policy names Intercom, Amazon, Google, Facebook, LinkedIn, Reddit and Twitter as third-party collectors. The pricing page lists GPT-5 support.","status":"not_published","url":"https://www.humata.ai/security","locator":"FAQ: Which Cloud Storage Services; privacy policy section 5","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Humata', 'Tilda'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Humata', 'Tilda' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Document data used for the model is not retained beyond 30 days; dashboard data is kept until you ask otherwise, and clients can delete their data permanently at any time. Period after cancellation not stated.","status":"verified","url":"https://www.humata.ai/security","locator":"FAQ: What Is Humata's Data Retention Policy?","url2":"https://www.humata.ai/privacy-policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"document data used for our model is not retained beyond 30 days."},{"key":"certifications","value":"SOC 2 Type II (1 certification named). The privacy policy states Humata is SOC 2 Type II compliant without limiting it to a plan; ISO 27001 is named only as a standard that informs the programme.","status":"verified","url":"https://www.humata.ai/privacy","locator":"6. Security Measures","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Humata is SOC 2 Type II compliant, demonstrating our commitment to secure and reliable systems."},{"key":"admin_ai_controls","value":"Not stated; no admin switch to limit AI features is described.","status":"not_published","url":"https://www.humata.ai/pricing","locator":"Plan comparison table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $49 per user/month for the Team plan (teams up to 10 people); the pricing FAQ says billing is a monthly subscription. VAT not shown.","status":"not_published","url":"https://www.humata.ai/pricing","locator":"Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"hunter","name":"Hunter","vendor":"Hunter Web Services, Inc. (Wilmington, Delaware)","category":"writing-and-email","plans":[{"id":"T371","plan":"Growth","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. Hunter processes AI-feature content (prompts, drafts) only on the user's instructions and not for its own purposes; its AI providers are contractually barred from training on it. Contact-search activity is not used to train models either.","status":"verified","url":"https://hunter.io/transparency/ai","locator":"10.7 Safeguards common to all AI processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No model training on Hunter data: Hunter contractually requires that its AI providers not use any data processed through our integration for AI model training."},{"key":"training_opt_out","value":"Nothing to do: Hunter states its AI providers are contractually barred from training on the data. Optional AI features can be turned off per sequence; account-wide opt-out is by email to privacy@hunter.io.","status":"verified","url":"https://hunter.io/transparency/ai","locator":"10.9 User controls for AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you want to opt out of all optional AI features across your account, contact privacy@hunter.io."},{"key":"eu_residency_option","value":"EU hosting is the default (Belgium); no separate setting or plan needed. Some sub-processors are in the US.","status":"verified","url":"https://hunter.io/privacy-policy","locator":"Data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"While Hunter servers are located in Belgium, Hunter may need to transfer your personal data"},{"key":"default_data_location","value":"Belgium: Google Cloud Platform data centre (eu-west-1).","status":"verified","url":"https://hunter.io/security-policy","locator":"Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Hunter services are hosted on Google Cloud Platform (GCP) in Belgium."},{"key":"dpa","value":"Yes. An EU and UK Data Processing Agreement is incorporated into the Terms of Service by reference.","status":"verified","url":"https://hunter.io/terms-of-service","locator":"Data protection section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Processing Agreement is incorporated into this Agreement by this reference."},{"key":"subprocessor_list","value":"Yes: https://hunter.io/subprocessors, 34 rows (32 companies; Google appears 3 times). AI providers listed: OpenAI and Google (Gemini API).","status":"verified","url":"https://hunter.io/subprocessors","locator":"Sub-processors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI Hunter users name, contact information, demographic information, or other information provided by the user in unstructured data."},{"key":"dpf_status","value":"No listing found for search term 'Hunter Web Services'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Hunter Web Services' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Campaign data and leads kept until the account is deleted; search and verification history 3 months; transactional email history 90 days; session recordings 30 days. Customer can delete data; OpenAI may keep API data up to 30 days.","status":"verified","url":"https://hunter.io/privacy-policy","locator":"Retention (Account Management and exceptions)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Until Hunter Users delete their account, with exceptions: Email search and verification history: 3 months."},{"key":"certifications","value":"None named. The DPA only says Hunter undergoes annual security assessments by an independent firm; no SOC 2 or ISO certificate is named.","status":"not_published","url":"https://hunter.io/security-policy","locator":"Security policy and DPA Annex","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: each user can disable AI features (writing assistance, Discover, personalization) in account settings at any time; no organisation-wide admin switch is described.","status":"verified","url":"https://hunter.io/privacy-policy","locator":"Right to opt out of AI features (Hunter Users)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Users can disable AI features entirely in account settings."},{"key":"price_eur","value":"149 EUR per month billed monthly, or 104 EUR per month billed yearly (1,248 EUR per year). No VAT statement on the page.","status":"verified","url":"https://hunter.io/pricing","locator":"Growth plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Growth Grow momentum in your outreach 149€ 104€ /month billed monthly 1,788€ 1,248€ billed yearly"}]}]},{"slug":"hypotenuse-ai","name":"Hypotenuse AI","vendor":"Hypotenuse Technologies Pte. Ltd.","category":"writing-and-email","plans":[{"id":"T342","plan":"Basic","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per the pricing page only: data is never used to train public AI models. The terms of service let Hypotenuse use content data to improve its services; neither policy mentions training.","status":"vendor_statement","url":"https://hypotenuse.ai/pricing","locator":"FAQ: How does Hypotenuse AI handle data security and compliance?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data remains your own and is used only to power your workflows in Hypotenuse AI. It is never shared with third parties or used to train public AI models."},{"key":"training_opt_out","value":"Not stated: no setting or email to stop training is described; the vendor says it does not train public models on customer data.","status":"not_published","url":"https://hypotenuse.ai/pricing","locator":"Looked at pricing FAQ, privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: no EU data-location option found.","status":"not_published","url":"https://hypotenuse.ai/privacy-policy","locator":"Looked at privacy policy, terms of service, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: data from users outside the US is transferred to and processed in the US.","status":"verified","url":"https://hypotenuse.ai/privacy-policy","locator":"Transfer of Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to United States and process it there."},{"key":"dpa","value":"Not stated: no data processing agreement mentioned; pricing page says security reviews and questionnaires are supported.","status":"not_published","url":"https://hypotenuse.ai/privacy-policy","locator":"Looked at privacy policy, terms of service, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not stated: no public sub-processor list found (0 entries); policy names analytics tools such as Mixpanel and Google, no AI model providers.","status":"not_published","url":"https://hypotenuse.ai/privacy-policy","locator":"Looked at privacy policy, terms of service, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Hypotenuse'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Hypotenuse' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: personal data is kept as long as necessary for the policy's purposes and legal duties; deletion by account request.","status":"verified","url":"https://hypotenuse.ai/privacy-policy","locator":"6. Retention of Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy."},{"key":"certifications","value":"1 named: SOC 2 Type II (security, availability, confidentiality), stated on the pricing page only.","status":"vendor_statement","url":"https://hypotenuse.ai/pricing","locator":"FAQ: How does Hypotenuse AI handle data security and compliance?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Hypotenuse AI is SOC 2 Type II compliant, with controls covering security, availability, and confidentiality."},{"key":"admin_ai_controls","value":"Not offered on Basic (1 seat); team access control is an Ecommerce Enterprise feature. No switch for AI features stated.","status":"not_published","url":"https://hypotenuse.ai/pricing","locator":"Compare all features table: Basic vs Ecommerce Enterprise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Custom pricing: no price shown for Basic (1 seat); contact the vendor.","status":"not_published","url":"https://hypotenuse.ai/pricing","locator":"Basic card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"ideogram","name":"Ideogram","vendor":"Ideogram AI (Ideogram, Inc.)","category":"design-images-and-video","plans":[{"id":"T563","plan":"Team","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, per the privacy policy: Ideogram may use the information it collects (section 2 covers prompts and uploaded images) for training the models that power its services. No exemption for the Team plan is stated.","status":"verified","url":"https://ideogram.ai/legal/privacy","locator":"2. Collection and use of information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"training the models that power our Services"},{"key":"training_opt_out","value":"Not stated; no opt-out of model training found for any plan.","status":"not_published","url":"https://ideogram.ai/legal/privacy","locator":"Privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://ideogram.ai/legal/privacy","locator":"Privacy policy, terms, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no country or hosting region is named. The privacy policy only says information is stored and processed outside the user's country of residence.","status":"not_published","url":"https://ideogram.ai/legal/privacy","locator":"8. Data security and retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; no data processing agreement found in the terms, privacy policy or pricing page.","status":"not_published","url":"https://ideogram.ai/pricing/","locator":"Pricing page, terms of service, privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found in the privacy policy, terms or pricing page.","status":"not_published","url":"https://ideogram.ai/legal/privacy","locator":"Privacy policy, terms of service, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Ideogram'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Ideogram' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: the privacy policy says information is kept as long as reasonably necessary for its purposes. You may have a right to ask Ideogram to delete personal information it holds about you.","status":"verified","url":"https://ideogram.ai/legal/privacy","locator":"8. Data security and retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain your information for as long as is reasonably necessary for the purposes"},{"key":"certifications","value":"Not stated for the Team plan. The prepaid Enterprise plan card says 'SOC 2 audited security'.","status":"not_published","url":"https://ideogram.ai/pricing/","locator":"Plans & pricing, Enterprise (prepaid) card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the Team plan lists central billing and administration but no setting to switch off AI features.","status":"not_published","url":"https://ideogram.ai/pricing/","locator":"Plans & pricing, Team","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Central billing and administration"},{"key":"price_eur","value":"Shown in USD only: $20 per user/month billed annually ($240 a year per user); list price $30 per user/month.","status":"not_published","url":"https://ideogram.ai/pricing/","locator":"Plans & pricing, Team","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"per user/month, $240 billed annually"}]}]},{"slug":"ifttt","name":"IFTTT","vendor":"IFTTT, Inc.","category":"automation","plans":[{"id":"T481","plan":"Pro+","tier":"business","price":{"label":"$8.99 / mo","amount":8.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training or machine-learning clause found in the privacy policy or terms. The plans page lists 'AI services' as a Pro+ feature.","status":"not_published","url":"https://ifttt.com/privacy","locator":"Privacy policy and terms (same page); searched for train, machine learning, artificial","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause was found, so no opt-out is described.","status":"not_published","url":"https://ifttt.com/privacy","locator":"Privacy policy and terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option stated; the policy says personal data is provided to IFTTT in the US and hosted on US servers.","status":"verified","url":"https://ifttt.com/privacy","locator":"GDPR section, Transfers of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is being provided to IFTTT in the U.S. and will be hosted on U.S. servers"},{"key":"default_data_location","value":"United States: the service is hosted and operated in the US by IFTTT and its service providers.","status":"verified","url":"https://ifttt.com/privacy","locator":"GDPR section, Transfers of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Service is hosted and operated in the United States"},{"key":"dpa","value":"Not stated for this plan. The only data-processing wording is a developer-agreement line about an 'EU Data Processing policy'; no DPA for Pro+ found.","status":"not_published","url":"https://ifttt.com/privacy","locator":"Terms, platform section 2.4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The parties will each comply with applicable portions of the EU Data Processing policy."},{"key":"subprocessor_list","value":"No public list. The privacy policy names only categories (hosting, analytics, fraud prevention, telecom, co-location providers).","status":"not_published","url":"https://ifttt.com/privacy","locator":"GDPR section, sharing with vendors and service providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We share Personal Data with vendors, third party service providers and agents who work on our behalf"},{"key":"dpf_status","value":"No listing found for search term 'IFTTT'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'IFTTT' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data is kept while the account is open (longer where law requires). You can delete the account from your profile ('delete my account') or by request form.","status":"verified","url":"https://ifttt.com/privacy","locator":"How Long Do We Retain Your Personal Data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain Personal Data about you for as long as you have an open account with us"},{"key":"certifications","value":"None named on the privacy policy or plans page.","status":"not_published","url":"https://ifttt.com/privacy","locator":"Privacy policy, security paragraph; plans page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the plans page lists 'AI services' for Pro+ but describes no organisation admin switch.","status":"not_published","url":"https://ifttt.com/plans","locator":"Pro+ plan feature list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Pro+ $8.99 per month, billed annually as $107.88.","status":"not_published","url":"https://ifttt.com/plans","locator":"Pro+ plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$8.99 / month $107.88 billed annually"}]}]},{"slug":"ilovepdf","name":"iLovePDF","vendor":"ILOVEPDF, S.L., Barcelona, Spain","category":"documents-hr-and-finance","plans":[{"id":"T586","plan":"Premium","tier":"business","price":{"label":"€5 / mo","amount":5,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. iLovePDF states it does not use your content to train, improve or develop its own or any third-party AI models.","status":"verified","url":"https://www.ilovepdf.com/help/terms","locator":"Content and Intellectual Property in AI Tools","url2":"https://www.ilovepdf.com/help/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ILOVEPDF DOES NOT USE YOUR CONTENT TO TRAIN, IMPROVE, OR DEVELOP ITS AI MODELS OR ANY THIRD-PARTY AI MODELS."},{"key":"training_opt_out","value":"Nothing to do: iLovePDF states it does not use customer content to train AI models.","status":"verified","url":"https://www.ilovepdf.com/help/terms","locator":"Content and Intellectual Property in AI Tools","url2":"https://www.ilovepdf.com/help/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ILOVEPDF DOES NOT USE YOUR CONTENT TO TRAIN, IMPROVE, OR DEVELOP ITS AI MODELS OR ANY THIRD-PARTY AI MODELS."},{"key":"eu_residency_option","value":"Yes. Processing is in the EEA by default, and Premium includes \"Regional file processing\" in 7 regions (regions not named on the pricing page).","status":"verified","url":"https://www.ilovepdf.com/pricing","locator":"Premium plan features, Regional file processing","url2":"https://www.ilovepdf.com/help/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Regional file processing 7 regions"},{"key":"default_data_location","value":"Within the European Economic Area as a general rule, unless the user selected otherwise. Hosting providers include Hetzner (Germany) and Cloudscale (Switzerland).","status":"verified","url":"https://www.ilovepdf.com/help/privacy","locator":"5. Do we disclose your personal data to third parties","url2":"https://www.ilovepdf.com/help/privacy/subprocessors","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As a general rule, and except the user has selected otherwise, we process your personal data within the European Economic Area."},{"key":"dpa","value":"Yes. A Data Processing Agreement is attached as Appendix I to the privacy policy and applies when iLovePDF processes your files; no separate signing.","status":"verified","url":"https://www.ilovepdf.com/help/privacy","locator":"2. Who is the data controller","url2":"https://www.ilovepdf.com/help/privacy/data-processing-agreement","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ILOVEPDF will process these personal data only and exclusively to the extent necessary to provide you with the service and the data processing agreement that is attached as Appendix I to this privacy policy will apply."},{"key":"subprocessor_list","value":"Yes, public list at https://www.ilovepdf.com/help/privacy/subprocessors (revised 19 Feb 2026): 17 rows, 15 companies. AI provider listed: OpenAI (EU/US).","status":"verified","url":"https://www.ilovepdf.com/help/privacy/subprocessors","locator":"Third-Party Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ILOVEPDF engages the following entities to provide processing activities for Customer Data"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, ILOVEPDF, S.L., Barcelona)","status":"verified","url":"https://www.ilovepdf.com/help/privacy","locator":"2. Who is the data controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"registered office at Calle Sabino de Arana, 60, 08028 Barcelona"},{"key":"data_retention","value":"Files are deleted automatically within 2 hours of processing; users can delete earlier from the download screen. Signed documents (iLoveSign) are kept up to 5 years. Account data is kept while you use the service, then blocked and deleted.","status":"verified","url":"https://www.ilovepdf.com/help/security","locator":"Data Retention and Removal","url2":"https://www.ilovepdf.com/help/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"all files processed within our platform are automatically and permanently deleted within two hours of being processed."},{"key":"certifications","value":"ISO/IEC 27001:2022 (1 certification); GDPR compliance claimed and eIDAS qualified trust service providers used for signatures.","status":"verified","url":"https://www.ilovepdf.com/help/security","locator":"Certifications and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"iLovePDF proudly holds ISO/IEC 27001:2022 certification"},{"key":"admin_ai_controls","value":"Not stated; Premium and Business accounts get AI credits, but no admin setting to switch AI tools off for a team is described.","status":"not_published","url":"https://www.ilovepdf.com/help/terms","locator":"Section VI AI Tools; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 5 per month billed annually (EUR 60 per year), or EUR 9 billed monthly; prices include VAT. A selector offers 1 to 25 users.","status":"verified","url":"https://www.ilovepdf.com/pricing","locator":"Premium plan card and FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€5 / month €60 Billed annually ### €9 Billed monthly"}]}]},{"slug":"instantly","name":"Instantly","vendor":"Foo Monk, LLC dba Instantly.ai","category":"writing-and-email","plans":[{"id":"T366","plan":"Starter bundle","tier":"business","price":{"label":"$94 / mo","amount":94,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Instantly; terms disclaim responsibility for what its third-party AI providers do with your inputs, 'including for use in their model training'","status":"verified","url":"https://instantly.ai/terms","locator":"Terms > 4.3 Artificial Intelligence Tools","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Instantly is not responsible for the Third-Party Services' handling of your Inputs or Outputs, including for use in their model training."},{"key":"training_opt_out","value":"Not stated; no opt-out or setting described","status":"not_published","url":"https://instantly.ai/terms","locator":"Looked at: terms, privacy policy, DPA, AI agent terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data region found","status":"not_published","url":"https://instantly.ai/privacy","locator":"Looked at: privacy policy, terms, DPA, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Instantly generally stores the information used in its services in the United States","status":"verified","url":"https://instantly.ai/privacy","locator":"Privacy Policy > 11. Storage of Information in the United States","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We generally store the Information used in our Services in the United States."},{"key":"dpa","value":"Yes: the Data Processing Addendum is incorporated into the Terms whenever Instantly processes personal data covered by data protection law; published at instantly.ai/dpa","status":"verified","url":"https://instantly.ai/terms","locator":"Terms > 6.6 Data Processing Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subscriber agrees that the terms and conditions of the Data Processing Addendum, applies and is hereby incorporated into this Agreement."},{"key":"subprocessor_list","value":"Public list at https://trust.instantly.ai/subprocessors (named in the DPA); page needs a browser so count and AI providers not captured","status":"not_captured","url":"https://instantly.ai/dpa","locator":"DPA > 8.2 Sub-processors (list lives at trust.instantly.ai/subprocessors, needs browser)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Information about Sub-processors, including their functions and locations, is available at: https://trust.instantly.ai/subprocessors"},{"key":"dpf_status","value":"No listing found for search term 'Foo Monk', 'Instantly'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Foo Monk', 'Instantly' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After termination Instantly returns, deletes or anonymises personal data within 30 days (legal-retention exceptions); the terms say Instantly may delete other account data under its retention policies","status":"verified","url":"https://instantly.ai/dpa","locator":"DPA > 10. Return and Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Within 30 days after the expiration or earlier termination of the Agreement, Service Provider shall, to the fullest extent technically possible in the circumstances"},{"key":"certifications","value":"Not captured; certifications would be on the trust centre, which needs a browser","status":"not_captured","url":"https://trust.instantly.ai/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin control to limit AI found","status":"not_published","url":"https://instantly.ai/terms","locator":"Looked at: terms, pricing, AI agent terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Starter bundle $94 per month, or $85 per month on the yearly toggle (Growth outreach $47 + Growth credits $47 at monthly pricing); terms say payments are in US dollars, taxes extra","status":"not_published","url":"https://instantly.ai/pricing","locator":"Pricing > Bundles > Starter","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"intercom","name":"Intercom","vendor":"Intercom","category":"sales-marketing-and-support","plans":[{"id":"T25","plan":"Essential with Fin","tier":"business","price":{"label":"$29 / user / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Terms license customer data to provide and improve the services, including Intercom AI model training; no opt-out found in the terms read. Third-party AI providers may not train on customer data","status":"verified","url":"https://www.intercom.com/legal/terms-and-policies","locator":"Terms of Service s.3.2 (effective 8 Sep 2026)","url2":"https://www.intercom.com/legal/terms-and-policies/additional-product-terms","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"No opt-out route is documented. Intercom's terms let it use customer data to provide and improve its services, including Intercom AI model training; its third-party AI providers do not train on customer data","status":"not_published","url":"https://www.intercom.com/legal/terms-and-policies","locator":"Section 3.2 'Rights in Customer Data'","url2":"https://www.intercom.com/help/en/articles/9929230-the-fin-ai-engine","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: EU data hosting in Dublin, with Fin and other AI features processed in the EU (Microsoft, Google, OpenAI); plan eligibility not stated","status":"verified","url":"https://www.intercom.com/help/en/articles/8699600-changes-to-your-eu-au-hosted-workspace","locator":"Help article (14 May 2026)","url2":"https://www.intercom.com/legal/subprocessors-list","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States unless the workspace uses EU or Australian data hosting","status":"verified","url":"https://www.intercom.com/legal/subprocessors-list","locator":"Default and regional sections","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The DPA is incorporated by reference into the Terms of Service; customers outside the US contract with Intercom's Dublin entity","status":"verified","url":"https://www.intercom.com/legal/terms-and-policies","locator":"Terms of Service s.3.1 and parties clause","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. Default (US) hosting: 14 entries, all USA, incl. OpenAI, Anthropic, Google, Microsoft, ElevenLabs and Cartesia; EU hosting: a separate list with AI processing in the EU","status":"verified","url":"https://www.intercom.com/legal/subprocessors-list","locator":"US, EU and Australia sections","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Intercom, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Intercom'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Data is kept for the contract. Deletion on request within 30 days; otherwise automatic deletion 180 days after the contract ends; backups are deleted after 14 days","status":"verified","url":"https://www.intercom.com/legal/data-processing-agreement","locator":"Section 10 'Return or Deletion of Customer Personal Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001; Fin AI Agent is separately AIUC-1 certified","status":"verified","url":"https://www.intercom.com/security","locator":"Section 'Enterprise security and privacy, for one shared system'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Admins switch individual inbox AI features on or off under Settings > AI & Automation > Inbox AI, and Fin answers only where it is set live; smart reply suggestions cannot be turned off","status":"verified","url":"https://www.intercom.com/help/en/articles/6955446-ai-features-available-in-the-inbox","locator":"Instructions 'To enable Inbox AI features…' and the Smart replies FAQ","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 29 per seat/month plus USD 0.99 per Fin outcome","status":"not_published","url":"https://www.intercom.com/pricing","locator":"Essential card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"invideo","name":"Invideo AI","vendor":"Invideo Innovation Pte. Ltd.","category":"design-images-and-video","plans":[{"id":"T556","plan":"Plus","tier":"business","price":{"label":"€30 / user / mo","amount":30,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for Invideo's own models. Its 'Experimental Tier' AI providers may train under their own terms, but that tier is off and locked by default and only an administrator can switch it on.","status":"verified","url":"https://invideo.io/privacy-policy","locator":"3. Model Training and Content Use","url2":"https://invideo.io/legal/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your User Content, Inputs, Output or Designs to train or fine-tune our proprietary artificial intelligence or machine-learning models."},{"key":"training_opt_out","value":"Nothing to do for Invideo's own models. To avoid providers that may train, keep the Experimental Tier toggle off: it is locked by default and only an administrator can enable it.","status":"verified","url":"https://invideo.io/legal/dpa","locator":"Definitions: Experimental Tier; section 5.1","url2":"https://invideo.io/privacy-policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Experimental Tier is not enabled unless Customer actively elects to use it."},{"key":"eu_residency_option","value":"Not stated; no EU data-storage option is described in the policy, Terms, DPA or pricing page.","status":"not_published","url":"https://invideo.io/privacy-policy","locator":"Looked in: Privacy Policy, Terms of Service, DPA, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the privacy policy mentions data residency obligations for providers but names no storage country or host.","status":"not_published","url":"https://invideo.io/privacy-policy","locator":"Looked in: Privacy Policy (sections 5, 7), Terms of Service, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. A public Data Processing Addendum is incorporated into the Agreement between Invideo and the customer; the pages do not say how it is signed or whether self-serve plans are covered.","status":"verified","url":"https://invideo.io/legal/dpa","locator":"Data Processing Addendum, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (\"DPA\") is incorporated into, and forms part of, the Agreement between Invideo and the Customer."},{"key":"subprocessor_list","value":"Not captured: the sub-processor list is at trust.invideo.io/subprocessors, which needs a browser; the policy says it separates Standard Tier and Experimental Tier AI providers.","status":"not_captured","url":"https://trust.invideo.io/subprocessors","locator":"Sub-processor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Invideo'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Invideo' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Content is kept for the life of the account; on an account deletion or deletion request it is removed from active systems within about 90 days (backups follow normal rotation). Account data is kept 90 days after a deletion request.","status":"verified","url":"https://invideo.io/privacy-policy","locator":"8. Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"account and content data is removed from active production systems within approximately 90 days, subject to backup and legal retention requirements"},{"key":"certifications","value":"Not captured: certifications would be on trust.invideo.io, which needs a browser; none are named in the policy, Terms or DPA.","status":"not_captured","url":"https://trust.invideo.io","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: an administrator can switch the 'Experimental Tier' AI providers on or off with a toggle (locked off by default). No switch to turn all AI features off is described.","status":"verified","url":"https://invideo.io/legal/dpa","locator":"Definitions: Experimental Tier; sections 5.1-5.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Experimental Tier is not enabled unless Customer actively elects to use it."},{"key":"price_eur","value":"Plus (team plan): EUR 30 per seat per month billed annually (EUR 60 per seat on monthly billing; the annual price is shown as 50% off); up to 10 seats. VAT not stated.","status":"verified","url":"https://invideo.io/pricing","locator":"Pricing > Team plans > Plus","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"2,000 credits per seat/mo €60€30per seat/mo, billed annually"}]}]},{"slug":"jamie","name":"jamie","vendor":"jamie (Kertos GmbH)","category":"meetings-and-notes","plans":[{"id":"T66","plan":"Team","tier":"business","price":{"label":"€33 / user / mo","amount":33,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. jamie says meeting data is never used to train models, neither by jamie nor by its model providers","status":"verified","url":"https://www.meetjamie.ai/security","locator":"Section 'No model training'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: no training takes place","status":"verified","url":"https://www.meetjamie.ai/security","locator":"Section 'No model training'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default","status":"verified","url":"https://www.meetjamie.ai/security","locator":"Sections 'EU data residency' and 'Hosted in Europe'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU: production data is stored in data centres in the European Union; audio is deleted after transcription","status":"verified","url":"https://www.meetjamie.ai/privacy-policy","locator":"Section 3.2 'Provision of the App and technical infrastructure'","url2":"https://www.meetjamie.ai/security","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. jamie's DPA forms part of the contract with every customer and lists the sub-processors in Annex 2","status":"verified","url":"https://www.meetjamie.ai/privacy-policy","locator":"Section 1.3 ('our Data Processing Agreement… forms part of our contract with every customer')","url2":"https://www.meetjamie.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public in the privacy policy (identical to DPA Annex 2): 16 entries; 10 process in the EU, 4 in the US (Clay, Loops, Superwall, WorkOS), 1 UK/EEA and Google Workspace globally; speech recognition by Soniox and AI inference on Modal, both in the EU","status":"verified","url":"https://www.meetjamie.ai/privacy-policy","locator":"Section 6.1 'Subprocessors (identical to Annex 2 of the DPA)'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Kertos GmbH, Munich)","status":"verified","url":"https://www.meetjamie.ai/privacy-policy","locator":"Section 'Controller'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Audio is deleted right after transcription; transcripts and notes stay until deleted; log data is deleted after 30 days. Custom retention policies are an Enterprise feature","status":"verified","url":"https://www.meetjamie.ai/security","locator":"Sections 'Audio not stored' and 'Data retention'","url2":"https://www.meetjamie.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO 27001; SOC 2 Type II audit in progress (marked pending); built for DORA requirements","status":"verified","url":"https://www.meetjamie.ai/security","locator":"Compliance tiles ('ISO 27001', 'SOC 2 Type II (pending)')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Team includes user management and admin controls and a shared workspace; SSO, SCIM and audit logs are Enterprise. A switch to turn AI features off is not described","status":"verified","url":"https://www.meetjamie.ai/pricing","locator":"Comparison rows 'User management & admin controls', 'SAML SSO', 'Audit logs'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 33 per seat/month (billing period shown on the toggle not captured)","status":"verified","url":"https://www.meetjamie.ai/pricing","locator":"Plan card 'Team'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"jasper","name":"Jasper","vendor":"Jasper AI, Inc.","category":"assistants","plans":[{"id":"T312","plan":"Pro","tier":"business","price":{"label":"$59 / user / mo","amount":59,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Terms of Service let Jasper use inputs and outputs to develop and enhance its own AI models; users in the EU or UK can object by emailing legal@jasper.ai.","status":"verified","url":"https://www.jasper.ai/legal/terms-of-service","locator":"Section on use of Customer Property (before section 12)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Jasper uses Customer Property, including Input and Output, to provide, maintain, and improve the Services, including for the purpose of developing and enhancing Jasper’s artificial intelligence models."},{"key":"training_opt_out","value":"EU or UK users email legal@jasper.ai to object; Jasper then stops using their data for model training. No in-product setting is described, and no opt-out is stated for other regions.","status":"verified","url":"https://www.jasper.ai/legal/terms-of-service","locator":"Section 12 For Users in the EU or UK","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To exercise this right, submit a request by contacting legal@jasper.ai. Upon verification, Jasper will cease using your Customer Property for model training and improvement, subject to applicable law."},{"key":"eu_residency_option","value":"Not stated; no EU hosting option found.","status":"not_published","url":"https://www.jasper.ai/pricing","locator":"Looked at pricing FAQ, legal/terms, legal/dpa, trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (US-based data centres).","status":"verified","url":"https://www.jasper.ai/pricing","locator":"Pricing page FAQ on security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is hosted in US-based data centers and encrypted in transit"},{"key":"dpa","value":"Yes. A public DPA with EU Standard Contractual Clauses exists; customers email legal@jasper.ai to enter into it. Not stated whether Pro includes it automatically.","status":"verified","url":"https://www.jasper.ai/legal/sub-processors","locator":"Intro text above the sub-processor table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are a Jasper customer and wish to enter into our DPA available at legal.jasper.ai/#dpa, please email us at legal@jasper.ai."},{"key":"subprocessor_list","value":"Yes: https://www.jasper.ai/legal/sub-processors, 31 entries (all US). AI providers listed: Anthropic, Cohere, Google Gemini, OpenAI, marked as optional agentic features.","status":"verified","url":"https://www.jasper.ai/legal/sub-processors","locator":"Sub-Processors page, Contractual Safeguards and table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"to provide the actual list of third-party sub-processors used by Jasper as of the date of this advisory"},{"key":"dpf_status","value":"No listing found for search term 'Jasper AI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Jasper AI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Under the DPA, data is kept only as long as the customer considers necessary; on termination or written request Jasper destroys or returns it. No fixed number of days is given.","status":"verified","url":"https://www.jasper.ai/legal/dpa","locator":"DPA section 4.3 Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Processor will retain Controller Data only for as long as the Customer deems it necessary for the Permitted Purpose, or as required by Applicable Data Protection Law."},{"key":"certifications","value":"SOC 2 Type II (1 certification). GDPR, CCPA and PCI are named as compliance, with no ISO certificate.","status":"verified","url":"https://www.jasper.ai/pricing","locator":"Pricing page FAQ on security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Jasper is SOC 2 Type II certified and complies with GDPR, CCPA, PCI, and DPA requirements"},{"key":"admin_ai_controls","value":"Not stated. Admin controls and Groups are listed on the Business plan, not on Pro; no switch to turn off AI features is described.","status":"not_published","url":"https://www.jasper.ai/pricing","locator":"Plan comparison and security section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $59 per seat/month billed yearly, or $69 per seat/month billed monthly. Pro includes 1 seat.","status":"not_published","url":"https://www.jasper.ai/pricing","locator":"Pricing page, Pro card and FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"jetbrains-ai","name":"JetBrains AI Pro","vendor":"JetBrains s.r.o.","category":"code-and-app-builders","plans":[{"id":"T533","plan":"organisation licence","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. JetBrains commits not to use inputs, data, outputs and suggestions to train code- or text-generating models unless the customer expressly agrees. Sharing of detailed code-related data is off by default.","status":"verified","url":"https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-service/","locator":"JetBrains AI Terms of Service, 5c Restriction on the use of Your Inputs, Data, Outputs, and Suggestions for the training of AI models","url2":"https://www.jetbrains.com/help/ai/data-collection-and-use-policy.html","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will not use Your Inputs, Data, Outputs, and Suggestions to train any language models that generate code, text, or another type of data"},{"key":"training_opt_out","value":"Nothing to do for model training: JetBrains states it will not train on customer content unless the customer agrees. Keep the 'Send detailed code-related data' setting off; on organisation licences only a company admin can allow it.","status":"verified","url":"https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-service/","locator":"JetBrains AI Terms of Service, 5c Restriction on the use of Your Inputs, Data, Outputs, and Suggestions for the training of AI models","url2":"https://www.jetbrains.com/help/ai/data-collection-and-use-policy.html","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We undertake that We will not use Your Inputs, Data, Outputs, and Suggestions to train any language models that generate code, text, or another type of data"},{"key":"eu_residency_option","value":"Not stated. No setting or plan for keeping JetBrains AI prompts in the EU is described in the terms, DPA, privacy notice or data collection notice.","status":"not_published","url":"https://www.jetbrains.com/legal/docs/privacy/privacy/","locator":"Looked in: AI Terms of Service, DPA, Privacy Notice section 8, Product Data Collection and Usage Notice, AI service providers page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"No single default for JetBrains AI (the Privacy Notice says it may differ from the EU default). The Third-Party Services page lists AI provider locations: OpenAI, Anthropic, xAI US; Google EU, US and Asia; Baseten US/UK; Tavily US; Nebius France/Spain/US.","status":"verified","url":"https://www.jetbrains.com/legal/docs/privacy/third-parties/","locator":"C. AI and LLM services, AI service providers table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your inputs and personal data may be shared with the listed AI subprocessors."},{"key":"dpa","value":"Yes. The Data Processing Addendum is incorporated into the JetBrains AI Terms, and applies by placing an order; it includes EU standard contractual clauses.","status":"verified","url":"https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-service/","locator":"JetBrains AI Terms of Service, General terms, Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"which is a part of (‘incorporated into’) these Terms."},{"key":"subprocessor_list","value":"Yes: JetBrains publishes its sub-processors at https://www.jetbrains.com/legal/docs/privacy/third-parties/ (25 rows: 9 hosting, 5 support/communication, 4 product-specific, 7 AI providers). AI providers: OpenAI, Google, Anthropic, xAI, Baseten, Tavily, Nebius.","status":"verified","url":"https://www.jetbrains.com/legal/docs/privacy/third-parties/","locator":"A. Third Parties and JetBrains Affiliates (Sub-Processors); C. AI and LLM services","url2":"https://www.jetbrains.com/legal/docs/terms/jetbrains-ai/service-providers/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"JetBrains considers these entities to be possible sub-processors of customers’ personal data in terms of the GDPR"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, JetBrains s.r.o., Prague, Czech Republic)","status":"verified","url":"https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-service/","locator":"1. Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"JetBrains s.r.o., a company registered in the Commercial Register of the Prague Municipal Court"},{"key":"data_retention","value":"No retention period for prompts is stated; the Terms say inputs and outputs can be stored for a limited period for security monitoring. After the DPA ends, JetBrains deletes or returns personal data within 90 days.","status":"verified","url":"https://www.jetbrains.com/legal/docs/terms/DPA_Customer.pdf","locator":"Section 6 Return or Deletion of Customer’s Personal Data, 6.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"return or delete Customer’s Personal Data, as applicable, within 90 days from the effective date of the termination or expiration of this DPA."},{"key":"certifications","value":"Not captured: JetBrains refers to its Trust Centre for certifications, but trust.jetbrains.com could not be loaded.","status":"not_captured","url":"https://trust.jetbrains.com","locator":"Trust Centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. An organisation admin can block or allow JetBrains AI for everyone in the organisation under Administration in the JetBrains Account (default is access allowed).","status":"verified","url":"https://jb.gg/aienable","locator":"Enable or disable JetBrains AI for all users in your organization","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In the JetBrains AI section of the Administration page, click the Block for everyone button to block access."},{"key":"price_eur","value":"Not captured: the JetBrains AI buy page (jetbrains.com/store/ai/) loads prices with JavaScript and returns no text.","status":"not_captured","url":"https://www.jetbrains.com/store/ai/","locator":"Store page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"jira","name":"Jira","vendor":"Atlassian Pty Ltd (Atlassian US, Inc.)","category":"workspace-and-projects","plans":[{"id":"T455","plan":"Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless switched off. On Standard, Atlassian uses metadata (always) and in-app data (on by default: work item titles, descriptions, comments) to improve its apps and AI for all customers, de-identified and aggregated. Third-party AI providers do not train on it.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/","locator":"Data contribution settings, Default data contribution settings (Free or Standard)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Metadata contribution: Is always contributed In-app data contribution: On"},{"key":"training_opt_out","value":"Atlassian Administration, Security, Data contribution: switch In-app data contribution to Off. The metadata contribution cannot be turned off on Standard (only on Enterprise).","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/","locator":"Data contribution settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To view your settings, navigate to Atlassian Administration, then Security, and then Data contribution."},{"key":"eu_residency_option","value":"Yes. Jira on Standard, Premium or Enterprise can be pinned to the EU (Frankfurt and Dublin) or Germany; the admin selects it under Data management, Data residency. Moving involves downtime of up to 24 hours.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Understand data residency, locations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Atlassian Cloud: Jira, Jira Service Management, Jira Product Discovery, Loom, and Confluence with Enterprise, Premium, and Standard plans."},{"key":"default_data_location","value":"Hosted on AWS. By default the data is in Atlassian's 'Global' location and can move dynamically across all AWS regions; an admin can pin it to a region such as EU (Frankfurt/Dublin) or Germany.","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Understand data residency, Global location paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, all Atlassian apps are hosted in the Global location, which includes all of our AWS regions."},{"key":"dpa","value":"Yes. Atlassian's Data Processing Addendum supplements the Atlassian Customer Agreement and applies to its cloud products; it includes EU/UK transfer terms.","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"Data Processing Addendum, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) supplements the Atlassian Customer Agreement, or other agreement in place between Customer and Atlassian"},{"key":"subprocessor_list","value":"Yes, public at https://www.atlassian.com/legal/sub-processors: 29 third-party rows (25 companies) for commercial cloud, plus 15 Atlassian group entities and 5 Government Cloud sub-processors. AI providers: AWS Bedrock, Google Vertex AI, OpenAI.","status":"verified","url":"https://www.atlassian.com/legal/sub-processors","locator":"Sub-processors list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Atlassian uses the third-party entities listed below (each, a “Sub-processor”) to process Customer Personal Data on behalf of Atlassian customers"},{"key":"dpf_status","value":"Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Atlassian'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After the agreement ends Atlassian deletes customer personal data per its documentation, but may keep copies under backup and record-retention policies. Data contributed for AI and then opted out is removed from datasets within 30 days (content attributes 90 days); de-identified aggregates can be kept up to 7 years.","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"DPA 6.2 Post Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data."},{"key":"certifications","value":"At least 2 confirmed on Atlassian's own pages: ISO/IEC 27001:2022 and SOC 2 (reports via Trust Portal). The Compliance Resource Center lists 34 resources but its filter list needs a browser.","status":"verified","url":"https://www.atlassian.com/trust/compliance/resources/iso27001","locator":"Compliance Resource Center, ISO/IEC 27001:2022","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Type Certifications / Attestations Documentation ISO/IEC 27001 Certificate"},{"key":"admin_ai_controls","value":"Yes. An organisation admin can block individual apps (including Jira) from Rovo AI features under Atlassian Administration, AI and Rovo, Access; this disables current and upcoming AI features for that app.","status":"verified","url":"https://support.atlassian.com/organization-administration/docs/deactivate-ai-in-apps/","locator":"Manage Rovo access, Block apps from Rovo features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Blocking an app will disable all current and upcoming AI features for that app."},{"key":"price_eur","value":"Not captured: the Jira pricing page is JavaScript-only and returns no text.","status":"not_captured","url":"https://www.atlassian.com/software/jira/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"join","name":"JOIN","vendor":"JOIN Solutions AG","category":"documents-hr-and-finance","plans":[{"id":"T610","plan":"Standard","tier":"business","price":{"label":"€17 / mo","amount":17,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no clause on training AI models found in the privacy policy, terms or DPA. The pricing page lists Job Studio (AI job ads) but names no AI provider or training rule.","status":"not_published","url":"https://join.com/en/privacy","locator":"Privacy policy, terms of use, DPA (searched for train, machine learning, AI)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://join.com/en/privacy","locator":"Privacy policy, terms, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No separate option described; EU/EEA/Swiss processing is the default under the DPA, but several US sub-processors (Amplitude, Customer.io, Segment, Recall.ai) process data in the US.","status":"verified","url":"https://join.com/en/data-processing-agreement","locator":"Place of data processing; Appendix 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless otherwise agreed between the parties, the processing and use of the data by JOIN takes place in Switzerland, the European Union or in another treaty state of the Agreement on the European Economic Area."},{"key":"default_data_location","value":"Switzerland, the EU or the EEA. Hosting and storage run on Google Cloud in Belgium (europe-west1); email, scheduling and error tools are in Germany. Some tools (analytics, messaging, interview transcription) are in the US.","status":"verified","url":"https://join.com/en/data-processing-agreement","locator":"Section on place of data processing; Appendix 2 subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless otherwise agreed between the parties, the processing and use of the data by JOIN takes place in Switzerland, the European Union or in another treaty state of the Agreement on the European Economic Area."},{"key":"dpa","value":"Yes. A DPA (version 3.0) is part of the terms and takes priority over them; JOIN acts as processor for the company's candidate data. No signature step is described.","status":"verified","url":"https://join.com/en/terms","locator":"Data protection section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The duties of the parties regarding data protection are further defined in the data processing agreement (DPA) accessible here https://join.com/dpa, which provisions prevails on these GTC."},{"key":"subprocessor_list","value":"Yes, published inside the DPA (Appendix 2): 12 entries (12 companies). AI-related: Recall.ai (interview recording and transcription). No LLM provider is named.","status":"verified","url":"https://join.com/en/data-processing-agreement","locator":"Appendix 2 - Subprocessors commissioned by JOIN","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Meeting-bot service used in the Interview Mode feature to record and transcribe interviews"},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, JOIN Solutions AG, Pfäffikon SZ)","status":"verified","url":"https://join.com/en/privacy","locator":"Controller section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These Services are operated by JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ"},{"key":"data_retention","value":"No fixed period: personal data is kept while the account exists, then deleted or anonymised. Company content is deleted with the account (requested by email). After the contract ends JOIN must delete the data and certify it. The customer sets candidate deletion deadlines.","status":"verified","url":"https://join.com/en/data-processing-agreement","locator":"Deletion of personal data after termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After the termination of the service agreement, JOIN is obliged to delete all personal data processed on behalf of the Company and certify to the Company that it has done so"},{"key":"certifications","value":"ISO 27001:2022 (1 certification named).","status":"verified","url":"https://join.com/en/data-processing-agreement","locator":"Security measures section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"JOIN is certified according to ISO 27001:2022."},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features (such as Job Studio) found on the pricing page, terms, privacy policy or DPA.","status":"not_published","url":"https://join.com/en/pricing","locator":"Pricing page, terms, privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 17 per job per month, billed annually (2 months free), excluding VAT. Unlimited users; up to 15 active jobs. Advanced is EUR 34 per job/month.","status":"verified","url":"https://join.com/en/pricing","locator":"Standard plan card and footnote","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"One job ad, posted everywhere at once. €17per job/month billed annually2 months free"}]}]},{"slug":"jotform","name":"Jotform","vendor":"Jotform Inc. (San Francisco, USA)","category":"research-forms-and-storage","plans":[{"id":"T623","plan":"Silver","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No for Jotform itself: the AI Terms of Use say Jotform will not use your data to train its AI or language models. Its outside AI providers (such as OpenAI) can train on data; Jotform makes no promise about them.","status":"verified","url":"https://www.jotform.com/ai-terms/","locator":"AI Terms of Use, data and privacy paragraph","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We will not use your data to train our AI or language models."},{"key":"training_opt_out","value":"Nothing to do for Jotform itself: its AI Terms say it will not use your data to train its AI. There is no opt-out for its outside AI providers, which may train on inputs.","status":"verified","url":"https://www.jotform.com/ai-terms/","locator":"AI Terms of Use, data and privacy paragraph","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We will not use your data to train our AI or language models."},{"key":"eu_residency_option","value":"Yes. Customers can switch storage to EU servers in Frankfurt, Germany (run by Google) in the Data tab of account settings; the account then moves to eu.jotform.com. Not stated whether every plan has it.","status":"verified","url":"https://www.jotform.com/gdpr/","locator":"Store data in the EU","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can store your data in the EU by enabling the appropriate option in the Data tab of your account settings."},{"key":"default_data_location","value":"United States by default: form data is stored on servers in the United States, on Google Cloud (Iowa) and AWS (Virginia) data centres.","status":"verified","url":"https://www.jotform.com/privacy/","locator":"Information we collect, From Our Customers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Form data is stored on servers located in the United States."},{"key":"dpa","value":"Yes. A Jotform-pre-signed Data Processing Addendum is available self-serve; the customer adds an electronic signature and it is sent to Jotform automatically.","status":"verified","url":"https://www.jotform.com/gdpr/","locator":"Sign a DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"a Data Processing Addendum (DPA), which is a self-serve and easy-to-execute document pre-signed by Jotform. It only requires an electronic signature from the user."},{"key":"subprocessor_list","value":"Yes, public at https://www.jotform.com/subprocessors/ with 7 entries (Amazon Web Services, Deepgram, ElevenLabs, Google, HubSpot, OpenAI, Twilio). AI providers: OpenAI, Google, Deepgram, ElevenLabs.","status":"verified","url":"https://www.jotform.com/subprocessors/","locator":"Jotform Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Processing regions vary by sub-processor and service"},{"key":"dpf_status","value":"Active (Jotform Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Jotform'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account personal info is kept while the account exists; after closing and unpublishing forms it is deleted after one month, and inactive accounts are held encrypted for one more year then deleted. Backup snapshots are kept 30 days.","status":"verified","url":"https://www.jotform.com/privacy/","locator":"How long we retain your information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you close your account and make your forms publicly unavailable through your account dashboard, your personal info will be deleted after one month."},{"key":"certifications","value":"PCI DSS Service Provider Level 1 is named. SOC 2 certification applies only to the dedicated Enterprise environment; other plans are 'aligned' with SOC 2. No ISO 27001 is named. StateRAMP is in a snapshot programme.","status":"verified","url":"https://www.jotform.com/security/","locator":"SOC 2 Compliance / PCI Certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Jotform’s dedicated environment aligns with the five SOC 2 Trust Service Principles: security, confidentiality, availability, privacy, and processing integrity."},{"key":"admin_ai_controls","value":"Not stated. No organisation-wide AI off switch is described; the pricing FAQ calls Enterprise the only multiuser plan, so Silver has no team admin.","status":"not_published","url":"https://www.jotform.com/pricing/","locator":"Pricing FAQ, Enterprise plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the plan prices load with JavaScript, so no Silver price could be read. The FAQ says people in Europe are charged in euros.","status":"not_captured","url":"https://www.jotform.com/pricing/","locator":"Pricing page FAQ on currency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you’re located in Europe, you’re charged in euros."}]}]},{"slug":"kagi-assistant","name":"Kagi Assistant","vendor":"Kagi (Kagi Inc.)","category":"assistants","plans":[{"id":"T302","plan":"Team plan, Ultimate tier","tier":"business","price":{"label":"$25 / user / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Kagi states Assistant data is never used to train AI models, by Kagi or by the LLM providers.","status":"verified","url":"https://help.kagi.com/kagi/ai/assistant.html","locator":"Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your data is never used to train AI models (not by us or by the LLM providers), and no account information is shared with the LLM providers."},{"key":"training_opt_out","value":"Nothing to do: Kagi states Assistant data is never used to train models.","status":"verified","url":"https://help.kagi.com/kagi/ai/assistant.html","locator":"Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your data is never used to train AI models (not by us or by the LLM providers), and no account information is shared with the LLM providers."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://kagi.com/privacy/rights","locator":"International Data Transfers; Team plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States. Kagi says it is US-based and information is stored and processed on its servers in the US.","status":"verified","url":"https://kagi.com/privacy/rights","locator":"International Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Kagi is based in the United States. If you're accessing our services from outside the United States, your information may be transferred to, stored, and processed in the United States where our servers are located."},{"key":"dpa","value":"Not stated for the Team plan. Kagi's privacy policy says a Data Processing Addendum for API customers is being finished and is not yet published.","status":"not_published","url":"https://kagi.com/privacy","locator":"Kagi API section: Your end users; Team plan help page, privacy rights addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No formal sub-processor list found. The LLMs & Privacy page (help.kagi.com/kagi/ai/llms-privacy.html) lists the model providers behind Assistant, 14 counted: Amazon Bedrock, Anthropic, Cerebras, DeepInfra, Fireworks.ai, Google, Groq, Meta, Microsoft Azure, Mistral AI, Nebius, OpenAI, Together.ai, xAI.","status":"verified","url":"https://help.kagi.com/kagi/ai/llms-privacy.html","locator":"LLMs & Privacy table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The table below provides an overview of how each provider handles your data, including training practices, retention policies"},{"key":"dpf_status","value":"No listing found for search term 'Kagi'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Kagi' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Assistant threads are deleted after 24 hours of inactivity by default; a setting switches threads to permanent, and a thread can be deleted at once. Reported threads are kept 30 days.","status":"verified","url":"https://help.kagi.com/kagi/ai/assistant.html","locator":"Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, threads are deleted after 24 hours of inactivity. This behavior can be adjusted in the settings."},{"key":"certifications","value":"No certification such as ISO 27001 or SOC 2 named. Kagi says an independent security audit by Illumant found it 'Highly Secure'.","status":"verified","url":"https://help.kagi.com/kagi/privacy/security.html","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have had our security independently audited by Illumant."},{"key":"admin_ai_controls","value":"Not stated as an on/off switch. Admins assign each member the Professional or Ultimate tier, which sets Assistant model access, but Assistant stays available on both.","status":"not_published","url":"https://help.kagi.com/kagi/plans/team-plan.html","locator":"Managing members; Billing details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $25 per member per month, paid monthly in advance (Ultimate tier, which includes Assistant premium models); Professional tier $10.","status":"not_published","url":"https://help.kagi.com/kagi/plans/team-plan.html","locator":"Billing details: Pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"kapwing","name":"Kapwing","vendor":"Kapwing Inc.","category":"design-images-and-video","plans":[{"id":"T554","plan":"Business","tier":"business","price":{"label":"$50 / mo","amount":50,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. No clause on training AI models was found; the policy only says data is used to provide and improve the service. Voice-cloning recordings are stored for research and development of its tools.","status":"not_published","url":"https://www.kapwing.com/policies/privacy","locator":"Looked in: Privacy Policy (use of data, Voice Cloning), Terms of Service (Content Rights)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training setting or opt-out is described, because no training clause exists in the policy or Terms.","status":"not_published","url":"https://www.kapwing.com/policies/privacy","locator":"Looked in: Privacy Policy, Terms of Service, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not offered or not stated; the Terms say non-US customers consent to storage in the US, and no EU option is described.","status":"not_published","url":"https://www.kapwing.com/policies/terms-of-service","locator":"Looked in: Terms of Service, Privacy Policy, Pricing page, Sub-processors article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Kapwing says the service is provided from the US, and its sub-processor list shows MongoDB and Google Cloud (video storage), both in the USA.","status":"verified","url":"https://www.kapwing.com/policies/terms-of-service","locator":"Privacy and data transfer clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are located outside of the United States, you also consent to the transfer, storage, and processing of your information in and out of the United States."},{"key":"dpa","value":"Not stated for Kapwing's own customers; no data processing agreement is offered on the Terms or privacy policy. The sub-processor page only shows which vendors have DPAs with Kapwing.","status":"not_published","url":"https://www.kapwing.com/policies/privacy","locator":"Looked in: Privacy Policy, Terms of Service, Sub-processors help article; /policies/dpa and /security returned no readable page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes, public at https://www.kapwing.com/help/kapwing-data-subprocessors/ (last updated May 26, 2026): 25 entries. AI providers include OpenAI, Google Cloud, ElevenLabs, DeepL, Perplexity, Pika, BytePlus, MiniMax Hailuo, Replicate, AssemblyAI.","status":"verified","url":"https://www.kapwing.com/help/kapwing-data-subprocessors/","locator":"List of Third-Party Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A sub-processor is a third-party service provider who have, or potentially will have, access to or process personal data that Kapwing processes for Kapwing Users."},{"key":"dpf_status","value":"No listing found for search term 'Kapwing'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Kapwing' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Deleted projects and workspaces are removed from view at once and from Kapwing's servers within 7 days; account deletion is immediate. Paid plans keep project files for the length of the subscription (free plan 3 days).","status":"verified","url":"https://www.kapwing.com/policies/privacy","locator":"Deleting content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"It will be permanently removed from viewing and public access immediately and removed from our servers within 7 days."},{"key":"certifications","value":"Not stated; no security certification is named in the privacy policy, Terms or pricing page.","status":"not_published","url":"https://www.kapwing.com/policies/privacy","locator":"Looked in: Privacy Policy (Security), Terms of Service, Pricing page; /security returned no readable page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the pricing page lists SAML SSO and shared workspaces but no setting to switch AI features off for a workspace.","status":"not_published","url":"https://www.kapwing.com/pricing","locator":"Looked in: Pricing page (plan comparison), Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Business $50 per month (4,000 credits a month, 800 GB storage). The page has a Monthly/Annual toggle (annual saves 33%); the basis of the $50 figure was not confirmed.","status":"not_published","url":"https://www.kapwing.com/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"kenjo","name":"Kenjo","vendor":"Kenjo GmbH","category":"documents-hr-and-finance","plans":[{"id":"T618","plan":"Growth","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no clause on training AI models found in the terms, privacy policy or security page, although the homepage says the product helps 'thanks to AI'. The privacy policy's no-training note about Anthropic covers Kenjo's own sales-call transcripts, not customer data.","status":"not_published","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"General terms (GTC), privacy policy, security page (searched for train, machine learning, AI)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"General terms, privacy policy, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not captured in the text snapshot. The security page's FAQ says infrastructure is deployed exclusively in Frankfurt, Germany, which would make EU hosting the only option; no setting is described.","status":"not_captured","url":"https://www.kenjo.io/security","locator":"FAQ: Where are Kenjo’s data centers located?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not captured in the text snapshot. The security page's FAQ, held in script data rather than visible text, says the platform is deployed exclusively in Frankfurt am Main, Germany (MongoDB Atlas, Amazon Web Services).","status":"not_captured","url":"https://www.kenjo.io/security","locator":"FAQ: Where are Kenjo’s data centers located?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. A data processing agreement is attached to the general terms as Annex 1 and becomes part of the contract; Kenjo is processor. The Annex text itself is not published on the website.","status":"verified","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"13. Confidentiality, data protection (13.1)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Parties agree that the data processing agreement attached as Annex 1 shall become an integral part of the contract"},{"key":"subprocessor_list","value":"Not stated; no public sub-processor list found on the terms, privacy policy, security page or help centre. The DPA annex that would list them is not published.","status":"not_published","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"General terms, privacy policy, security page, help centre home (searched for sub-processors)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Kenjo GmbH, Berlin)","status":"verified","url":"https://www.kenjo.io/legal/privacy","locator":"1.1 Controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Controller pursuant to the GDPR is Kenjo GmbH"},{"key":"data_retention","value":"After the contract ends the customer gets a 30-day transition period to export data; Kenjo then deletes all remaining data unless the law requires longer. Backups run every 6 hours and are kept 2 days.","status":"verified","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"6.2 Transition period and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Kenjo shall not delete the Customer's data before the expiration of the Transition Period."},{"key":"certifications","value":"Not captured in the text snapshot. The security page's FAQ says Kenjo itself holds no certifications but uses ISO 27001-certified data centres and follows the same standards.","status":"not_captured","url":"https://www.kenjo.io/security","locator":"FAQ: Does Kenjo follow international standards and regulations?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin control for AI features is described in the terms, privacy policy, security page or help centre home.","status":"not_published","url":"https://www.kenjo.io/legal/terms-and-conditions","locator":"General terms, privacy policy, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page builds its prices with a script and the text shows only '0.0€ per employee' placeholders for Starter, Growth and Connect; billing is per employee with 10% off annual billing.","status":"not_captured","url":"https://www.kenjo.io/pricing","locator":"Pricing: plan cards and price calculator","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"kit-convertkit","name":"Kit","vendor":"Kit, Inc. (formerly ConvertKit)","category":"sales-marketing-and-support","plans":[{"id":"T514","plan":"Creator","tier":"business","price":{"label":"$33 / mo","amount":33,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training clause found. The terms license Kit to use anonymised data from your content to improve its services, which does not mention AI models.","status":"not_published","url":"https://kit.com/terms","locator":"User Content licence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training opt-out described.","status":"not_published","url":"https://kit.com/terms","locator":"Terms, privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found. Transfers to the US rely on the EU-US Data Privacy Framework or SCCs.","status":"not_published","url":"https://kit.com/security","locator":"Security and GDPR sections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Kit says it stores data on servers located in the United States and other countries; hosting is with AWS.","status":"verified","url":"https://kit.com/privacy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Kit is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries."},{"key":"dpa","value":"Yes, a DPA is published and covers the Terms; it terminates when the Terms end. No separate signing described.","status":"verified","url":"https://kit.com/dpa","locator":"DPA preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) sets forth the terms under which Kit processes Personal Data concerning Subscribers of creators’ newsletters"},{"key":"subprocessor_list","value":"Yes, Attachment 3 of the DPA (https://kit.com/dpa), updated Oct 9, 2026: 13 entries. AI providers: OpenAI OpCo, LLC (application AI functionality) and AskElephant AI (support).","status":"verified","url":"https://kit.com/dpa","locator":"Attachment 3 - Subprocessor List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You specifically consent to Kit’s appointment of the Subprocessors identified on Attachment 3"},{"key":"dpf_status","value":"No listing found for search term 'ConvertKit'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'ConvertKit' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept until the Terms end. At the customer's choice Kit then deletes or returns the subscriber data, except copies on backups, which are isolated. No fixed number of days.","status":"verified","url":"https://kit.com/dpa","locator":"1.6 Disposal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"At Your choice, Kit will delete or return all Subscriber Personal Data upon the end of the provision of Services"},{"key":"certifications","value":"Kit names none of its own; it relies on AWS (SOC 2 Type II, ISO 27001) and Cloudflare (ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II).","status":"verified","url":"https://kit.com/security","locator":"Infrastructure security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS’s infrastructure security protections have been independently validated as part of its SOC 2 Type II and ISO 27001 certifications"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to switch AI features off found. Connecting an outside AI tool through Kit MCP is a choice made by the customer.","status":"not_published","url":"https://kit.com/privacy","locator":"AI Tools You Connect","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in euros. Shown in USD only: $33 per month, billed yearly as $390 (1,000 subscribers).","status":"not_published","url":"https://kit.com/pricing","locator":"Creator plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$390 billed yearly—Save $78 per year"}]}]},{"slug":"klaviyo","name":"Klaviyo","vendor":"Klaviyo","category":"sales-marketing-and-support","plans":[{"id":"T85","plan":"Email (paid)","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in aggregated or de-identified form: Klaviyo uses aggregated or de-identified customer data to improve and train its own models; its LLM providers (OpenAI, Anthropic, AWS Bedrock, Gemini) may not train on customer data","status":"verified","url":"https://www.klaviyo.com/legal/ai-faqs","locator":"Section on model training and service improvement","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"None described: customers can simply not use generative AI features, but no opt-out from aggregated or de-identified model training is offered","status":"verified","url":"https://www.klaviyo.com/legal/ai-faqs","locator":"FAQ 'Can we opt out of generative AI features?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, where agreed: if a customer has stipulated EU data residency, Klaviyo stores customer personal data in the EU, though some processing still happens outside the EU","status":"verified","url":"https://www.klaviyo.com/legal/data-processing-agreement","locator":"Clause on EU data residency","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: AWS hosting in the US; ClickHouse also hosts in Germany","status":"verified","url":"https://www.klaviyo.com/legal/subprocessors","locator":"Sub-processor table, 'Data hosting location(s)' (updated 11 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Klaviyo's DPA is incorporated into and forms part of the Agreement","status":"verified","url":"https://www.klaviyo.com/legal/data-processing-agreement","locator":"Clause (A) ('incorporated into and forms part of the Agreement')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 27 third-party entries, mostly hosting and processing in the US; AI features use Anthropic and OpenAI","status":"verified","url":"https://www.klaviyo.com/legal/subprocessors","locator":"Sub-processor table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active, re-certification under review (Klaviyo; EU-US DPF, Swiss-US DPF for non-HR data, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Klaviyo'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the account; on request at closure Klaviyo returns the data, and it deletes customer personal data within 90 days of account closure or the end of the agreement","status":"verified","url":"https://www.klaviyo.com/legal/data-processing-agreement","locator":"Section 'Deletion and Return'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS; GDPR listed","status":"verified","url":"https://trust.klaviyo.com/","locator":"Compliance tiles","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not described: Klaviyo leaves use of generative and agentic AI features to each user; no account-wide switch is documented","status":"not_published","url":"https://www.klaviyo.com/legal/ai-faqs","locator":"FAQ 'Can we opt out of generative AI features?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"No fixed price on the German page: paid email plans are priced by number of contacts in a calculator; a free plan covers 500 emails a month","status":"not_published","url":"https://www.klaviyo.com/de/pricing","locator":"German pricing page (free plan card; paid prices only via calculator)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"krea","name":"Krea","vendor":"Krea.ai, Inc.","category":"design-images-and-video","plans":[{"id":"T565","plan":"Business","tier":"business","price":{"label":"$160 / mo","amount":160,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: Krea commits not to use Business subscription inputs and outputs to train its AI models.","status":"verified","url":"https://krea.ai/business-terms","locator":"Use of Content for Training and Service Improvement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Krea commits that it will NOT use your Inputs or Outputs to train its AI models or algorithms."},{"key":"training_opt_out","value":"Nothing to do on Business: the Business Terms state Krea does not train on Business inputs and outputs.","status":"verified","url":"https://krea.ai/business-terms","locator":"Use of Content for Training and Service Improvement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Krea commits that it will NOT use your Inputs or Outputs to train its AI models or algorithms."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://krea.ai/privacy","locator":"Privacy policy, business terms, trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the services are hosted on US servers; the sub-processor summary shows Amazon Web Services with data location US.","status":"verified","url":"https://krea.ai/privacy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States"},{"key":"dpa","value":"Yes, on request: the DPA is a Trust Center document that customers request; Business Terms are described as including data protection clauses.","status":"verified","url":"https://krea.ai/legal/subprocessors","locator":"Trust Center, Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To receive the full register, request access to our DPA through this Trust Center"},{"key":"subprocessor_list","value":"Yes, but abbreviated: https://krea.ai/legal/subprocessors shows 8 primary sub-processors, all in the US, with no AI model provider listed. The full register is only in the DPA, on request.","status":"verified","url":"https://krea.ai/legal/subprocessors","locator":"Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This is an abbreviated summary of our primary subprocessors."},{"key":"dpf_status","value":"No listing found for search term 'Krea'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Krea' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for content. On ending the Business plan, members lose access and the owner should export content first; closing an account may destroy its content. Profile data is kept while the account exists.","status":"verified","url":"https://krea.ai/business-terms","locator":"Termination and account deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Account termination may result in destruction of any Content associated with your account"},{"key":"certifications","value":"One audit: SOC 2 (the Trust Center lists SOC 2 Type 1 and a bridge letter; the full report is available under NDA).","status":"verified","url":"https://krea.ai/security","locator":"Information security programme","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Krea is SOC 2 compliant: an independent audit firm has examined our controls against the SOC 2 framework"},{"key":"admin_ai_controls","value":"Yes, partly: Business workspaces can restrict which AI models members may use and set custom roles and permissions.","status":"verified","url":"https://krea.ai/pricing","locator":"Business plan features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Restrict which AI models your workspace can use to manage costs and ensure compliance with your policies."},{"key":"price_eur","value":"Shown in USD only: Business $160 per month (list price $200 struck through), 80k compute units a month, up to 50 seats included at one flat price.","status":"not_published","url":"https://krea.ai/pricing","locator":"For Teams and Enterprises, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Up to 50 seats included One flat price covers your entire workspace"}]}]},{"slug":"krisp","name":"Krisp AI Meeting Assistant","vendor":"Krisp Technologies, Inc.","category":"meetings-and-notes","plans":[{"id":"T384","plan":"Advanced","tier":"business","price":{"label":"$15 / user / mo","amount":15,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No: the privacy policy says that with recording and meeting notes on, Krisp stores them only to provide the service and does not use the content for any purpose; the security page says no customer data is used for model training.","status":"verified","url":"https://krisp.ai/legal/privacy-policy","locator":"Meeting Transcription / Meeting Recording (Information We Collect)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"ONLY IN CONNECTION WITH PROVIDING SERVICES TO THE CUSTOMER – WE DO NOT MONITOR, SELL OR USE SUCH CONTENT FOR ANY PURPOSE"},{"key":"training_opt_out","value":"Nothing to do: the privacy policy says meeting recordings and notes are used only to provide the service.","status":"verified","url":"https://krisp.ai/legal/privacy-policy","locator":"Meeting Transcription / Meeting Recording (Information We Collect)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"ONLY IN CONNECTION WITH PROVIDING SERVICES TO THE CUSTOMER – WE DO NOT MONITOR, SELL OR USE SUCH CONTENT FOR ANY PURPOSE"},{"key":"eu_residency_option","value":"No: Krisp does not offer regional data storage options","status":"verified","url":"https://krisp.ai/security-for-ai-meeting-assistant/","locator":"HIPAA Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"At this time, Krisp does not offer regional data storage options."},{"key":"default_data_location","value":"United States: all data is stored on secure servers in the US","status":"verified","url":"https://krisp.ai/security-for-ai-meeting-assistant/","locator":"HIPAA Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored on secure servers located in the United States."},{"key":"dpa","value":"Not stated: the terms of use and privacy policy mention no data processing agreement; a BAA for health data is offered on the Business tier","status":"not_published","url":"https://krisp.ai/terms-of-use","locator":"Looked at terms of use, privacy policy, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A list is said to be at trust.krisp.ai/subprocessors, which needs JavaScript and could not be read","status":"not_captured","url":"https://trust.krisp.ai/subprocessors","locator":"3rd Party Data Sharing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Krisp'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Krisp' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Meeting data is stored in Krisp's cloud only if the user opts in; deleted transcripts and summaries are hard-deleted, and customers can request deletion of all data by email; no fixed period is given","status":"verified","url":"https://krisp.ai/security-for-ai-meeting-assistant/","locator":"GDPR and Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers can delete all their data by sending an email to"},{"key":"certifications","value":"2 named: SOC 2 Type II and PCI DSS; HIPAA-supporting controls with a BAA on the Business tier","status":"verified","url":"https://krisp.ai/security-for-ai-meeting-assistant/","locator":"SOC-2 Type II Audit","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can download Krisp’s SOC-2 Type II audit report from Krisp’s Trust Center."},{"key":"admin_ai_controls","value":"Advanced adds admin controls for note-taking mode enforcement and meeting link sharing; no switch to turn AI features off is described","status":"not_published","url":"https://krisp.ai/pricing","locator":"Advanced, Admin Controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $15 per user per month billed annually ($30 on monthly billing) for Advanced","status":"not_published","url":"https://krisp.ai/pricing","locator":"Advanced","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"kustomer","name":"Kustomer","vendor":"Kustomer, LLC (formerly Kustomer, Inc.)","category":"phone-and-voice","plans":[{"id":"T441","plan":"seat-based subscription","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for the customer's own AI features: in the DPA the customer instructs Kustomer to train the AI/ML features of the service on its behalf, de-identifying data where necessary. Kustomer says it does not train global models, does not share data with other customers, and bars third-party LLM providers from training on it.","status":"verified","url":"https://www.kustomer.com/privacy/dpa/","locator":"DPA 2.3 (Instructions)","url2":"https://www.kustomer.com/legal/seat-supplemental-terms/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"further instructs Kustomer, where necessary, to deidentify or anonymize Personal Data, to train the AI and ML features of the Services on behalf of Client as part of the Processing"},{"key":"training_opt_out","value":"Not stated. No setting or email to stop training of the customer's own AI features is described; AI features apply only if the customer chooses to use them.","status":"not_published","url":"https://www.kustomer.com/legal/seat-supplemental-terms/","locator":"A. AI Features, 1.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated. The statement says the service is hosted in the US and the EU but describes no option to choose EU-only storage.","status":"not_published","url":"https://www.kustomer.com/privacy/statement/","locator":"Transfers section; GDPR page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States and European Union. The privacy statement says the service is hosted in both; it does not say which is the default for an account.","status":"verified","url":"https://www.kustomer.com/privacy/statement/","locator":"Transfers section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States (“U.S.”) and the European Union (“EU”) through Kustomer and our sub-processors."},{"key":"dpa","value":"Yes. Kustomer offers a Data Processing Addendum as part of the subscription agreement; clients with older versions can request the current one.","status":"verified","url":"https://www.kustomer.com/privacy/gdpr-ccpa/","locator":"Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Kustomer offers our Clients a Data Processing Addendum (DPA) to the subscription agreement for our Services"},{"key":"subprocessor_list","value":"A public list exists at https://www.kustomer.com/compliance/subprocessors/ (now trust.kustomer.com/subprocessors) with email notice of changes, but it needs a browser, so no count was captured. The AI FAQ names OpenAI and AWS as sub-processors.","status":"not_captured","url":"https://www.kustomer.com/compliance/subprocessors/","locator":"DPA 4.1 links this list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Kustomer, LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Kustomer'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the contract runs. Kustomer deletes client data within 90 days after access ends; admins can delete customer personal data, removed within 90 days of the request.","status":"verified","url":"https://www.kustomer.com/privacy/statement/","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We endeavor to delete the Personal Data that we process on behalf of our Clients as soon as reasonably practicable, but in no event more than ninety (90) days following the date a Client’s access to our Services has been terminated"},{"key":"certifications","value":"Four named: SOC 2, ISO 27001, ISO 27701, ISO/IEC 42001 (plus GDPR). The AI FAQ specifies SOC 2 Type II.","status":"vendor_statement","url":"https://www.kustomer.com/pricing/","locator":"Security and trust row of the plan table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2, ISO 27001, ISO 27701, ISO/IEC 42001, and GDPR"},{"key":"admin_ai_controls","value":"Partly. The terms say certain AI features can be enabled or disabled as set out in Kustomer's documentation (not read), and apply only if the customer chooses to use them. A single organisation-wide switch is not confirmed.","status":"verified","url":"https://www.kustomer.com/legal/seat-supplemental-terms/","locator":"A. AI Features, 1.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Instructions for enabling/disabling certain AI Features are outlined in the Documentation."},{"key":"price_eur","value":"No public price. Kustomer says it does not post fixed prices and builds a quote after a sales assessment.","status":"not_published","url":"https://www.kustomer.com/pricing/","locator":"Pricing built for you","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"langdock","name":"Langdock","vendor":"Langdock","category":"assistants","plans":[{"id":"T06","plan":"Business","tier":"business","price":{"label":"€29.00 / user / mo","amount":29,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No (vendor statement). DPA v2.1 contains no training clause; processing only on documented instructions","status":"vendor_statement","url":"https://langdock.com/security","locator":"Security page (undated)","url2":"https://langdock.com/dpa","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off (vendor statement): Langdock says customer data is never used to train or improve AI models","status":"vendor_statement","url":"https://langdock.com/security","locator":"FAQ 'Does Langdock use our data to train AI models?'","url2":"https://langdock.com/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU is the default. Choosing models with 'global deployment' lets Microsoft, AWS, Google and OpenAI process outside the EU, including the US","status":"verified","url":"https://langdock.com/dpa","locator":"Section 8(2); Appendix 2 (global deployment sub-processors)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU/EEA by default; application hosted on Microsoft Azure in the EU","status":"verified","url":"https://langdock.com/dpa","locator":"Section 8(1)","url2":"https://langdock.com/security","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA version 2.1 (undated) tied to the General Terms of Use; German version binding","status":"verified","url":"https://langdock.com/dpa","locator":"Header 'Version 2.1 Current'; section 15","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public in the DPA. 11 entries from 7 companies; standard: Microsoft Ireland, AWS EMEA, Google Cloud EMEA, OpenAI Ireland, Mistral (all EU processing), plus Sentry and Cloudflare (US companies, EU processing)","status":"verified","url":"https://langdock.com/dpa","locator":"Appendix 2","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Langdock GmbH)","status":"verified","url":"https://langdock.com/dpa","locator":"Contracting party / footer 'Langdock GmbH'","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Set by admins: chats not used for 7 days, 1 month, 3 months, 12 months or forever are deleted with their uploaded documents in a daily check. Deleting a chat removes it at once; files only in that chat go in the overnight cleanup","status":"verified","url":"https://docs.langdock.com/en/admin/workspace/workspace","locator":"Workspace settings, 'Data Retention'","url2":"https://docs.langdock.com/en/using-langdock/troubleshooting/faq/data-retention-for-files","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO 27001 certified and SOC 2 Type II audited","status":"verified","url":"https://langdock.com/security","locator":"Section 'Audits and Certifications' and FAQ 'What certifications does Langdock hold?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Admins can switch web search, image generation and file creation on or off for everyone, turn agents off for the whole workspace, and set role-based permissions for uploads and sharing","status":"verified","url":"https://docs.langdock.com/en/admin/workspace/workspace","locator":"Workspace settings: capabilities toggles and 'Agents' > 'General access'","url2":"https://docs.langdock.com/en/admin/workspace/permissions","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 29.00 per user/month billed monthly, or EUR 23.20 per user/month billed annually (Business, Standard seat, excl. VAT; first 50 seats). Business Max seat: EUR 119.00 monthly or EUR 99.00 annually.","status":"verified","url":"https://langdock.com/pricing?billing=monthly","locator":"Business plan card, Billing toggle Monthly and Annual","url2":"","checkedOn":"2026-10-20","checkedFrom":"browser, Berlin (DE)","quote":"Recommended €29.00 Standard seat Per user / month (excl. VAT)"}]}]},{"slug":"languagetool","name":"LanguageTool","vendor":"LanguageTool (Learneo)","category":"writing-and-email","plans":[{"id":"T21","plan":"Team","tier":"business","price":{"label":"€56.90 / user / yr","amount":56.9,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Learneo does not use inputs from Individual or Team plan users to train models; no opt-out needed","status":"verified","url":"https://languagetool.org/legal/privacy","locator":"Privacy policy (updated 17 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Learneo does not use inputs from LanguageTool Individual or Team users to train its language models; this is the default and needs no action","status":"verified","url":"https://languagetool.org/legal/privacy","locator":"Section 'AI Models and Training Data', LanguageTool paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU hosting is the default per the DPA's sub-processor list","status":"verified","url":"https://languagetool.org/legal/dpa","locator":"Appendix 3","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Germany and the EU: hosting by Telekom and Hetzner (Germany), AWS's Germany branch and Google Cloud (Dublin address)","status":"verified","url":"https://languagetool.org/legal/dpa","locator":"Appendix 3","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Business DPA (last modified 21 Aug 2024) applies once incorporated via the agreement, an order form or an amendment; signed copy on request; processor Learneo, Inc.","status":"verified","url":"https://languagetool.org/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"In the DPA (Appendix 3): 9 entries; 5 in Germany (incl. Aleph Alpha for rephrasing), 3 in the US (Cloudflare, OpenAI for rephrasing only, Amplitude), 1 in Ireland","status":"verified","url":"https://languagetool.org/legal/dpa","locator":"Appendix 3","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Learneo, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Learneo'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period for checked texts is stated. Texts written in the online editor or desktop app are stored in the customer database (AWS Germany per the DPA); access logs are deleted after 14 days; at contract end data is deleted or returned at the customer's choice","status":"not_published","url":"https://languagetool.org/legal/dpa","locator":"Appendix on technical measures ('log files are deleted after 14 days'), sub-processor list and deletion clause","url2":"https://languagetool.org/legal/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed. No security certification appears on the business page, the privacy policy or the business DPA","status":"not_published","url":"https://languagetool.org/business","locator":"Section 'Privacy Policy and GDPR Compliance'","url2":"https://languagetool.org/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"No AI switch described. Team features are the shared dictionary and style guide; owners and admins manage members and roles","status":"verified","url":"https://help.languagetool.org/hc/en-us/articles/39254472101655-How-does-the-Team-Plan-work","locator":"Section 'How to manage different team roles'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 56.90 per user/year incl. VAT (sold from 2 seats: EUR 113.80/year)","status":"verified","url":"https://languagetool.org/de/premium","locator":"'Für Teams' card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"later-social","name":"Later Social","vendor":"Victory Square Media Inc. (d.b.a. Later; privacy notice by Mavrck LLC d.b.a. Later)","category":"sales-marketing-and-support","plans":[{"id":"T521","plan":"Growth","tier":"business","price":{"label":"$37.50 / mo","amount":37.5,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the privacy notice says Later can use your uploaded content, engagement data and platform interactions to train and improve its own AI models; no opt-out is described.","status":"verified","url":"https://later.com/privacy","locator":"AI and Machine Learning","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We may use your content, engagement data, and platform interactions to train and improve our AI models"},{"key":"training_opt_out","value":"Not stated; the privacy notice describes no way to stop Later training on your content (its rights list covers sales or sharing and targeted advertising only).","status":"not_published","url":"https://later.com/privacy","locator":"AI and Machine Learning; Your Rights","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU storage option found.","status":"not_published","url":"https://later.com/privacy","locator":"Privacy notice (transfers, storage); terms; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States.","status":"verified","url":"https://later.com/privacy","locator":"Sharing and Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We store personal information in the USA."},{"key":"dpa","value":"Not captured: no DPA found on later.com; the trust centre could not be read.","status":"not_captured","url":"https://trust.later.com/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not captured: no public sub-processor list found on later.com; the trust centre could not be read.","status":"not_captured","url":"https://trust.later.com/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Mavrck', 'Later'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Mavrck', 'Later' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for as long as necessary for the purpose collected, at least while the account exists; no fixed number of days; Later reserves the right to keep anonymised or aggregated data indefinitely.","status":"verified","url":"https://later.com/privacy","locator":"Storage Period","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We only retain personal information for as long as necessary for the purpose for which it was collected."},{"key":"certifications","value":"Not captured: no certifications named on later.com pages; the trust centre could not be read.","status":"not_captured","url":"https://trust.later.com/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI content tools documented on the pages read (AI credits are metered per plan).","status":"not_published","url":"https://later.com/plans","locator":"Growth plan features; privacy notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $37.50 per month (2 users, 2 social sets), billed yearly.","status":"not_published","url":"https://later.com/plans","locator":"Growth plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"lavender","name":"Lavender","vendor":"Sorter, Inc. dba Lavender","category":"writing-and-email","plans":[{"id":"T365","plan":"Team Plan","tier":"business","price":{"label":"$89 / user / mo","amount":89,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Lavender's own models; the privacy policy says raw email content sent to the LLM is not used to train it or to improve the AI model externally","status":"verified","url":"https://www.lavender.ai/privacy-policy","locator":"Privacy Policy > Third-Party Processing / AI Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The raw email content is not used for the training of the LLM or for improving the AI model externally"},{"key":"training_opt_out","value":"Not stated; no opt-out or setting described","status":"not_published","url":"https://www.lavender.ai/privacy-policy","locator":"Looked at: privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data region found","status":"not_published","url":"https://www.lavender.ai/privacy-policy","locator":"Looked at: privacy policy, terms of service, coach page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no storage country or hosting provider named","status":"not_published","url":"https://www.lavender.ai/privacy-policy","locator":"Looked at: privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated: a page titled 'Data Protection Agreement' exists (lavender.ai/dpa) but shows only a sign-up form for sub-processor update emails; no agreement text found","status":"not_published","url":"https://www.lavender.ai/dpa","locator":"Data Protection Agreement page; also looked at: privacy policy, terms of service, coach and ora pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Please fill out this form to receive email notifications for any subprocessor updates."},{"key":"subprocessor_list","value":"No public list shown; the privacy policy says you may ask for a list of third parties including LLM providers, and lavender.ai/dpa offers email notice of sub-processor changes 10 days ahead","status":"verified","url":"https://www.lavender.ai/privacy-policy","locator":"Privacy Policy > Third-Party Processing / AI Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You may ask us for a list of third-parties with whom we share your personal information (including LLM service providers)"},{"key":"dpf_status","value":"No listing found for search term 'Sorter'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Sorter' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"The Terms say Lavender does not retain copies of your emails; account data can be deleted in the dashboard settings. No fixed retention period is stated in the Terms.","status":"verified","url":"https://www.lavender.ai/terms-of-service","locator":"Data & Privacy","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Lavender does not retain copies of your emails"},{"key":"certifications","value":"SOC 2 (type not stated) and GDPR compliance, claimed on the marketing site only; no report or audit page","status":"vendor_statement","url":"https://www.lavender.ai/","locator":"Home > Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are SOC2-certified and GDPR-compliant."},{"key":"admin_ai_controls","value":"Not stated; no admin control to limit AI found","status":"not_published","url":"https://www.lavender.ai/coach","locator":"Looked at: coach page, privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $89 per seat/month billed annually ($99 monthly) for the Team Plan; sold through a demo, VAT not shown","status":"not_published","url":"https://www.lavender.ai/coach","locator":"Coach page > Pricing > Team Plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"leexi","name":"Leexi","vendor":"Leexi SA","category":"meetings-and-notes","plans":[{"id":"T394","plan":"Business","tier":"business","price":{"label":"€39 / user / mo","amount":39,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The DPA prohibits any AI model training on customer audio, transcripts and summaries, by Leexi or by third parties, and imposes this on its AI sub-processors.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Article 7 - Prohibition on using personal data to train AI models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No Personal Data of the Client, whether raw data (audio or video recordings), transcribed data or derived data (summaries, chapters, follow-up tasks, translations, analyses), is used, in any form or for any purpose whatsoever, for AI Model Training"},{"key":"training_opt_out","value":"Nothing to do: the DPA states customer content is never used for AI model training.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Article 7","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No Personal Data of the Client, whether raw data (audio or video recordings), transcribed data or derived data (summaries, chapters, follow-up tasks, translations, analyses), is used, in any form or for any purpose whatsoever, for AI Model Training"},{"key":"eu_residency_option","value":"Yes, EU by default for every plan; customers can also switch hosting to Scaleway (French cloud) as an option.","status":"verified","url":"https://leexi.ai/en/pricing/","locator":"Modules","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Switch to Scaleway, a French cloud service (by default: AWS France)"},{"key":"default_data_location","value":"European Union: AWS France (Paris) primary, Ireland for backup and disaster recovery.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Annex 2, 1. Amazon Web Services EMEA SARL","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"France (Paris, eu-west-3, primary region) and Ireland"},{"key":"dpa","value":"Yes. The DPA takes effect when the client subscribes online, including a free trial (no signature needed) and prevails over other terms on data protection.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"entered into between the client and Leexi on the date on which the Client subscribes online to the Services, including in the context of a free trial."},{"key":"subprocessor_list","value":"Yes. DPA Annex 2 lists 10 sub-processors; the live list is on the trust centre (trust.leexi.ai, needs a browser). AI/model providers: Microsoft Azure OpenAI (EU), Mistral AI; speech: Gladia, ElevenLabs.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Article 8.2 and Annex 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Leexi keeps the list of its Sub-processors up to date on the dedicated page of its trust center"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Leexi SA, Brussels, Belgium)","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Title page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Avenue Herrmann-Debroux 2, 1160 Brussels (Auderghem), Belgium"},{"key":"data_retention","value":"Recordings: kept 2 years by default, configurable down to 1 day, or 'Never keep recordings'. Transcripts and summaries: 1 day to 2 years as set. Raw media deleted once processed. Contract end: deleted within 30 days. Pricing lists retention policy under the paid Governance module.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Article 14.1 and 14.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"processed audio and video recordings are retained by default for two (2) years from the date of each conversation, with a configurable minimum of one (1) day"},{"key":"certifications","value":"ISO 27001:2022 (1 certification named); GDPR compliance is also claimed.","status":"verified","url":"https://leexi.ai/dpa_en.pdf","locator":"Article 10.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"security measures form part of its ISO 27001:2022 certification, the scope of which covers"},{"key":"admin_ai_controls","value":"Not stated: roles, SSO and retention controls sit in the paid Governance module; no switch to turn AI features off for the organisation is described.","status":"not_published","url":"https://leexi.ai/en/pricing/","locator":"Modules: Governance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€39 per licence per month on the yearly toggle (shown next to a struck-through €49 monthly rate), annual invoice, excl. VAT","status":"verified","url":"https://leexi.ai/en/pricing/","locator":"Our plans: Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Greater productivity for teams 39€/month49€ Per licence per month. Annual invoice, excl. VAT."}]}]},{"slug":"lemlist","name":"lemlist","vendor":"LEMPIRE SAS (lemlist)","category":"writing-and-email","plans":[{"id":"T367","plan":"Email","tier":"business","price":{"label":"$55 / mo","amount":55,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. DPA section 11 lets lemlist reuse personal data in prospecting emails 'for the purpose of improving the services' without mentioning AI training; its AI providers are listed with 'no conservation or reuse by the provider'","status":"not_published","url":"https://www.docdroid.net/file/download/RHyJAgZ/lempire-dpa-template-to-sign-pdf.pdf","locator":"Standard DPA (PDF linked as 'DPA to download' on lemlist.com/legal/dpa) > 11. Re-use of data by the Provider; Annex I.C; also looked at: terms, privacy policy, DPA page, ai-info page, help centre AI articles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"for the purpose of improving the services of"},{"key":"training_opt_out","value":"Not stated; no AI-training opt-out or setting described","status":"not_published","url":"https://www.lemlist.com/legal/terms","locator":"Looked at: terms, privacy policy, DPA page, ai-info page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by default: all lemlist servers are in the EU. Optional AI providers (OpenAI, Anthropic, Google Gemini, Perplexity) and Intercom support are USA-based with SCCs","status":"verified","url":"https://www.docdroid.net/file/download/RHyJAgZ/lempire-dpa-template-to-sign-pdf.pdf","locator":"Standard DPA > Annex II Security Measures; Annex I.C","url2":"https://www.lemlist.com/legal/privacy-policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All servers are located in the EU in order to be fully GDPR compliant."},{"key":"default_data_location","value":"European Union: lemlist's host servers are located exclusively in the EU (DPA: hosting by OVH and backups by Scaleway, France). Some processing tools may transfer data outside the EU","status":"verified","url":"https://www.docdroid.net/file/download/RHyJAgZ/lempire-dpa-template-to-sign-pdf.pdf","locator":"Standard DPA > Annex II Security Measures; Annex I.C; privacy policy > Location of data storage and transfers","url2":"https://www.lemlist.com/legal/privacy-policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All servers are located in the EU in order to be fully GDPR compliant."},{"key":"dpa","value":"Yes: the DPA is incorporated into the Terms and accepted by signing them; an e-signed copy is sent on request","status":"verified","url":"https://www.lemlist.com/legal/terms","locator":"Terms of Service > personal data / DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These terms and conditions incorporate the Data Processing Agreement (DPA). By signing these terms and conditions, the Customer accepts the DPA."},{"key":"subprocessor_list","value":"Listed in Annex I.C of the downloadable standard DPA (not a separate web page): 13 entries, 13 companies (5 standard, 5 optional AI/voice, 3 for Lead Finder). AI providers: OpenAI, Anthropic, Google Gemini, Perplexity AI, ElevenLabs","status":"verified","url":"https://www.docdroid.net/file/download/RHyJAgZ/lempire-dpa-template-to-sign-pdf.pdf","locator":"Standard DPA > Annex I.C List of Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Some of the Service’s features and integrations require the use of additional Sub-Processors."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, lempire SAS, Paris, France)","status":"verified","url":"https://www.lemlist.com/legal/privacy-policy","locator":"Privacy Policy > The data controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"a company registered under France law number 823 475082 with the Paris Trade & Companies Register"},{"key":"data_retention","value":"Account and usage personal data: no longer than 3 years after the account is closed; at termination lemlist destroys or returns the customer's personal data at the customer's choice (DPA 13.2); Confidential Information destroyed within 30 days on a reasonable-efforts basis. No period stated for AI prompts","status":"verified","url":"https://www.lemlist.com/legal/privacy-policy","locator":"Privacy Policy > Data retention periods","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The time needed to provide to you our services, and in no event no longer than 3 years after closing your account"},{"key":"certifications","value":"SOC 2 Type II (1 certification); report shown on the trust centre","status":"verified","url":"https://trust.lemlist.com","locator":"Trust Center > Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Compliance SOC2 type 2 report View all"},{"key":"admin_ai_controls","value":"Not stated; no admin control to switch AI features off found","status":"not_published","url":"https://www.lemlist.com/pricing","locator":"Looked at: pricing, terms, ai-info page, help-centre AI articles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $55 per month for the Email plan with the yearly toggle ($69 monthly view); unlimited users, VAT not shown","status":"not_published","url":"https://www.lemlist.com/pricing","locator":"Pricing > Email","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"lever","name":"Lever","vendor":"Lever, Inc. (Employ, Inc.)","category":"documents-hr-and-finance","plans":[{"id":"T612","plan":"Core Platform","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. AI features are off until the customer enables them, and Employ may train models on a customer's AI input data only if the customer instructs, directs or consents, and then only on an anonymized or aggregated basis.","status":"verified","url":"https://www.employinc.com/ai-terms-of-service/","locator":"4. AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Customer instructs, directs, or consents to the use of its Input Data in training or fine-tuning AI or to its being shared with third parties (Training), Employ has a limited license to use such Input Data on an anonymized and/or aggregated basis"},{"key":"training_opt_out","value":"Nothing to do by default: AI is off until an authorized user switches it on, and no training happens unless the customer instructs or consents.","status":"verified","url":"https://www.employinc.com/ai-terms-of-service/","locator":"4. AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"such functionality will not process Customer Data or generate Output unless and until Customer (through its Authorized Users) affirmatively enables it."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found in the DPA, security exhibit, terms or sub-processor list. Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.","status":"not_published","url":"https://www.lever.co/agreements/dpa","locator":"DPA, Security Exhibit, Terms of Service, sub-processor page (searched residency, EU hosting)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Parties agree that the Data Privacy Framework will apply to any Customer Data that is transferred outside the EEA, UK, or Swiss territories."},{"key":"default_data_location","value":"United States. The sub-processor list gives AWS (cloud hosting and infrastructure) and Google Cloud (cloud hosting) as USA.","status":"verified","url":"https://www.employinc.com/sub-processors/","locator":"Current List of Lever Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services (AWS) Cloud Hosting & Infrastructure USA"},{"key":"dpa","value":"Yes. A GDPR/UK/Swiss DPA with standard contractual clauses is published; Employ acts as processor. Employ also offers a pre-signed DPA for download.","status":"verified","url":"https://www.lever.co/agreements/dpa","locator":"2.3 Customer Instructions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer appoints Employ as a processor to process Customer Data on behalf of, and in accordance with, Customer’s instructions as set out in the Agreement and this Addendum"},{"key":"subprocessor_list","value":"Yes, public at https://www.employinc.com/sub-processors/: 17 current Lever sub-processors, plus 3 optional ones (Employ, Nylas, Workato) and 3 affiliates. The separate AI Companions list (9) names Anthropic, OpenAI, AssemblyAI, IBM watsonx and Recall.","status":"verified","url":"https://www.employinc.com/sub-processors/","locator":"Authorized Sub-Processors for Lever Software","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This article communicates the current list of companies who are authorized to process personal data for the Lever software."},{"key":"dpf_status","value":"Not listed under its own name (Lever); its parent Employ Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Employ Inc'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customers configure their own retention and automatic anonymisation or deletion rules in the product. Employ deletes customer data from production 30 days after contract end, fully deleted by 45 days.","status":"verified","url":"https://www.lever.co/agreements/dpa","locator":"Annex II: data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Employ initiates the deletion of all Customer data from the production systems 30 days following contract termination so that such data is deleted by 45 days after contract termination."},{"key":"certifications","value":"1 named: SOC 2 (the security exhibit commits Lever to maintain AICPA SOC 2 certification or equivalent; the pricing page says SOC 2 Type II). No ISO certificate found.","status":"verified","url":"https://www.lever.co/security-exhibit","locator":"1.2 Certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lever shall maintain AICPA SOC2 certification or equivalent as well as maintain a lawful transfer mechanism for export of personal data out of the European Union."},{"key":"admin_ai_controls","value":"Yes. AI functionality does not process customer data until the customer's authorized users enable it, and the customer is responsible for controlling who can enable it.","status":"verified","url":"https://www.employinc.com/ai-terms-of-service/","locator":"4. AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer is responsible for managing and monitoring access to the AI and for ensuring that only appropriately authorized individuals enable such functionality."},{"key":"price_eur","value":"Not published: Lever gives prices only by custom quote; the pricing page shows no amounts.","status":"not_published","url":"https://www.lever.co/pricing","locator":"FAQ: How can I get a precise quote for Lever software?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To get Lever pricing, you’ll need to contact Lever directly for a custom quote."}]}]},{"slug":"lexware-office","name":"Lexware Office","vendor":"Haufe Service Center GmbH (Lexware)","category":"documents-hr-and-finance","plans":[{"id":"T596","plan":"M","tier":"business","price":{"label":"€12.90 / mo","amount":12.9,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The terms for the AI functions state that input and output are not used for training.","status":"verified","url":"https://agb.lexware.de/lexware-office","locator":"2.3 Vertragsgemäße Nutzung von KI-Funktionen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Eine Nutzung des Inputs oder Outputs zu Trainingszwecken findet nicht statt."},{"key":"training_opt_out","value":"Nothing to do: the AGB state that AI input and output are not used for training.","status":"verified","url":"https://agb.lexware.de/lexware-office","locator":"2.3 Vertragsgemäße Nutzung von KI-Funktionen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Eine Nutzung des Inputs oder Outputs zu Trainingszwecken findet nicht statt."},{"key":"eu_residency_option","value":"Hosting is in Germany for all customers according to the product page; no separate EU setting is needed or described.","status":"vendor_statement","url":"https://office.lexware.de/","locator":"Zertifikate: Daten in Deutschland","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Entwicklung, Hosting und Datenschutz komplett aus Deutschland: Deine Daten sind bestens aufgehoben."},{"key":"default_data_location","value":"Germany: high-security data centres in the Frankfurt area, ISO 27001 certified.","status":"vendor_statement","url":"https://office.lexware.de/","locator":"FAQ: Wie sicher sind meine Daten?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deine Daten liegen in deutschen Hochsicherheits-Rechenzentren im Großraum Frankfurt, zertifiziert nach ISO 27001."},{"key":"dpa","value":"Yes. Lexware says it has concluded a contract for data processing (Art. 28 GDPR) with the customer, binding it to use the data only for the software modules and not to pass it on.","status":"verified","url":"https://datenschutz.lexware.de/lexware-office","locator":"1. Wer sind wir","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Kunde und wir haben hierzu einen Vertrag zur Auftragsverarbeitung geschlossen"},{"key":"subprocessor_list","value":"No public sub-processor list found; the terms only say Lexware uses staff and subcontractors bound to data secrecy.","status":"not_published","url":"https://agb.lexware.de/lexware-office","locator":"10.2.5","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Haufe Service Center GmbH, Freiburg, Germany)","status":"verified","url":"https://datenschutz.lexware.de/lexware-office","locator":"1. Wer sind wir und wie können Sie uns erreichen?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Haufe Service Center GmbH Munzinger Straße 9 79111 Freiburg"},{"key":"data_retention","value":"When you cancel, Lexware fully deletes the account and any data you have not saved yourself, and warns you before deletion. Retention of AI inputs is not stated.","status":"verified","url":"https://agb.lexware.de/lexware-office","locator":"12.5 Löschung Ihrer Daten in Ihrem Lexware Office Nutzerkonto","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Nicht durch Sie gesicherte Daten gehen bei der Kündigung verloren, da wir Ihr Lexware Office Nutzerkonto vollständig löschen."},{"key":"certifications","value":"ISO 27001 for the data centres (1 named); the product page also cites TÜV-checked security and GoBD certification for the bookkeeping.","status":"vendor_statement","url":"https://office.lexware.de/","locator":"FAQ: Wie sicher sind meine Daten?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deine Daten liegen in deutschen Hochsicherheits-Rechenzentren im Großraum Frankfurt, zertifiziert nach ISO 27001."},{"key":"admin_ai_controls","value":"Not stated; the AGB set rules for using the AI functions but no organisation-wide switch to turn them off is described.","status":"not_published","url":"https://agb.lexware.de/lexware-office","locator":"2.3 Vertragsgemäße Nutzung von KI-Funktionen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€12.90 per month excl. VAT for version M (offers, e-invoices, reminders), cancellable monthly; a discounted €6.45 is shown for a 3-month introductory period. Flat per account, not per user.","status":"verified","url":"https://office.lexware.de/preise/","locator":"Version M","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alle Preise pro Monat, zzgl. MwSt. Monatlich kündbar."}]}]},{"slug":"userlike","name":"Lime Connect, formerly Userlike","vendor":"Lime Connect (Userlike) GmbH, Cologne (Lime Technologies AB group)","category":"phone-and-voice","plans":[{"id":"T435","plan":"Pro","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No (vendor statement): chat data is not used for external AI training without an appropriate legal basis; a feature box says it is never used to train external AI models. Training by Lime Connect itself is not addressed.","status":"vendor_statement","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"FAQ: Are customer data used to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No. At Lime Connect, customer data from chats are not used for external AI training without an appropriate legal basis."},{"key":"training_opt_out","value":"No opt-out setting described. The vendor states chat data is not used for external AI training without an appropriate legal basis; training by Lime Connect itself is not addressed.","status":"vendor_statement","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"FAQ: Are customer data used to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No. At Lime Connect, customer data from chats are not used for external AI training without an appropriate legal basis."},{"key":"eu_residency_option","value":"Included by default: data is stored only in Germany/Europe; no setting needed.","status":"verified","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"FAQ: Where is data stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All communication data is stored exclusively within Europe, specifically on servers located in Germany."},{"key":"default_data_location","value":"Germany: all communication data is stored on servers in Germany.","status":"verified","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"FAQ: Where is data stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All communication data is stored exclusively within Europe, specifically on servers located in Germany."},{"key":"dpa","value":"Yes. A DPA is available on request via a form on the data-privacy page (Data Protection Officer replies in 1-2 working days) and includes the sub-processor list.","status":"verified","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"Independently audited section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Processing Agreement (DPA) available on request, including a full list of sub-processors"},{"key":"subprocessor_list","value":"Not public. The full sub-processor list is included in the DPA you request from the vendor.","status":"not_published","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"Looked in data-privacy page, terms, privacy policy, help-centre index","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Lime Connect (Userlike) GmbH, Cologne)","status":"verified","url":"https://connect.lime-technologies.com/en/legal/imprint/","locator":"Imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lime Connect (Userlike) GmbH Kölnturm, Im Mediapark 8 50670 Köln"},{"key":"data_retention","value":"You set an expiry date: chat transcripts and messages are deleted automatically after the period you choose; conversations can also be exported or deleted manually. If the account is deleted, its data is deleted automatically.","status":"verified","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"Automatic data deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you can set an expiry date on your data. This means that your customer data (chat transcripts, messages) will be automatically deleted after a time set by you."},{"key":"certifications","value":"1 named: ISO 27001 (the servers where data is stored are ISO 27001-certified; Lime Connect's own certification is not claimed). No SOC 2 named.","status":"vendor_statement","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"ISO 27001 Certified box","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored on ISO 27001-certified servers. Independently audited and regularly renewed."},{"key":"admin_ai_controls","value":"Partly: Connect AI Agent and Copilot are separate paid add-ons (so AI is off unless bought), and admins decide which requests AI handles and when a human takes over.","status":"verified","url":"https://connect.lime-technologies.com/en/products/data-privacy/","locator":"You're in control of the AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you decide what gets automated, what data is processed, and when a human steps in"},{"key":"price_eur","value":"From 105 EUR per month billed monthly, or 87 EUR per month billed annually, excluding VAT (Pro; minimum 3 seats). AI Agent add-on from 99 EUR per month. Whether the price is per seat is not stated.","status":"verified","url":"https://connect.lime-technologies.com/en/pricing/","locator":"Pro card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Multi-channel customer communication, enhanced by AI. From 105 € /month* 87 € /month*"}]}]},{"slug":"lindy","name":"Lindy","vendor":"Crivello Corp (Lindy)","category":"assistants","plans":[{"id":"T324","plan":"Team","tier":"business","price":{"label":"$29.99 / user / mo","amount":29.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Terms say Lindy does not use customer content to train AI models and its AI providers have agreed not to; the security page says the same for your data.","status":"verified","url":"https://www.lindy.ai/terms","locator":"Contributions section","url2":"https://www.lindy.ai/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your Contributions to train AI models, and our AI model providers have agreed not to use them to train their models."},{"key":"training_opt_out","value":"Nothing to do: Lindy states it does not train on customer content and its AI providers have agreed not to.","status":"verified","url":"https://www.lindy.ai/terms","locator":"Contributions section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your Contributions to train AI models, and our AI model providers have agreed not to use them to train their models."},{"key":"eu_residency_option","value":"Vendor claim only: the security page says residency requirements are supported; no EU region, setting or plan is described, and the Terms say the Services are hosted in the United States.","status":"vendor_statement","url":"https://www.lindy.ai/security","locator":"Privacy Controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data deletion requests, access rights, and residency requirements are all supported."},{"key":"default_data_location","value":"United States. The Terms say the Services are hosted in the United States; cloud providers named in the privacy policy are Google Cloud Platform, Amazon Web Services, DigitalOcean, MongoDB and Cloudflare.","status":"verified","url":"https://www.lindy.ai/terms","locator":"Section 19 Privacy Policy","url2":"https://www.lindy.ai/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Please be advised the Services are hosted in the United States."},{"key":"dpa","value":"Yes. Data Processing Terms are built into the Terms of Service (no separate signing); Lindy acts as processor and the customer can ask to sign standard contractual clauses.","status":"verified","url":"https://www.lindy.ai/terms","locator":"Data Processing Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When and to the extent we are acting as a Processor in our provision of the Services, and you are acting as the Controller, the following provisions apply:"},{"key":"subprocessor_list","value":"No standalone list; the privacy policy names 32 companies by group (the terms authorise them). AI providers: Anthropic, OpenAI, Perplexity AI, Exa Labs, ElevenLabs, Deepgram.","status":"verified","url":"https://www.lindy.ai/privacy","locator":"Vendors, Consultants, and Other Third-Party Service Providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AI Model & AI Service Providers: Anthropic, OpenAI, Perplexity AI, Exa Labs, ElevenLabs, Deepgram"},{"key":"dpf_status","value":"No listing found for search term 'Crivello', 'Lindy'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Crivello', 'Lindy' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period published. On account termination Lindy deactivates or deletes data from active databases (some kept for fraud and legal reasons); processor terms promise prompt deletion of customer personal data after the service ends, with certification on request.","status":"verified","url":"https://www.lindy.ai/terms","locator":"Data Processing Terms item 9","url2":"https://www.lindy.ai/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We shall promptly delete (and certify to such deletion upon your written request) all copies of Company Personal Data after the date of our cessation of the provision of the Services to you."},{"key":"certifications","value":"1 audited certification: SOC 2 Type II (audited by Johanson Group); HIPAA, GDPR and PIPEDA compliance are also claimed.","status":"verified","url":"https://www.lindy.ai/security","locator":"Compliance & Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type II Certified Audited by Johanson Group."},{"key":"admin_ai_controls","value":"Not stated for Team. Approvals are built in; SSO, SCIM and audit logs are Enterprise-only, and no admin switch to disable or limit AI features is described.","status":"not_published","url":"https://www.lindy.ai/pricing","locator":"Team and Enterprise boxes","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $29.99 per user per month for 3,000 credits each; larger credit packs up to $9,999.50 per month.","status":"not_published","url":"https://www.lindy.ai/pricing","locator":"Team box","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"linear","name":"Linear","vendor":"Linear Orbit, Inc.","category":"workspace-and-projects","plans":[{"id":"T454","plan":"Business","tier":"business","price":{"label":"$16 / user / mo","amount":16,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Linear will not use Customer Data, including AI prompts and outputs, to train, fine-tune or improve its own AI models, and its contracts require third-party AI providers not to train on it either.","status":"verified","url":"https://linear.app/legal/ai-addendum","locator":"AI Services Addendum, 13.2 Model Training (Linear) and 13.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Linear will not use Customer Data, including Prompts or Outputs, to train, fine-tune, or otherwise improve Linear’s own AI models."},{"key":"training_opt_out","value":"Nothing to do: the AI Services Addendum states Linear does not train its own models on customer data, including prompts and outputs.","status":"verified","url":"https://linear.app/legal/ai-addendum","locator":"AI Services Addendum, 13.2 Model Training (Linear)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Linear will not use Customer Data, including Prompts or Outputs, to train, fine-tune, or otherwise improve Linear’s own AI models."},{"key":"eu_residency_option","value":"Yes. The security page says you choose EU or US storage for your data when creating a Linear workspace. Which plans offer it is not stated.","status":"verified","url":"https://linear.app/security","locator":"Security, Multi-region hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Choose to store your data in the European Union or the United States when creating a Linear workspace."},{"key":"default_data_location","value":"Chosen when the workspace is created: EU or US (security page). The DPA says Linear's primary processing takes place in the United States and the database runs on Google Cloud; which region is preselected is not stated.","status":"verified","url":"https://linear.app/dpa","locator":"DPA, Transfers of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer acknowledges that Linear’s primary processing operations take place in the United States"},{"key":"dpa","value":"Yes. The DPA supplements the Terms of Service; by accepting the Terms the customer enters into it, and the EU Standard Contractual Clauses are deemed signed.","status":"verified","url":"https://linear.app/dpa","locator":"Data Processing Addendum, preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By executing the Agreement, Customer enters into this DPA on behalf of itself"},{"key":"subprocessor_list","value":"Yes, listed in Exhibit B of the DPA at https://linear.app/dpa: 34 entries. AI providers: Google, Amazon Web Services, Anthropic, OpenAI, Fireworks AI, TypeSafe AI, Cohere, Braintrust Data.","status":"verified","url":"https://linear.app/dpa","locator":"DPA Exhibit B, List of Authorized Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following includes the information required by Annex I and Annex III of the EU SCCs"},{"key":"dpf_status","value":"No listing found for search term 'Linear Orbit'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Linear Orbit' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal data is kept while the account is open (and longer where the law requires); after the services end, Linear returns or deletes the customer's personal data at the customer's choice. No fixed period for AI prompts stated.","status":"verified","url":"https://linear.app/dpa","locator":"DPA, return or deletion of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Following completion of the Services, at Customer’s choice, Linear shall return or delete Customer’s Personal Data"},{"key":"certifications","value":"2 named: SOC 2 Type II and ISO/IEC 27001:2022. HIPAA is offered via a BAA; GDPR is described as a commitment.","status":"verified","url":"https://linear.app/security","locator":"Security, Enterprise-grade security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Linear has achieved ISO/IEC 27001:2022 certification for its information security management system."},{"key":"admin_ai_controls","value":"Yes. The AI addendum refers to opting out of an AI service or feature through administrator controls, and says Linear will not re-enable it without the customer's action.","status":"verified","url":"https://linear.app/legal/ai-addendum","locator":"AI Services Addendum, 13.4 Opt-Out Persistence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Customer has opted out of an AI Service or feature through Customer’s administrator controls in the Service"},{"key":"price_eur","value":"Shown in USD only: Business $16 per user/month, billed yearly.","status":"not_published","url":"https://linear.app/pricing","locator":"Pricing, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business $16 per user/month$16 per user/month Billed yearly"}]}]},{"slug":"linkedin-sales-navigator","name":"LinkedIn Sales Navigator","vendor":"LinkedIn Corporation (USA); contracting entity named in the Order Form","category":"sales-marketing-and-support","plans":[{"id":"T506","plan":"Advanced","tier":"business","price":{"label":"€148.21 / user / mo","amount":148.21,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for the Sales Navigator subscription. LinkedIn's FAQ says it trains generative AI on members' own profile data and on what members type into its AI features, unless the member turns off 'Data for Generative AI Improvement'; that FAQ is about members, and the LSA, DPA and service terms have no AI-training clause.","status":"not_published","url":"https://www.linkedin.com/help/linkedin/answer/a5538339","locator":"Looked in LSA, DPA, Service Terms; member FAQ: Does LinkedIn use (or process) my personal data to improve generative AI?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Each member turns off the 'Data for Generative AI Improvement' setting in their own LinkedIn settings; objections for other models use a Data Processing Objection form. No organisation-wide admin switch is stated, and the FAQ describes members' data, not the company subscription.","status":"verified","url":"https://www.linkedin.com/help/linkedin/answer/a5538339","locator":"Can I opt out of the use of my personal data and the content I create to train GAI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To opt out, use the Data for Generative AI Improvement member setting."},{"key":"eu_residency_option","value":"Not stated; no EU storage option found for Sales Navigator.","status":"not_published","url":"https://www.linkedin.com/legal/l/dpa","locator":"Looked in LSA, DPA, service terms, sub-processor list, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the DPA says customer personal data goes to LinkedIn's data centres in the United States.","status":"verified","url":"https://www.linkedin.com/legal/l/dpa","locator":"Annex, Supplementary Measures","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Personal Data as defined in the Data Processing Agreement is transferred across public networks to the Data Importer’s data centres in the United States"},{"key":"dpa","value":"Yes. The LinkedIn Data Processing Agreement is incorporated into the subscription agreement (LSA) and applies automatically.","status":"verified","url":"https://www.linkedin.com/legal/l/lsa","locator":"LSA 2.3 Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the terms of which are incorporated into this LSA"},{"key":"subprocessor_list","value":"Yes, public list at legal.linkedin.com/customer-subprocessors (25 August 2026): 43 rows (12 infrastructure + 31 service providers; Microsoft appears in both). Microsoft is the only major AI or cloud model provider named.","status":"verified","url":"https://legal.linkedin.com/customer-subprocessors","locator":"LinkedIn Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following describes the legal entities engaged in the storage and content delivery of Customer Personal Data by LinkedIn for the Services"},{"key":"dpf_status","value":"Active (LinkedIn Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'LinkedIn'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer personal data is kept for the term of the services; at termination or on request LinkedIn returns or destroys it at the customer's choice. AI conversations are stored until the member deletes them.","status":"verified","url":"https://www.linkedin.com/legal/l/dpa","locator":"Section 8 Data Return and Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"LinkedIn shall, and shall cause any Subprocessors to, at the choice of Customer, return all the Customer Personal Data"},{"key":"certifications","value":"ISO 27001, ISO 27018 (both cover Sales Solutions), ISO 22301, SOC 2 and PCI DSS: 5 listed on the trust page.","status":"verified","url":"https://security.linkedin.com/trust-and-compliance","locator":"Compliance Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 22301 ISO 27001 ISO 27018 SOC 2"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for Sales Navigator's AI features found.","status":"not_published","url":"https://business.linkedin.com/sell/sales-navigator/compare-plans","locator":"Looked in compare-plans page, LSA, DPA, generative AI FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Advanced plan: €148.21 per licence per month, or €1,693.88 per licence per year; described as estimates that may exclude VAT.","status":"verified","url":"https://business.linkedin.com/sell/sales-navigator/compare-plans","locator":"FAQ: How much does LinkedIn Sales Navigator cost?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"CAD: C$179.99/month or C$2,039.88/year EUR: €148.21/month or €1,693.88/year"}]}]},{"slug":"livechat","name":"LiveChat","vendor":"Text, Inc. (LiveChat), Boston, MA, USA","category":"phone-and-voice","plans":[{"id":"T440","plan":"Growth","tier":"business","price":{"label":"$79 / user / mo","amount":79,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for Text's own AI: the DPA lets Text use customer data to improve its services, including training AI models; it says it does not share personal data with other clients. The AI principles say models are task-specific and per licence, and never used for general-purpose or third-party (OpenAI) training.","status":"verified","url":"https://livechat.com/legal/data-processing-addendum/","locator":"DPA 2.4 (Processing of Personal Data)","url2":"https://www.livechat.com/legal/ai-principles/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"for the purposes of providing, maintaining, and improving the Text Services, analysis, including training artificial intelligence (“AI”) models and similar or related Services and features"},{"key":"training_opt_out","value":"Not stated. The AI principles say customer data is used to refine Text's own models and give no setting or email to switch this off; customers can only ask for personal data to be deleted.","status":"not_published","url":"https://www.livechat.com/legal/ai-principles/","locator":"AI Model Training / Privacy and Security; DPA 2.4; terms of use; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated. No EU data-region option found in the legal or security pages.","status":"not_published","url":"https://livechat.com/legal/security/","locator":"Security page; for-clients FAQ; international-data-transfer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated. Text says it works globally and uses Google Cloud and Amazon Web Services, but gives no default storage country or region.","status":"not_published","url":"https://livechat.com/legal/security/","locator":"Security page FAQ; also checked privacy policy and for-clients FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The DPA is part of the Agreement accepted at sign-up; no separate signature is needed or offered.","status":"verified","url":"https://livechat.com/legal/for-clients/","locator":"Data Processing Addendum FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not sign the DPA as a separate agreement anymore - the DPA is already an integral part of the Agreement, meaning it does not require a separate signature."},{"key":"subprocessor_list","value":"A public list exists (linked from the legal FAQ) at https://trust.text.com/subprocessors, but it loads only in a browser, so no count or AI providers were captured. OpenAI is named as an AI partner on the AI principles page.","status":"not_captured","url":"https://www.livechat.com/help/livechat-list-of-subprocessors/","locator":"Where can I find a sub-processors list? (for-clients FAQ)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Text, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Text, Inc'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period stated. The customer can delete or export data at any time with the in-product tools; for other requests Text answers within 30 days. After the agreement ends Text and its sub-processors may keep backups for legal reasons until permanently erased.","status":"verified","url":"https://livechat.com/legal/data-processing-addendum/","locator":"DPA 9. Return and deletion of data (plain-language box)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you need help deleting or exporting data outside built-in tools, just send us a written request. We’ll handle it within 30 days, using our standard methods."},{"key":"certifications","value":"Not stated for Text itself. The security FAQ names no certification; it says Text relies on cloud providers that comply with recognised standards and links to Google Cloud and Amazon Web Services compliance pages.","status":"not_published","url":"https://livechat.com/legal/security/","locator":"What security certifications do you rely on? (security FAQ); also privacy policy and DPA searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. The pages read describe AI features but no admin switch to turn them off for the whole organisation.","status":"not_published","url":"https://www.livechat.com/legal/ai-principles/","locator":"How We Put Our Principles into Practice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $79 per user/month, billed annually (Growth plan; Essential is $19).","status":"not_published","url":"https://livechat.com/pricing/","locator":"Growth plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"lokalise","name":"Lokalise","vendor":"Lokalise, Inc.","category":"writing-and-email","plans":[{"id":"T352","plan":"Explorer","tier":"business","price":{"label":"$149 / mo","amount":149,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless you object: Lokalise may use your AI inputs and outputs to improve its AI features and train its own models (e.g. AI Scoring). Training of third-party LLMs on your data is not permitted.","status":"verified","url":"https://lokalise.com/ai-addendum/","locator":"3. Use and Ownership of Input and Output","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you consent (or do not object) to Lokalise’s use of Input and Output to improve the AI Features"},{"key":"training_opt_out","value":"Object to or withdraw consent: the AI Addendum promises 'reasonable means' to do so, and the AI statement says to email privacy@lokalise.com for requests about data use in AI. No admin menu path is published; withdrawing may limit AI features.","status":"verified","url":"https://lokalise.com/ai-statement/","locator":"6.2 Human Oversight and Control, Opt-out controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Opt-out controls: Customers can opt out of AI training data use at any time via the AI Addendum."},{"key":"eu_residency_option","value":"Default is EU-based AWS hosting for all customers; no separate region setting or plan option is described.","status":"verified","url":"https://lokalise.com/product/security/","locator":"Lokalise security and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"processes customer data on EU-based AWS infrastructure"},{"key":"default_data_location","value":"EU: customer data is processed on EU-based AWS infrastructure (AWS Germany per sub-processor list).","status":"verified","url":"https://lokalise.com/product/security/","locator":"Lokalise security and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"processes customer data on EU-based AWS infrastructure"},{"key":"dpa","value":"Yes: pre-signed DPA, incorporated into the Terms of Service; to countersign, download it, fill in the customer section and email privacy@lokalise.com.","status":"verified","url":"https://lokalise.com/dpa/","locator":"Lokalise Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Addendum has been pre-signed on behalf of Lokalise."},{"key":"subprocessor_list","value":"Yes: https://lokalise.com/sub-processors/ (updated 1 Aug 2026) lists 49 entries incl. AWS, Google, Microsoft Translate, DeepL, OpenAI, Anthropic. A separate AI list at /ai-subprocessor-list/ has 7 rows (AWS Bedrock, OpenAI, Anthropic, Google, Microsoft, DeepL, Vertex AI).","status":"verified","url":"https://lokalise.com/sub-processors/","locator":"List of Lokalise Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lokalise may use the following Sub-processors to the Services to you:"},{"key":"dpf_status","value":"Active (Lokalise Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Lokalise'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On contract end all customer data is automatically deleted, except where the law requires keeping it (no period given). Audit logs 12 months. AI provider retention: OpenAI prompts 30 days, AWS Bedrock none.","status":"verified","url":"https://lokalise.com/product/security/","locator":"FAQ: Lokalise data handling","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon contract termination, all customer data is automatically deleted from Lokalise systems, except where retention is required by law."},{"key":"certifications","value":"SOC 2 Type II, ISO 27001 and ISO 27017 (3 certifications; ISO since Nov 2020). Not PCI DSS certified.","status":"verified","url":"https://lokalise.com/product/security/","locator":"Lokalise holds the following certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lokalise holds SOC 2 Type II, ISO 27001, and ISO 27017 certifications"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features found. Withdrawing consent for Custom AI Profiles disables that feature.","status":"not_published","url":"https://lokalise.com/ai-statement/","locator":"Sections 4.1 and 6; pricing; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Explorer $149 per month (Growth $379, Advanced $1,049). The page has a monthly/yearly billing toggle; 14-day free trial.","status":"not_published","url":"https://lokalise.com/pricing/","locator":"Explorer plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"loom","name":"Loom","vendor":"Atlassian (Loom)","category":"meetings-and-notes","plans":[{"id":"T112","plan":"Business + AI","tier":"business","price":{"label":"$24 / user / mo","amount":24,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No, for now: Atlassian does not use metadata or in-app data from Loom, which has no data contribution settings yet; Atlassian says it will notify organisations when that changes. Loom AI sends transcripts (not video or audio) to OpenAI","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings-availability/","locator":"Paragraph on apps without data contribution settings ('such as Loom or Bitbucket')","url2":"https://www.loom.com/ai","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off today: Loom has no data contribution settings yet and Atlassian does not use its data","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings-availability/","locator":"Paragraph on apps without data contribution settings","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not clear for Business: data residency covers Loom, but only for a new Loom site set up on the Atlassian platform, and Atlassian lists it for Standard, Premium and Enterprise plans without saying whether Loom Business counts.","status":"not_published","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Sections 'How data residency works for Loom' and plan availability line","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Global: Atlassian app data may sit in any Atlassian AWS region unless data residency is set","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Opening sections","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Loom is an Atlassian Cloud Product under the Atlassian Customer Agreement, and Atlassian's DPA (effective 17 Aug 2026) applies with the EU SCCs taking effect automatically","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"Effective date and SCC clause","url2":"https://www.atlassian.com/legal/product-terms","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public (Atlassian's list): 11 of 29 entries (10 companies) apply to Loom, including AWS, Speechmatics for transcription, Google Vertex AI and OpenAI","status":"verified","url":"https://www.atlassian.com/legal/sub-processors","locator":"Entries with 'Loom' under 'Applicable Cloud Products' (effective 15 May 2026)","url2":"https://www.loom.com/ai","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Atlassian'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the subscription; after the agreement ends Atlassian deletes all customer personal data in line with its documentation (no period stated in the DPA)","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"Section 'Deletion and Return of Customer Personal Data'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022 and SOC 2: Loom is listed among the relevant products on Atlassian's certification pages","status":"verified","url":"https://www.atlassian.com/trust/compliance/resources/iso27001","locator":"Section 'Relevant products'","url2":"https://www.atlassian.com/trust/compliance/resources/soc2","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not published: no admin switch for Loom AI was found; Loom's AI page only explains how an admin upgrades to Business + AI","status":"not_published","url":"https://www.loom.com/ai","locator":"FAQ section","url2":"https://support.atlassian.com/organization-administration/docs/deactivate-ai-in-apps/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 24 per user/month with annual billing selected (Business without AI USD 18)","status":"not_published","url":"https://www.loom.com/pricing","locator":"Plan card 'Business + AI'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"lovable","name":"Lovable","vendor":"Lovable (Lovable Labs Inc.)","category":"code-and-app-builders","plans":[{"id":"T84","plan":"Business","tier":"business","price":{"label":"€50 / mo","amount":50,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Terms allow Lovable to use customer data to train its AI models unless the customer asks it not to, on any plan. The DPA bars training on personal data inside customer data.","status":"verified","url":"https://lovable.dev/terms","locator":"Your Content and Data > Rights in Customer Data","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We may use your Customer Data to develop and train artificial intelligence and machine learning models. You may tell us at any time that you do not want your Customer Data used for model training"},{"key":"training_opt_out","value":"Tell Lovable you do not want your customer data used for model training; the Terms allow this at any time. No in-product setting is described.","status":"verified","url":"https://lovable.dev/terms","locator":"Your Content and Data > Rights in Customer Data","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We may use your Customer Data to develop and train artificial intelligence and machine learning models. You may tell us at any time that you do not want your Customer Data used for model training"},{"key":"eu_residency_option","value":"Yes: EU hosting is selectable for Lovable Cloud data; Supabase databases are in the EU by default","status":"verified","url":"https://lovable.dev/security","locator":"Regional data hosting","url2":"https://trust.lovable.dev/subprocessors","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Region chosen per project: Lovable Cloud hosts customer data in the EU, US or Asia Pacific and does not move it across regions by default; core platform on Google Cloud in the Netherlands","status":"verified","url":"https://lovable.dev/security","locator":"Sections on regional data hosting","url2":"https://trust.lovable.dev/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Lovable's DPA (last updated 6 Nov 2025) forms part of the Terms of Service ordered under an Order Form; the contracting entity is Lovable Labs Incorporated, Boston","status":"verified","url":"https://lovable.dev/data-processing-agreement","locator":"Preamble and definition of 'Lovable'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 44 entries including 7 add-on providers; locations mixed between the EU, UK, US and global; AI from Anthropic, OpenAI, Google Vertex, Azure AI Foundry, AWS Bedrock, OpenRouter, Fireworks, Baseten, ElevenLabs and Perplexity","status":"verified","url":"https://trust.lovable.dev/subprocessors","locator":"Subprocessors list ('44 results')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Lovable'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Lovable' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period is stated; Lovable may keep de-identified or aggregated data derived from customer data indefinitely","status":"not_published","url":"https://lovable.dev/terms","locator":"Customer data licence clause","url2":"https://lovable.dev/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II, SOC 2 Type I (2026) and ISO 27001:2022","status":"verified","url":"https://trust.lovable.dev/","locator":"Compliance section and documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Business adds a team workspace, role-based access, SSO, internal publishing, a security center and per-member credit limits; no switch to turn AI off is described","status":"verified","url":"https://lovable.dev/pricing","locator":"Plan card 'Business' and FAQ on credit limits","url2":"https://lovable.dev/security","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 50 per month (monthly billing) for the workspace, with 100 credits and unlimited users; yearly billing gives 2 months free; VAT basis not stated","status":"verified","url":"https://lovable.dev/pricing","locator":"Plan card 'Business' with Monthly toggle","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"lucid","name":"Lucid","vendor":"Lucid Software Inc.","category":"workspace-and-projects","plans":[{"id":"T467","plan":"Team","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Lucid itself: it says it does not use customer data to train models in a way that breaches confidentiality. It does not permit its third-party AI providers (Azure OpenAI, AWS Bedrock) to train on customer data. AI is on by default.","status":"not_published","url":"https://help.lucid.co/hc/en-us/articles/31463501699476-AI-in-Lucid-overview","locator":"Help centre: AI in Lucid overview, Lucid approach to AI","url2":"https://help.lucid.co/hc/en-us/articles/30324063850516-Boost-productivity-with-Lucid-AI","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not permit our third-party AI service providers to use customer data to improve or train artificial intelligence models."},{"key":"training_opt_out","value":"Not stated: no training opt-out is described. Admins on Team and Enterprise accounts can switch Lucid AI off for the whole account (Admin menu, 'Enable Lucid AI' toggle).","status":"not_published","url":"https://help.lucid.co/hc/en-us/articles/31463501699476-AI-in-Lucid-overview","locator":"Help centre: AI in Lucid overview; Boost productivity with Lucid AI, For admins","url2":"https://help.lucid.co/hc/en-us/articles/30324063850516-Boost-productivity-with-Lucid-AI","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not captured: lucid.co security and legal pages are blocked (403) to non-browser fetch.","status":"not_captured","url":"https://lucid.co/security","locator":"lucid.co page blocked to non-browser fetch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not captured: lucid.co security and legal pages are blocked (403) to non-browser fetch.","status":"not_captured","url":"https://lucid.co/security","locator":"lucid.co page blocked to non-browser fetch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, on request: Lucid's Trust Center says Lucid will enter into a DPA. How it is requested or signed is not shown (the Terms page on lucid.co could not be read).","status":"verified","url":"https://trust.lucid.co","locator":"Trust Center, Quick Summary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Will enter into a DPA"},{"key":"subprocessor_list","value":"Not captured: Lucid's Trust Center says a subprocessors list is available, but it sits on lucid.co (blocked). The help article says Lucid AI uses Microsoft Azure OpenAI Service and AWS Bedrock.","status":"not_captured","url":"https://lucid.co/subprocessors","locator":"lucid.co page blocked to non-browser fetch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Lucid Software Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Lucid Software'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not captured: lucid.co privacy and Terms pages are blocked. The Trust Center summary says Lucid deletes customer data on request; no period is shown.","status":"not_captured","url":"https://lucid.co/privacy","locator":"lucid.co page blocked to non-browser fetch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Trust Center shows 12 badges: SOC 2 Type II, ISO 27001:2022, ISO 27701, ISO 42001, FedRAMP Moderate, IRAP, PCI and TX-RAMP (8 audits/certifications), plus CSA, SIG, GDPR and CCPA. Company-wide.","status":"verified","url":"https://trust.lucid.co","locator":"Trust Center, Badges","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 27001:2022 ISO 27701 ISO 42001 PCI SIG SOC 2 Type II TX-RAMP"},{"key":"admin_ai_controls","value":"Yes. Admins on Team and Enterprise accounts can switch Lucid AI on or off for all users of the account (Admin menu, 'Enable Lucid AI' toggle). AI is on by default.","status":"verified","url":"https://help.lucid.co/hc/en-us/articles/30324063850516-Boost-productivity-with-Lucid-AI","locator":"Help centre: For admins: Enable or disable Lucid AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins on Team and Enterprise accounts can control whether or not to give users on their account access to AI features."},{"key":"price_eur","value":"Not captured: the lucid.co pricing page returns 403 to non-browser fetch.","status":"not_captured","url":"https://lucid.co/pricing","locator":"lucid.co page blocked to non-browser fetch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"lusha","name":"Lusha Workspace","vendor":"Lusha Systems, Inc. (Boston, USA)","category":"sales-marketing-and-support","plans":[{"id":"T501","plan":"Scale","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in part: the Terms say Lusha will not use Customer Data to train public AI, but its AI Features are trained offline, mainly on customer metadata, and Lusha analyses inputs and outputs with machine learning to improve its services.","status":"verified","url":"https://www.lusha.com/legal/terms_and_conditions-2/","locator":"Section 7 Privacy and Artificial Intelligence","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Lusha confirms that it will not use Customer Data to train public AI. Notwithstanding the foregoing, AI Features may be trained in Lusha’s local and offline environment for product and research development purposes, mainly with regard to Customers’ metadata."},{"key":"training_opt_out","value":"No single stated switch for the Terms' carve-out; the Terms say permissions can be changed in the Lusha Platform, and the AI trust page says recommendation use is opted out through Support and an account-level opt-out of AI features exists.","status":"verified","url":"https://www.lusha.com/trust-center/tc-ai/","locator":"Product-specific AI usage: Personalized recommendations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data used: Yes, customers can opt-out by reaching out to Lusha’s Support team"},{"key":"eu_residency_option","value":"Yes, by contract: the DPA describes a 'Europe Service' (defined in the Order Form) under which Lusha will not process personal data in a Third Country (outside the EEA and other approved countries). No self-serve setting is described.","status":"verified","url":"https://www.lusha.com/legal/dpa/","locator":"DPA Part 1, section 3 Processing Obligations (Europe Service)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Section 3.b of this Part 1 only applies if and to the extent the Customer has purchased the Europe Service."},{"key":"default_data_location","value":"Ireland: Amazon Web Services hosts the service in Ireland per the sub-processor list that the DPA incorporates; other sub-processors are listed in Ireland and Germany.","status":"verified","url":"https://www.lusha.com/subprocessors/","locator":"Lusha Third-Party Subprocessors table","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services, Inc. Hosting Ireland N/A"},{"key":"dpa","value":"Yes. A data processing agreement is an integral part of the master services agreement; the Terms say it takes precedence over them.","status":"verified","url":"https://www.lusha.com/legal/dpa/","locator":"DPA preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This data processing agreement (“DPA”) forms an integral part of the master services agreement"},{"key":"subprocessor_list","value":"Yes, public list at lusha.com/subprocessors: 27 entries (last updated September 2025). No AI or model providers are listed; AWS (hosting), Google, Salesforce and Zoom appear.","status":"verified","url":"https://www.lusha.com/subprocessors/","locator":"Lusha Third-Party Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lusha’s Subprocessors provide infrastructure, data storage, system logging services, and other tools"},{"key":"dpf_status","value":"No listing found for search term 'Lusha'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Lusha' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer personal data is kept for the period of the agreement; on termination Lusha returns or deletes it, except aggregated data kept for statistical or financial purposes.","status":"verified","url":"https://www.lusha.com/legal/dpa/","locator":"DPA, Annex: period of retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The period for which the Personal Data will be retained: the period of the Agreement."},{"key":"certifications","value":"SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 31700, ISO 42001 and TRUSTe Responsible AI (7 named), plus GDPR seal from ePrivacyseal.","status":"verified","url":"https://www.lusha.com/trust-center/tc-compliance/","locator":"Certifications & attestations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Lusha maintains SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 31700, and TRUSTe Responsible AI certifications."},{"key":"admin_ai_controls","value":"Yes, per the AI trust page: an account-level opt-out of all AI-powered features and granular controls for individual AI capabilities. Which plans get them is not stated.","status":"verified","url":"https://www.lusha.com/trust-center/tc-ai/","locator":"User controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Account-level opt-out of all AI-powered features"},{"key":"price_eur","value":"Not captured: the pricing page shows no plan names or prices in the text version.","status":"not_captured","url":"https://www.lusha.com/pricing/","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"mailchimp","name":"Mailchimp","vendor":"Intuit Mailchimp","category":"sales-marketing-and-support","plans":[{"id":"T80","plan":"Standard","tier":"business","price":{"label":"From €18.03 / mo","amount":18.03,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, under Intuit's privacy statement: Intuit trains its AI and machine-learning models, including by assessing certain content customers send through the platform. Mailchimp's terms and DPA describe no opt-out","status":"verified","url":"https://mailchimp.com/legal/privacy/","locator":"Intuit Global Privacy Statement (updated 9 Mar 2026), 'Research and development'","url2":"https://mailchimp.com/legal/terms/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not described: no setting or contract clause lets a customer stop Intuit's training use","status":"not_published","url":"https://mailchimp.com/legal/terms/","locator":"Section 'Generative KI-Funktionen' and data clauses","url2":"https://mailchimp.com/legal/privacy/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://mailchimp.com/about/security/","locator":"Security page (full text)","url2":"https://mailchimp.com/legal/data-processing-addendum/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Mailchimp's mail transfer agents run in data centres in the US","status":"verified","url":"https://mailchimp.com/about/security/","locator":"Section 'Sicherheit durch unsere Rechenzentren'","url2":"https://mailchimp.com/legal/subprocessors/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Mailchimp's Data Processing Addendum is part of the agreement with business customers and includes the 2021 SCCs","status":"verified","url":"https://mailchimp.com/legal/data-processing-addendum/","locator":"Opening paragraph ('ist Bestandteil der Vereinbarung')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public but dated (last updated 29 Feb 2024): 25 entries, 21 in the US; AI features through Intuit Assist use Microsoft and OpenAI","status":"verified","url":"https://mailchimp.com/legal/subprocessors/","locator":"Table 'Entity Name & Location' and 'Last updated: Feb. 29, 2024'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Intuit; EU-US DPF, Swiss-US DPF, UK Extension; one covered entity)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Intuit'","url2":"https://mailchimp.com/legal/data-processing-addendum/","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the account; on termination Mailchimp provides tools to delete or export data and then deletes it under its deletion policies; accounts inactive for 24 months may be closed","status":"verified","url":"https://mailchimp.com/legal/data-processing-addendum/","locator":"Section 7.1 'Löschung oder Herausgabe bei Kündigung'","url2":"https://mailchimp.com/legal/terms/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed on Mailchimp's security page","status":"not_published","url":"https://mailchimp.com/about/security/","locator":"Security page (full text)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not described: Mailchimp documents user levels, but no switch for its AI features","status":"not_published","url":"https://mailchimp.com/help/manage-user-levels-in-your-account/","locator":"User levels article","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From EUR 18.03 per month after a 14-day free trial (smallest contact tier, up to 6,000 emails a month); VAT basis not stated","status":"verified","url":"https://mailchimp.com/de/pricing/marketing/","locator":"Plan card 'Standard' with EUR selected ('Danach ab: €18.03/Monat')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"mailerlite","name":"MailerLite","vendor":"MailerLite Limited","category":"sales-marketing-and-support","plans":[{"id":"T513","plan":"Comfort","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for AI-feature inputs and outputs: the Terms give MailerLite a licence to use them to improve AI models. Nothing is stated for ordinary subscriber or campaign data. Its partners OpenAI and Google do not train on them.","status":"verified","url":"https://www.mailerlite.com/legal/terms-of-service","locator":"17. AI-Powered Features, 17.3","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"You grant MailerLite a license to use your Inputs and Outputs to improve AI models, and you agree to comply with any restrictions on AI usage."},{"key":"training_opt_out","value":"No opt-out described. The privacy policy and AI policy say providers (OpenAI, Google) are contractually barred from training; the terms' licence for MailerLite itself has no stated opt-out. AI tools can simply be left unused.","status":"not_published","url":"https://www.mailerlite.com/legal/ai-policy","locator":"Your Control and Our Use of AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not a setting: hosting is already in the EU (Germany and the Netherlands) per the trust page.","status":"verified","url":"https://www.mailerlite.com/trust-page","locator":"Data center security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our services are hosted by trusted and certified data storage centers that are located in the European Union (Germany and the Netherlands)"},{"key":"default_data_location","value":"EU: data centres in Germany (legacy Classic accounts) and the Netherlands (new MailerLite), run by Google Cloud EMEA Ltd.","status":"verified","url":"https://www.mailerlite.com/legal/data-processing-agreement","locator":"Annex 4, Google Cloud EMEA Ltd","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data center of Legacy (Classic) with its location in Germany, and data center of new MailerLite with its location in the Netherlands"},{"key":"dpa","value":"Yes, part of the terms: the DPA supplements the Terms of Service and takes effect when the customer agrees to them; no separate signing.","status":"verified","url":"https://www.mailerlite.com/legal/data-processing-agreement","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA is effective from the date the Customer agrees with the terms and conditions of the TOU."},{"key":"subprocessor_list","value":"Yes, in Annex 4 of the DPA (https://www.mailerlite.com/legal/data-processing-agreement): 2 entries (Google Cloud EMEA Ltd, Vercom S.A.). No AI provider is listed there; OpenAI and Google Vertex AI appear in the privacy policy and AI policy instead.","status":"verified","url":"https://www.mailerlite.com/legal/data-processing-agreement","locator":"Annex 4 - List of MailerLite Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The controller has authorised the use of the following sub-processors:"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, MailerLite Limited, Dublin, Ireland)","status":"verified","url":"https://www.mailerlite.com/legal/terms-of-service","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"MailerLite Limited, an Irish registered company at 88 Harcourt Street, Dublin 2, D02 DK18, Ireland"},{"key":"data_retention","value":"Kept while the account is active; after a deletion request, data is deleted or anonymised within 30 days. Billing and transaction records are kept 7 years. AI prompt retention not stated, providers said to retain nothing.","status":"verified","url":"https://www.mailerlite.com/legal/privacy-policy","locator":"11. Data retention, 11.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your data will be fully deleted or anonymized within 30 days from receiving an eligible request."},{"key":"certifications","value":"1 named: ISO/IEC 27001:2022 (company and its data centres); GDPR compliant badge only.","status":"verified","url":"https://www.mailerlite.com/trust-page","locator":"ISO/IEC 27001","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"MailerLite is certified to ISO/IEC 27001:2022, the leading standard for Information Security Management Systems (ISMS)."},{"key":"admin_ai_controls","value":"Not stated; AI tools are described as optional for each user, but no organisation-wide admin switch is documented.","status":"not_published","url":"https://www.mailerlite.com/legal/ai-policy","locator":"Your Control and Our Use of AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page shows no amounts in its text (prices load with JavaScript, EUR/USD toggle).","status":"not_captured","url":"https://www.mailerlite.com/pricing","locator":"Comfort plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"make","name":"Make","vendor":"Make (Celonis)","category":"automation","plans":[{"id":"T22","plan":"Teams","tier":"business","price":{"label":"$29 / user / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for scenario data. The DPA is a processor agreement; the privacy notice only says Google Workspace data is not used to train generalised AI models","status":"not_published","url":"https://www.make.com/privacy-notice","locator":"Privacy notice (last updated 5 Feb 2026)","url2":"https://www.make.com/data-processing-agreement.pdf","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Not stated: Make documents no training use of scenario data and no opt-out route. Its privacy notice speaks only of aggregated, anonymised usage data for product improvement","status":"not_published","url":"https://www.make.com/privacy-notice","locator":"Section on purposes ('To improve our operations, systems, products…')","url2":"https://www.make.com/data-processing-agreement.pdf","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, when the organisation is created","status":"verified","url":"https://help.make.com/organizations","locator":"Region field","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Chosen per organisation at creation: EU (Ireland; Germany for Enterprise) or US; it cannot be changed later","status":"verified","url":"https://help.make.com/organizations","locator":"Region field","url2":"https://assets.ctfassets.net/un655fb9wln6/78xuveidrchD9EWZLrrCUM/a8333d0c19d7de7910d81d8edd68df71/Make_Sub-Processors_November_2025.docx.pdf","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Celonis DPA for Make (last modified 3 May 2024) forms part of the agreement","status":"verified","url":"https://www.make.com/data-processing-agreement.pdf","locator":"Section 1.1","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public (effective 12 Dec 2025): 18 third parties; AI services OpenAI, Anthropic, Google and Groq (US hosting) and Microsoft (France), used for customers who use AI features","status":"verified","url":"https://assets.ctfassets.net/un655fb9wln6/78xuveidrchD9EWZLrrCUM/a8333d0c19d7de7910d81d8edd68df71/Make_Sub-Processors_November_2025.docx.pdf","locator":"Sub-processor table","url2":"https://www.make.com/terms-and-conditions","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Celonis Inc; EU-US, Swiss-US, UK Extension); Make itself is run by Celonis entities in the EU","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Celonis'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Log data is stored for 30 days by default; longer storage is offered on Enterprise. Run history length depends on the plan","status":"verified","url":"https://www.make.com/security","locator":"Paragraph on customer data security ('By default, log data is stored for 30 days')","url2":"https://help.make.com/scenario-history","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II and SOC 3 audits completed; GDPR adherence. No ISO certification listed","status":"verified","url":"https://www.make.com/security","locator":"Compliance section at the top of the page","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not stated. Make's administration docs cover organisation roles, custom roles and the AI provider and data-zone settings, but no organisation-wide switch for Make's AI features","status":"not_published","url":"https://help.make.com/administration","locator":"Administration section index","url2":"https://help.make.com/ai-providers-and-data-zones-in-make","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 29 per month for 10,000 credits, annual billing (per account, not per seat)","status":"not_published","url":"https://www.make.com/pricing","locator":"Teams card (rendered page)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"mammouth-ai","name":"Mammouth AI","vendor":"Mammouth AI SAS","category":"assistants","plans":[{"id":"T320","plan":"Team","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The DPA states Mammouth will not use customer personal data to train AI models; the provider page adds that models are never trained on prompts sent via Mammouth.","status":"verified","url":"https://info.mammouth.ai/docs/terms-of-service","locator":"Annex DPA, clause 2.3","url2":"https://info.mammouth.ai/docs/privacy-with-model-providers","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For the avoidance of doubt, Mammouth shall not use Customer Personal Data to train artificial intelligence models."},{"key":"training_opt_out","value":"Nothing to do: Mammouth states it never uses conversations to train anything and trains no internal models.","status":"verified","url":"https://info.mammouth.ai/docs/privacy-with-model-providers","locator":"Intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don't train any internal models, and we never use your conversations to train anything."},{"key":"eu_residency_option","value":"No separate setting: EEA storage is the default for everyone. AI model calls are not EU-only: Fireworks AI, xAI and OpenRouter are listed as USA, OpenAI, Anthropic and Google as EU / USA.","status":"verified","url":"https://info.mammouth.ai/docs/terms-of-service","locator":"Annex List of Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fireworks AI Processing and generating USA xAI Processing and generating USA OpenRouter Processing and generating USA"},{"key":"default_data_location","value":"European Economic Area: hosting by Hetzner (computing) and Neon (hosting), both in Germany; files on Cloudflare (EU) and Google Cloud (Belgium). Prompts go to AI model providers, some in the USA.","status":"verified","url":"https://info.mammouth.ai/docs/privacy-policy/","locator":"Section 7 International Data Transfers","url2":"https://info.mammouth.ai/docs/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As we are based in Europe, your personal data is processed and stored within the European Economic Area (EEA)."},{"key":"dpa","value":"Yes. A Data Processing Addendum is part of the Terms of Service and ranks third in the contract order; it applies automatically (no separate signing described).","status":"verified","url":"https://info.mammouth.ai/docs/terms-of-service","locator":"Section 6 Personal Data and DPA clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"DPA: Mammouth’s DPA applies to such processing in compliance with GDPR."},{"key":"subprocessor_list","value":"Yes, in the Terms annex (https://info.mammouth.ai/docs/terms-of-service): 14 entries. AI providers: OpenAI, Anthropic, Mistral AI, Google, Fireworks AI, xAI, OpenRouter. Others: Hetzner, Neon, Cloudflare, Google Cloud, Sendinblue, Resend, Stripe.","status":"verified","url":"https://info.mammouth.ai/docs/terms-of-service","locator":"Annex List of Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Main SubProcessors SubProcessor Activity Location of Activity Hetzner Computing EU (Germany)"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Mammouth AI SAS, Paris, France)","status":"verified","url":"https://info.mammouth.ai/docs/privacy-policy/","locator":"Section 1 Who We Are","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The data controller for your personal data is Mammouth AI SAS, a company incorporated in France, having its registered office at 8 Rue Dupleix, 75015 Paris, France"},{"key":"data_retention","value":"Chats are kept while the subscription is active and can be deleted at any time; deleted data is held up to 30 rolling days for abuse detection, then permanently removed. Account data is kept up to 1 year after the subscription ends. AI providers keep prompts no longer than 30 days.","status":"verified","url":"https://info.mammouth.ai/docs/privacy-policy/","locator":"Section 4 How Long Do We Retain Your Data","url2":"https://info.mammouth.ai/docs/privacy-with-model-providers","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Once you delete your data, we might retain it for up to 30 rolling days for abuse detection"},{"key":"certifications","value":"Not stated: no ISO 27001, SOC 2 or similar certification found in the privacy policy, terms (DPA security measures), FAQ or teams page. GDPR compliance is claimed.","status":"not_published","url":"https://info.mammouth.ai/docs/terms-of-service","locator":"Terms DPA section 5 security measures and clause 8; privacy policy; FAQ; teams page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Team owners can disable specific AI providers, API access and video generation for all members, and deploy connectors centrally.","status":"verified","url":"https://info.mammouth.ai/docs/teams","locator":"Permissions section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Owners can restrict certain features for all team members: Disable specific AI providers Disable API access Disable video generation"},{"key":"price_eur","value":"Team plan costs the same per user as individual plans, in EUR incl. VAT: Starter 12 euro, Standard 24 euro, Expert 72 euro per user per month (monthly billing shown).","status":"verified","url":"https://mammouth.ai/pricing","locator":"Pricing page, Team box","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Same price per user for businesses as for B2C"}]}]},{"slug":"mattermost","name":"Mattermost Professional","vendor":"Mattermost, Inc.","category":"workspace-and-projects","plans":[{"id":"T473","plan":"","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. No training clause found in the Terms of Use, Software and Services License Agreement, DPA page, privacy policy or pricing page. The AI feature (Agents) sends data to the LLM provider the customer configures.","status":"not_published","url":"https://mattermost.com/pricing/","locator":"Pricing page, Terms of Use, Software and Services License Agreement, Privacy Policy, DPA page searched for train/AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated. No training clause was found, so no opt-out step is documented.","status":"not_published","url":"https://mattermost.com/pricing/","locator":"Pricing page, Terms of Use, License Agreement, Privacy Policy, DPA page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by choice of hosting: the customer can run the software in an EU data centre or private cloud. No Mattermost-run EU region is described for Professional.","status":"verified","url":"https://mattermost.com/platform/security/","locator":"Security page, Zero Trust First","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Maintain full ownership of your data with deployment on your own infrastructure or private cloud."},{"key":"default_data_location","value":"On the customer's own servers or private cloud: Professional is a self-hosted licence, so Mattermost does not host the messages. A Mattermost-run cloud is described only for the Enterprise plan.","status":"verified","url":"https://mattermost.com/platform/security/","locator":"Security page, Zero Trust First","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Maintain full ownership of your data with deployment on your own infrastructure or private cloud."},{"key":"dpa","value":"Yes. Mattermost offers a Data Processing Addendum that supplements the customer terms or master subscription agreement; an authorised person signs it via a link on the DPA page.","status":"verified","url":"https://mattermost.com/data-processing-addendum/","locator":"Data Processing Addendum page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mattermost offers a Data Processing Addendum that supplements the Customer Terms of Service or any master subscription agreement."},{"key":"subprocessor_list","value":"Yes, public: https://mattermost.com/subprocessors/ . 13 third-party subprocessors plus 4 Mattermost affiliates (last updated 23 Dec 2024). AI providers listed: Anthropic PBC and OpenAI Inc. (AI Services).","status":"verified","url":"https://mattermost.com/subprocessors/","locator":"Subprocessor Addendum page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mattermost and its affiliates may engage third parties (each a “Subprocessor”) to process your Personal Data."},{"key":"dpf_status","value":"Active (Mattermost, Inc; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Mattermost'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept in the customer's own database. By default deleted messages are only hidden (soft delete); retention rules that permanently delete after a set age (e.g. 30 or 90 days) are described for Enterprise customers; not stated for Professional.","status":"verified","url":"https://docs.mattermost.com/administration-guide/comply/data-retention-policy.html","locator":"Data retention policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mattermost Enterprise customers can set a global retention policy as well as custom retention policies"},{"key":"certifications","value":"2 named: SOC 2 Type II (report 2025, bridge letter 2026) and ISO 27001 (2022 certificate).","status":"verified","url":"https://trust.mattermost.com","locator":"Trust centre, Featured Documents","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mattermost ISO 27001 (2022) Certificate"},{"key":"admin_ai_controls","value":"Yes. The AI Agents plugin can be enabled or disabled system-wide by an admin, and it only works once an admin configures an LLM provider.","status":"verified","url":"https://docs.mattermost.com/administration-guide/configure/agents-admin-guide.html","locator":"Agents admin guide, general settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"toggle to enable or disable the plugin system-wide"},{"key":"price_eur","value":"No public price. The Professional plan shows 'Contact Sales'; licences are prepaid annual per-seat subscriptions.","status":"not_published","url":"https://mattermost.com/pricing/","locator":"Pricing page, Professional card and billing FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mattermost Professional and Mattermost Enterprises licenses are sold as prepaid annual subscriptions based on the number of annual seat licenses purchased"}]}]},{"slug":"meetgeek","name":"MeetGeek","vendor":"MeetGeek US Infra, Inc. (US instance); AIVISION PRODUCTS SRL (EU instance)","category":"meetings-and-notes","plans":[{"id":"T381","plan":"Business","tier":"business","price":{"label":"$27 / user / mo","amount":27,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: meeting content is not used to train or improve AI models, its own or its AI providers', unless the customer opts in in writing","status":"verified","url":"https://meetgeek.ai/privacy-policy","locator":"4. No AI training on your content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use meeting content (recordings, transcripts, summaries, chat prompts or AI outputs) to train, fine-tune or otherwise improve AI models"},{"key":"training_opt_out","value":"Nothing to do: no training by default; training happens only if the customer explicitly opts in in writing","status":"verified","url":"https://meetgeek.ai/privacy-policy","locator":"4. No AI training on your content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"unless you explicitly opt in in writing"},{"key":"eu_residency_option","value":"Yes: EU and US data residency; choose the EU instance and meeting content is stored at rest in AWS data centres in the EU","status":"verified","url":"https://meetgeek.ai/privacy-policy","locator":"Data residency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"MeetGeek offers EU and US data residency:"},{"key":"default_data_location","value":"Depends on the instance: the EU instance stores meeting content in AWS data centres in the EU, the US instance in the US; which is the default for a new account is not stated","status":"verified","url":"https://meetgeek.ai/data-processing-agreement","locator":"Hosting region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer's instance determines its hosting region"},{"key":"dpa","value":"Yes: a public data processing agreement covers the EU and US instances and includes EU standard contractual clauses; how it is accepted on a self-serve plan is not stated","status":"verified","url":"https://meetgeek.ai/data-processing-agreement","locator":"7 (international transfers)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021"},{"key":"subprocessor_list","value":"Yes, public list at meetgeek.ai/subprocessors with 4 entries: AWS, OpenAI (AI summaries and chat, no training, zero data retention), Intercom, Mixpanel","status":"verified","url":"https://meetgeek.ai/subprocessors","locator":"MeetGeek Subprocessor List","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This page lists the subprocessors MeetGeek engages to process Customer Data under our Data Processing Addendum."},{"key":"dpf_status","value":"No listing found for search term 'MeetGeek'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'MeetGeek' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Meeting content is kept as set by the plan and workspace retention settings (Business: unlimited transcript storage, 12 months of video); deleted within 30 days of account closure, backups a further 35 days","status":"verified","url":"https://meetgeek.ai/privacy-policy","locator":"Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Meeting content: as set by your plan and workspace retention settings, including custom retention periods on Enterprise plans; deleted within 30 days of account closure, and from encrypted backups within a further 35 days."},{"key":"certifications","value":"1 audit named: SOC 2 Type II (annual); the pricing page also claims GDPR, HIPAA and CCPA compliance","status":"verified","url":"https://meetgeek.ai/privacy-policy","locator":"Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"MeetGeek is audited annually against SOC 2 Type II."},{"key":"admin_ai_controls","value":"Not stated for Business: org-wide settings and locks are listed under Enterprise; no switch to turn AI features off is described","status":"not_published","url":"https://meetgeek.ai/pricing","locator":"Plan comparison, Admin & Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $27 per user per month on the monthly view of the Business plan","status":"not_published","url":"https://meetgeek.ai/pricing","locator":"Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"microsoft-copilot","name":"Microsoft 365","vendor":"Microsoft","category":"assistants","plans":[{"id":"T32","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No (new app since 18 Aug 2026): prompts, responses and file contents in the Microsoft Copilot app are not used to train foundation models; optional feedback is not used for that either","status":"verified","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history","locator":"Box 'Important' at the top of the article","url2":"https://support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off in the new app. Separate personalisation settings (Saved memories, One shared experience, Web search, ad personalisation) are under Settings > Personalization","status":"verified","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/privacy-controls","locator":"Sections 'Memory', 'Shared experiences', 'Web search', 'Personalized advertising'","url2":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"No. The EU Data Boundary and Advanced Data Residency are commercial Microsoft 365 commitments, not offered for personal accounts","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"EU Data Boundary section (commercial Microsoft 365 Copilot)","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: personal data may be stored and processed in the user's region, the United States or any country where Microsoft or its providers operate","status":"verified","url":"https://www.microsoft.com/en-us/privacy/privacystatement","locator":"Section 'Storage and processing of personal data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. With a personal Microsoft account, Copilot is covered by the Microsoft Services Agreement and Microsoft is the controller; the Products and Services DPA is for commercial customers","status":"verified","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Opening section ('covered by the Microsoft Services Agreement')","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No list for personal accounts. Microsoft's Online Services subprocessor list covers commercial services; the privacy statement mentions affiliates and service providers in general","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Subprocessor list reference (commercial Online Services)","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation' (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated for the new app. Users delete single chats in Copilot and can export or delete all Copilot activity in the Microsoft privacy dashboard","status":"not_published","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history","locator":"Sections 'Manage your activity history'","url2":"https://support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"None listed for personal accounts. Microsoft's Copilot certification statements (ISO 27001, ISO 42001 and others) are made for commercial Microsoft 365 Copilot","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Compliance offerings paragraph (commercial page)","url2":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal account has no admin; the user manages memory, web search and personalisation","status":"verified","url":"https://support.microsoft.com/en-us/privacy/microsoft-copilot/privacy-controls","locator":"Opening list of controls","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 0","status":"verified","url":"https://www.microsoft.com/de-de/microsoft-365/buy/compare-all-microsoft-365-products","locator":"Plan cards contrast paid Copilot with 'der kostenlosen Version' (the free version)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T33","plan":"Personal with Copilot","tier":"personal","price":{"label":"€99 / yr","amount":99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Prompts, responses and file contents when using Copilot in Microsoft 365 apps are not used to train foundation models; connected-experience data is not used to train LLMs","status":"verified","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Section 'Your data and Copilot', box 'Important'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off. To stop Copilot reading documents at all, turn off 'Experiences that analyze content' or 'All connected experiences' in the Microsoft 365 privacy settings, which disables Copilot in Word, Excel, PowerPoint, Outlook and OneNote","status":"verified","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Section 'Your privacy settings and Copilot'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No. The EU Data Boundary and Advanced Data Residency are commercial Microsoft 365 commitments, not offered for personal accounts","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"EU Data Boundary section (commercial Microsoft 365 Copilot)","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not fixed: personal data may be stored and processed in the user's region, the United States or any country where Microsoft or its providers operate","status":"verified","url":"https://www.microsoft.com/en-us/privacy/privacystatement","locator":"Section 'Storage and processing of personal data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. With a personal Microsoft account, Copilot is covered by the Microsoft Services Agreement and Microsoft is the controller; the Products and Services DPA is for commercial customers","status":"verified","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Opening section ('covered by the Microsoft Services Agreement')","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No list for personal accounts. Microsoft's Online Services subprocessor list covers commercial services; the privacy statement mentions affiliates and service providers in general","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Subprocessor list reference (commercial Online Services)","url2":"https://www.microsoft.com/en-us/privacy/privacystatement","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation' (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated. Some apps keep Copilot activity history across sessions; it can be exported or deleted in the Microsoft privacy dashboard","status":"not_published","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Section 'Your data and Copilot' (activity history)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"None listed for personal accounts. Microsoft's Copilot certification statements (ISO 27001, ISO 42001 and others) are made for commercial Microsoft 365 Copilot","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Compliance offerings paragraph (commercial page)","url2":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal subscription has no admin; each user switches Copilot off through the connected-experience privacy settings","status":"verified","url":"https://support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy","locator":"Section 'Your privacy settings and Copilot'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 99 per year, or EUR 10 per month","status":"verified","url":"https://www.microsoft.com/de-de/microsoft-365/buy/compare-all-microsoft-365-products","locator":"Card 'Microsoft 365 Single' (sold as Personal outside Germany)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"microsoft-365-copilot","name":"Microsoft 365 Copilot","vendor":"Microsoft","category":"assistants","plans":[{"id":"T03","plan":"Business add-on","tier":"business","price":{"label":"€18.20 / user / mo","amount":18.2,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Prompts, responses and Microsoft Graph data are not used to train foundation models; optional feedback may improve Copilot but not train foundation models","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Important box and feedback note (ms.date 9 Jul 2026, updated 8 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: prompts, responses and Microsoft Graph data are not used to train the foundation models. Optional feedback is not used for that either; admins manage feedback centrally","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Sections on data use and 'Feedback'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Included for EU tenants (EU Data Boundary), except models provided by Anthropic as a sub-processor, which are excluded from the EU Data Boundary. In-country commitments via Advanced Data Residency or Multi-Geo add-ons (Multi-Geo tenants fall outside the EU Data Boundary)","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Section 'Microsoft Copilot and the EU Data Boundary'","url2":"https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-flex-routing","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU tenants: inside the EU Data Boundary at rest. Exceptions: flex routing (on by default for eligible tenants created after 25 Mar 2026) can send inference to the US, Canada or Australia at peak load; Anthropic models excluded from the boundary","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-flex-routing","locator":"Notes and FAQ (ms.date 29 Sep 2026)","url2":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Covered by the Microsoft Products and Services DPA and Product Terms, with Microsoft as processor (applies through the licence terms)","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection","locator":"Opening section (ms.date 29 May 2026)","url2":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public as a downloadable document (Microsoft Online Services Subprocessor List) via Trust Center/Service Trust Portal; change notices via Service Trust Portal 'My Library'","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Paragraph on the subprocessor list","url2":"https://go.microsoft.com/fwlink/?linkid=2096306","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Prompts and responses are stored with the organisation's other Microsoft 365 content; admins set retention policies in Microsoft Purview, and users can delete their Copilot activity history in My Account","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Section 'Data stored about user interactions with Microsoft Copilot'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Microsoft names GDPR, ISO 27001, HIPAA and ISO 42001 (AI management) for Copilot, plus a commitment to ISO/IEC 27018; audit reports sit in the Service Trust Portal","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Paragraph 'Microsoft Copilot provides broad compliance offerings and certifications…'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Copilot is licensed per user; admins choose which agents are allowed, whether Anthropic or OpenAI models are used, and can turn off optional connected experiences (this can remove web search)","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Sections on agents (Integrated apps), third-party models and connected experiences","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 18.20 per user/month list, promotional EUR 15.60, annual subscription, excl. VAT; add-on to a Microsoft 365 Business plan (up to 300 users)","status":"verified","url":"https://www.microsoft.com/de-de/copilot/solutions/business?market=de","locator":"Card 'Microsoft 365 Copilot Business'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"microsoft-bookings","name":"Microsoft Bookings","vendor":"Microsoft Corporation","category":"research-forms-and-storage","plans":[{"id":"T636","plan":"included in Microsoft 365 Business Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the Bookings overview, FAQ or admin pages.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/bookings/bookings-faq","locator":"Bookings FAQ (also overview and turn-on/off pages)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause or opt-out setting found for Bookings.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/bookings/bookings-faq","locator":"Bookings FAQ and overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes for EU customers through the EU Data Boundary, which keeps Customer Data in EU or EFTA datacentres; Bookings itself has no region setting.","status":"verified","url":"https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn","locator":"EU Data Boundary overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data"},{"key":"default_data_location","value":"Inside the customer's Microsoft 365 tenant: Bookings data sits in Exchange Online shared mailboxes, like other Microsoft 365 data. For EU customers the EU Data Boundary keeps storage in the EU or EFTA.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/bookings/bookings-overview","locator":"Bookings overview > Bookings data and compliance","url2":"https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All Bookings data is stored within the Microsoft 365 platform and in Exchange Online."},{"key":"dpa","value":"Yes. The Microsoft Data Protection Addendum covers processing of Customer Data and personal data in Microsoft products and takes precedence over other licensing terms; it applies through the licence terms.","status":"verified","url":"https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/MOSA","locator":"Privacy & Security Terms > Data Protection Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Protection Addendum, or DPA (defined in the Glossary) sets forth the parties obligations with respect to the processing and security of Customer Data, Professional Services Data, and Personal Data by the Products."},{"key":"subprocessor_list","value":"Yes, public as a downloadable Microsoft Online Services Subprocessor List; entry count not captured. It covers all Microsoft Online Services under the DPA.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Data access > List of subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After a subscription ends, Microsoft keeps customer data for 90 days in a limited-function account, then deletes it, including backups, within a further 90 days. A Bookings calendar is deleted by deleting its Exchange mailbox.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-management","locator":"Data management > data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you terminate a cloud subscription or it expires (except for free trials), Microsoft will store your customer data in a limited-function account for 90 days"},{"key":"certifications","value":"Microsoft 365 lists ISO 27001, ISO 27018, ISO 27701, SOC 2 and C5 (5); Bookings is not named in the scope lists, but its data is held in Exchange Online, which is.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"ISO 27001 in-scope services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Exchange Online, Exchange Online Protection, Forms"},{"key":"admin_ai_controls","value":"Not stated. No AI feature is documented for Bookings. An admin can disable Bookings for eligible licences, which is not an AI-specific control.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/bookings/bookings-faq","locator":"Bookings FAQ, overview and turn-on/off pages (no AI feature found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A customer can also disable access to Bookings for certain eligible licenses in their tenant."},{"key":"price_eur","value":"Not captured: Bookings is not sold alone; the Business Standard price page shows no amount without JavaScript.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-365/business/microsoft-365-business-standard","locator":"Microsoft 365 Business Standard page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"microsoft-edge-copilot","name":"Microsoft Copilot Chat in Microsoft Edge","vendor":"Microsoft Corporation (Microsoft Edge, Microsoft Copilot Chat)","category":"research-forms-and-storage","plans":[{"id":"T646","plan":"work account, included with Microsoft 365","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Prompts, responses and Microsoft Graph data in Copilot Chat are not used to train foundation models.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection","locator":"Enterprise data protection for prompts and responses","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models."},{"key":"training_opt_out","value":"Nothing to switch off: Microsoft states prompts, responses and Graph data are not used to train foundation models. Optional feedback is not used for that either; admins manage feedback.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection","locator":"Enterprise data protection for prompts and responses","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models."},{"key":"eu_residency_option","value":"Yes for EU customers: Copilot is an EU Data Boundary service. Exceptions: models provided by Anthropic as a subprocessor and web search queries are outside it.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Microsoft Copilot and the EU Data Boundary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary."},{"key":"default_data_location","value":"For EU users, EU traffic stays in the EU Data Boundary; worldwide traffic can be sent to the EU and other countries for model processing.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Microsoft Copilot and the EU Data Boundary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing."},{"key":"dpa","value":"Yes. Copilot Chat for organisations is covered by the Microsoft Products and Services Data Protection Addendum and Product Terms, with Microsoft as data processor.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection","locator":"What is enterprise data protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor."},{"key":"subprocessor_list","value":"Yes: the Microsoft Online Services Subprocessor List (downloadable via the Trust Center). Microsoft names Anthropic and OpenAI as model subprocessors in Copilot. Entries not counted (document download).","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"List of subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Prompts and responses are stored with the organisation's other Microsoft 365 data; admins set retention in Microsoft Purview, and users can delete their own Copilot activity history in the My Account portal.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Deleting the history of user interactions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your users can delete their Copilot activity history, which includes their prompts and the responses Copilot returns, by going to the My Account portal."},{"key":"certifications","value":"ISO 27001 and ISO 42001 are named for Copilot (2 certifications); the page also lists GDPR and HIPAA as compliance offerings and cites an ISO/IEC 27018 privacy commitment.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems."},{"key":"admin_ai_controls","value":"Yes. Admins can allow or block Copilot Chat from using page content in Edge with the EdgeEntraCopilotPageContext policy, restrict or block access for users or groups, and unpin Copilot Chat.","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/manage","locator":"Manage Copilot Chat in Microsoft Edge; Restrict access to Microsoft Copilot Chat","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To allow or block Copilot Chat from using browsing context, use the EdgeEntraCopilotPageContext policy."},{"key":"price_eur","value":"No separate price: Copilot Chat (Basic) is included with eligible Microsoft 365 licenses. The licence price itself could not be read (Microsoft pricing pages blocked).","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/overview","locator":"Overview of Microsoft Copilot Chat","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Copilot Chat (Basic) is the standalone baseline experience included with eligible Microsoft 365 licenses."}]}]},{"slug":"microsoft-copilot-studio","name":"Microsoft Copilot Studio","vendor":"Microsoft Corporation","category":"assistants","plans":[{"id":"T334","plan":"capacity pack","tier":"business","price":{"label":"€173.30 / mo","amount":173.3,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No by default. Microsoft says customer data is not used to train or improve Microsoft AI models or third-party models (such as OpenAI's), unless the tenant admin opts in to data sharing (off by default; US tenants only at time of reading).","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/faqs-copilot-data-security-privacy","locator":"FAQ for Copilot data security and privacy in Power Platform, \"What happens to my data when I use Copilot?\"","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Are NOT used to train or improve Microsoft AI models, unless your tenant admin opts in to sharing data with us."},{"key":"training_opt_out","value":"Nothing to do for foundation-model training. To keep Microsoft's optional review of inputs off, leave Power Platform admin center > Settings > Tenant settings > 'Data sharing for Dynamics 365 Copilot and Power Platform Copilot AI Features' switched off.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/faqs-copilot-data-sharing","locator":"FAQ for Copilot data sharing, 'How does it work?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"turn on Data sharing for Dynamics 365 Copilot and Power Platform Copilot AI Features > Enable Data Sharing toggle."},{"key":"eu_residency_option","value":"Yes. Choose an environment region inside the EU Data Boundary; a tenant with an EU or EFTA billing address is in scope when all its environments are in an EU region.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-copilot-studio/geo-data-residency","locator":"Geographic data residency, 'EU Data Boundary (EUDB) compliance'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"if a customer provisions a tenant with a billing address in the EU or EFTA, that tenant will be in-scope for the EU Data Boundary if the customer also creates all of its environments within a geographic region inside the EU Data Boundary."},{"key":"default_data_location","value":"In the Microsoft Azure region (geography) chosen for the customer's tenant and environments; if a tenant's location is not in Microsoft's table, data is stored in the United States.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-copilot-studio/data-location","locator":"Data locations in Copilot Studio, 'Data locations' section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If a tenant's location isn't listed in the data locations table, data is stored in the United States."},{"key":"dpa","value":"Yes. Copilot Studio is a Power Platform Core Service, so Microsoft's standard Data Protection Addendum applies automatically as part of the Product Terms when you subscribe.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services DPA page, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)."},{"key":"subprocessor_list","value":"Microsoft publishes a sub-processor list through its Service Trust Portal, but the page needs a browser, so the count could not be read.","status":"not_captured","url":"https://aka.ms/subprocessor","locator":"Microsoft Service Trust Portal sub-processor page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Agent conversation transcripts are kept in Copilot Studio storage for up to 28 days then deleted automatically; the Dataverse copy is cleared by a job after 30 days by default, and the customer can change that period.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-copilot-studio/analytics-transcripts-powerapps","locator":"Conversation transcripts, retention notes","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Transcript data is retained in Copilot Studio storage for up to 28 days to support proper agent functionality and is automatically deleted after this period."},{"key":"certifications","value":"12 frameworks named, including SOC audits and 7 ISO standards (ISO 9001, 20000-1, 22301, 27001, 27017, 27018, 27701), plus HIPAA, HITRUST, FedRAMP, PCI DSS, CSA STAR, UK G-Cloud, OSPAR, K-ISMS, MTCS Level 3, Spain ENS High.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-certification","locator":"Copilot Studio compliance overview, 'ISO compliance' and list of standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Copilot Studio is compliant with the ISO standards listed in the following table."},{"key":"admin_ai_controls","value":"Yes. Admins set data policies in the Power Platform admin center that govern the use and availability of Copilot Studio features and agent capabilities, such as knowledge sources, connectors, actions and publication channels.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governance","locator":"Security and governance, data policies section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can use data policies in the Power Platform admin center to govern the use and availability of Copilot Studio features and agent capabilities, including:"},{"key":"price_eur","value":"EUR 173.30 per pack per month, each pack covering 25,000 Copilot Credits, tenant-wide. A pay-as-you-go option has no upfront commitment (per-credit rate not shown). VAT not stated for this product.","status":"verified","url":"https://www.microsoft.com/en-ie/microsoft-365-copilot/pricing/copilot-studio","locator":"Copilot Studio plans and pricing, 'How credits work' FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"With Copilot Credit packs, a customer pays up front (€173.30/pack/month for 25,000 Copilot Credits)."}]}]},{"slug":"microsoft-forms","name":"Microsoft Forms","vendor":"Microsoft Corporation (Redmond, USA)","category":"research-forms-and-storage","plans":[{"id":"T627","plan":"Microsoft 365 Business Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Microsoft Forms itself. Microsoft says only that Copilot prompts, responses and data accessed through Microsoft Graph are not used to train foundation language models; nothing is said about Forms responses.","status":"not_published","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft 365 Copilot privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"training_opt_out","value":"Not stated for Forms. No setting or email is described to stop Forms content being used for model training.","status":"not_published","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft 365 Copilot privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Default placement only: for EU or EFTA tenants Forms data is stored in the EU/EFTA geography, but Microsoft states these services carry no specific data-residency commitment unless the Product Terms say so. No setting to choose.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-other","locator":"Other Microsoft 365 services data locations, Forms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless otherwise stated in the Microsoft Product Terms, the following Microsoft 365 services don't have specific commitments for Data Residency."},{"key":"default_data_location","value":"Follows the tenant's home region: EU or EFTA tenants get the EU/EFTA geography; other European tenants get Europe; Australian tenants that set up Forms before 12 Oct 2022 get Australia; all other locations get the United States.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-other","locator":"Forms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Countries or regions in the European Union (EU) or European Free Trade Association (EFTA) Macro Region Geography 4 - European Union/EFTA"},{"key":"dpa","value":"Yes. The Microsoft Products and Services Data Protection Addendum sets the data processing and security terms for products bought under the Product Terms, which includes Microsoft 365.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Data Protection Addendum overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site"},{"key":"subprocessor_list","value":"Yes, a Microsoft Online Services Subprocessor List is published via the Trust Center for all services under the DPA, but it is a download that could not be read, so entries are not counted.","status":"not_captured","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"Data access, subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"While the subscription is active the customer can access, extract or delete data. After the subscription ends Microsoft keeps data 90 days in a limited-function account, then deletes it, and in any case within 180 days. A deleted Entra user's Forms data is deleted 30 days later.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview","locator":"Microsoft 365 data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data."},{"key":"certifications","value":"4 named with Forms in scope: ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27018 and SOC 2 (commercial cloud). ISO 42001 and C5 pages do not list Forms.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"ISO 27001 in-scope services (Office 365 applicability)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Exchange Online Protection, Forms, Griffin"},{"key":"admin_ai_controls","value":"Not stated for AI in Forms. Admins can turn Microsoft Forms off for the whole organisation or for specific people; a separate AI on/off switch for Forms was not found.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-forms/admin-information","locator":"Admin information, getting started","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft 365 IT Administrators can turn off Microsoft Forms in the Microsoft 365 admin Center, under the User Management tab."},{"key":"price_eur","value":"Not captured: Microsoft Forms has no separate price; it is included in Microsoft 365 business plans, and the Business Standard price page is JavaScript-only.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-365/business/microsoft-365-business-standard","locator":"Business Standard plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"microsoft-loop-and-planner","name":"Microsoft Loop and Planner","vendor":"Microsoft Corporation","category":"workspace-and-projects","plans":[{"id":"T458","plan":"Loop (Microsoft 365 Business Standard)","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, for Microsoft Copilot: prompts, responses and data it reads through Microsoft Graph are not used to train foundation language models. The page speaks about Copilot, not about the app by name.","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft Copilot privacy, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"training_opt_out","value":"Nothing to do for Copilot: Microsoft states prompts, responses and Microsoft Graph data are not used to train foundation language models. No app-specific setting is described.","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft Copilot privacy, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"eu_residency_option","value":"Yes. The Loop compliance summary lists EU Data Boundary compliance as supported and Multi-Geo as supported for Loop workspaces, so content can be created in an EU geography.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/loop/loop-compliance-summary","locator":"Loop compliance summary, At a glance and Data lifecycle","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EUDB: Compliance is supported. See What is the EU Data Boundary?"},{"key":"default_data_location","value":"In the Microsoft 365 data geography of the user or group (their preferred data location), in SharePoint, OneDrive or SharePoint Embedded containers.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/loop/loop-compliance-summary","locator":"Loop compliance summary, Data lifecycle (Multi-Geo)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Content is created in the geo matching the user's or group's preferred data location."},{"key":"dpa","value":"Yes. The Microsoft Products and Services Data Protection Addendum is an addendum to the Product Terms and sets the data processing and security terms for subscribed products.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services DPA, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site"},{"key":"subprocessor_list","value":"Yes, a Microsoft Online Services Subprocessors List is published on the Microsoft Trust Center, but the list page is JavaScript-only and could not be read, so entries and AI providers are uncounted.","status":"not_captured","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview","locator":"Overview of AI Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subprocessors authorized to process Customer Data or Personal Data in Microsoft Online Services are listed on the Microsoft Trust Center."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"If a paid subscription ends, Microsoft keeps customer data in a limited-function account for 90 days so it can be extracted, then disables the account and deletes the data. Admins can delete data during the subscription; Copilot chat history can be given retention policies in Purview.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview","locator":"Microsoft 365 data retention, deletion and destruction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data."},{"key":"certifications","value":"Not named for Loop. Microsoft's ISO 27001, 27018, 27701 and SOC 2 Type 2 in-scope service lists name Planner but do not list Loop; Microsoft 365-wide certificates exist.","status":"not_published","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"ISO/IEC 27001 in-scope services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly stated. Admins can control creation of Loop components, pages and workspaces with Cloud Policy and SharePoint PowerShell; no AI-specific switch for Loop was found.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoft-365/loop/loop-compliance-summary","locator":"Loop compliance summary, Foundations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Use Cloud Policy and SharePoint PowerShell to control creation of Loop components, pages, and workspaces."},{"key":"price_eur","value":"Not captured: the Microsoft 365 Business Standard pricing page is JavaScript-only and shows no text.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-365/business/microsoft-365-business-standard","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T457","plan":"Planner (Microsoft 365 Business Standard)","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, for Microsoft Copilot: prompts, responses and data it reads through Microsoft Graph are not used to train foundation language models. The page speaks about Copilot, not about the app by name.","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft Copilot privacy, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"training_opt_out","value":"Nothing to do for Copilot: Microsoft states prompts, responses and Microsoft Graph data are not used to train foundation language models. No app-specific setting is described.","status":"verified","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft Copilot privacy, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"eu_residency_option","value":"Yes. Microsoft 365 customer data can be kept in the EU: the EU Data Boundary commits to store and process customer data for Microsoft 365 within the EU, and the tenant's geography sets where content sits.","status":"verified","url":"https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn","locator":"What is the EU Data Boundary?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data"},{"key":"default_data_location","value":"In Microsoft's Azure location for the tenant's country; the data location table gives Europe for EU countries such as Germany, France, Ireland and Austria. Premium plan data sits in Dataverse and attachments in the group's SharePoint location.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-service-other","locator":"Planner section and static data location table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Premium plan data is stored in Dataverse. Assigned tasks are also stored in the same Azure location as basic plans, and attachments are stored in the SharePoint location for the group."},{"key":"dpa","value":"Yes. The Microsoft Products and Services Data Protection Addendum is an addendum to the Product Terms and sets the data processing and security terms for subscribed products.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services DPA, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site"},{"key":"subprocessor_list","value":"Yes, a Microsoft Online Services Subprocessors List is published on the Microsoft Trust Center, but the list page is JavaScript-only and could not be read, so entries and AI providers are uncounted.","status":"not_captured","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview","locator":"Overview of AI Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subprocessors authorized to process Customer Data or Personal Data in Microsoft Online Services are listed on the Microsoft Trust Center."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"If a paid subscription ends, Microsoft keeps customer data in a limited-function account for 90 days so it can be extracted, then disables the account and deletes the data. Admins can delete data during the subscription; Copilot chat history can be given retention policies in Purview.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview","locator":"Microsoft 365 data retention, deletion and destruction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data."},{"key":"certifications","value":"4 named with Planner in scope: ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701 and SOC 2 Type 2. ISO 42001 and C5 pages do not list Planner.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"ISO/IEC 27001 in-scope services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Office Pro Plus, Office Services Infrastructure, OneDrive, Planner, Power Apps, Power BI, Project Online"},{"key":"admin_ai_controls","value":"Not stated for Planner specifically; no admin switch for AI features in Planner was found in the pages read. Copilot features need a Microsoft Copilot licence assigned to the user.","status":"not_published","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft Copilot privacy; Planner data location pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the Microsoft 365 Business Standard pricing page is JavaScript-only and shows no text.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-365/business/microsoft-365-business-standard","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"microsoft-power-automate","name":"Microsoft Power Automate","vendor":"Microsoft Corporation","category":"automation","plans":[{"id":"T480","plan":"Premium","tier":"business","price":{"label":"€13.00 / user / mo","amount":13,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for the Copilot AI features: Microsoft says customer data is not used to train Microsoft AI models unless the tenant admin opts in to optional data sharing, which is off by default.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/faqs-copilot-data-security-privacy","locator":"What happens to my data when I use Copilot? / How does Copilot use my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Are NOT used to train or improve Microsoft AI models, unless your tenant admin opts in to sharing data with us."},{"key":"training_opt_out","value":"Nothing to do by default: the optional data-sharing setting is off. If an admin switched it on: Power Platform admin center > Settings > Tenant settings > turn off the 'Data sharing for Dynamics 365 Copilot and Power Platform Copilot AI Features' toggle.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/faqs-copilot-data-sharing","locator":"How does it work? / If I've opted in, how can I withdraw my consent?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, the data sharing option is disabled for you."},{"key":"eu_residency_option","value":"Yes. When creating an environment you choose the region; an environment created in the EU and EFTA runs in European data centres and keeps data inside EU Data Boundary regions.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/admin/regions-overview","locator":"How do I find out where my app is deployed?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"if your environment is created in the European Union (EU) and European Free Trade Association (EFTA), then your app is deployed in European data centers."},{"key":"default_data_location","value":"In the geography set as the tenant's default location when the organisation is created; environments can be placed in a chosen geo, and data stays inside the geo apart from stated exceptions.","status":"verified","url":"https://learn.microsoft.com/en-us/power-platform/admin/wp-compliance-data-privacy","locator":"Data location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When your organization establishes a tenant, it establishes the default geographical (geo) location."},{"key":"dpa","value":"Yes. Data processing terms for the plan sit in Microsoft's Products and Services Data Protection Addendum, which is an addendum to the Product Terms that apply when you subscribe.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services Data Protection Addendum (DPA)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)."},{"key":"subprocessor_list","value":"Not captured: Microsoft's subprocessor list is not on the pages that could be read without a browser.","status":"not_captured","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"DPA page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Cloud flow run history is kept 30 days in storage, counted from the run's start time. A period for deletion after cancellation was not found on the pages read.","status":"verified","url":"https://learn.microsoft.com/en-us/power-automate/limits-and-config","locator":"Duration and retention limits","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Run retention in storage 30 days Run retention is calculated using a run's start time."},{"key":"certifications","value":"Power Automate is listed as an in-scope service for 3 ISO standards on Microsoft's compliance pages: ISO/IEC 27001, 27018 and 27701. A SOC report was not confirmed on a page that could be read.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"Microsoft in-scope cloud platforms and services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Power Automate cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite"},{"key":"admin_ai_controls","value":"Partly. Tenant settings include a Bing-based help toggle for Copilot in Power Automate and the optional data sharing switch; no tenant-wide switch to turn off Copilot in Power Automate was found, and refusing cross-region data movement does not turn Copilot off.","status":"not_published","url":"https://learn.microsoft.com/en-us/power-platform/admin/geographical-availability-copilot","locator":"Move data across regions page; tenant settings list at https://learn.microsoft.com/en-us/power-platform/admin/tenant-settings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you don't allow data movement across regions, that doesn't turn off all Copilots and generative AI features."},{"key":"price_eur","value":"EUR 13.00 per user per month, paid yearly. The page states the price does not include VAT.","status":"verified","url":"https://www.microsoft.com/en-ie/power-platform/products/power-automate/pricing","locator":"Power Automate Premium card (Ireland site)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Power Automate Premium €13.00 user/month, paid yearly Price does not include VAT."}]}]},{"slug":"microsoft-teams-essentials","name":"Microsoft Teams Essentials","vendor":"Microsoft Corporation","category":"workspace-and-projects","plans":[{"id":"T471","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Teams. Microsoft says only that Microsoft 365 Copilot prompts, responses and Graph data are not used to train foundation LLMs; no Teams-specific training statement was found.","status":"not_published","url":"https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy","locator":"Microsoft 365 Copilot privacy page; Teams security and compliance overview and data-location pages searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"training_opt_out","value":"Not stated. No Teams training clause was found, so no opt-out step is documented for Teams.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoftteams/security-compliance-overview","locator":"Teams security and compliance overview; Copilot privacy page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by tenant region: new tenants can have Teams data in countries such as France, Germany, Italy, Poland, Sweden; EMEA otherwise. The paid Multi-Geo add-on is not available to small-business subscriptions.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/location-of-data-in-teams","locator":"Location of data in Microsoft Teams, Important note","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teams currently offers data residency in Australia, Brazil, Canada, France, Germany, India, Italy, Japan, Norway, Poland, Qatar, South Korea, South Africa, Sweden"},{"key":"default_data_location","value":"In the geographic region of your Microsoft 365 organization (for example Americas, EMEA, APAC, or a country such as Germany for new tenants); the admin can see it under Settings > Organization profile > Data location.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/location-of-data-in-teams","locator":"Location of data in Microsoft Teams","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data in Teams resides in the geographic region associated with your Microsoft 365 or Office 365 organization."},{"key":"dpa","value":"Yes. The Microsoft Products and Services Data Protection Addendum is the data processing and security terms for subscribed products, an addendum to the Product Terms.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services Data Protection Addendum (DPA) landing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site"},{"key":"subprocessor_list","value":"Not captured: Microsoft publishes subprocessor information through the Service Trust Portal, which needs a browser.","status":"not_captured","url":"https://servicetrust.microsoft.com/","locator":"Service Trust Portal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for Teams Essentials. Teams retention-and-delete policies need a licence such as Office 365 E3; whether Essentials includes it is not stated. No default retention period or post-cancellation deletion period found.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoftteams/retention-policies","locator":"Manage retention policies for Microsoft Teams","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Users who are subject to a retention policy for Teams must have an appropriate license, such as Office 365 E3 or Office 365 A3."},{"key":"certifications","value":"4 named: ISO 27001, ISO 27018, SOC 1 and SOC 2 (SSAE18). The same list also names HIPAA and EU Model Clauses.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/security-compliance-overview","locator":"Teams security and compliance overview, Compliance standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These standards are the compliance certifications Teams holds."},{"key":"admin_ai_controls","value":"Not stated for Teams Essentials. No page found describing an admin switch for AI features on this plan.","status":"not_published","url":"https://learn.microsoft.com/en-us/microsoftteams/security-compliance-overview","locator":"Teams security and compliance overview; Copilot privacy page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: Microsoft's Teams plan and pricing pages return a block page to non-browser fetch.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-teams/small-business","locator":"Teams small business pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"microsoft-teams-premium","name":"Microsoft Teams Premium","vendor":"Microsoft Corporation","category":"meetings-and-notes","plans":[{"id":"T395","plan":"intelligent recap add-on","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Microsoft states customer data is not logged or used for any AI model training or testing in intelligent recap, and is not shared with non-Microsoft parties including OpenAI.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/intelligent-recap","locator":"How Microsoft uses data to provide intelligent recap","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data isn‘t logged or used for any AI model training or testing."},{"key":"training_opt_out","value":"Nothing to do: Microsoft states customer data is not used for AI model training in intelligent recap.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/intelligent-recap","locator":"How Microsoft uses data to provide intelligent recap","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data isn‘t logged or used for any AI model training or testing."},{"key":"eu_residency_option","value":"Yes. A Microsoft 365 tenant provisioned in the EU or EFTA is in scope for the EU Data Boundary (store and process in the EU/EFTA); Multi-Geo add-on is an alternative for several regions. Teams is listed as an in-scope service.","status":"verified","url":"https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/MOSA","locator":"EU Data Boundary Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For Microsoft 365, if Customer provisions a tenant in the EU or EFTA, that tenant will be in-scope for the EU Data Boundary"},{"key":"default_data_location","value":"The geographic region of the customer's Microsoft 365 organisation (its tenant). Recap content is stored in Exchange Online mailboxes and OneDrive/SharePoint.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/intelligent-recap","locator":"How Microsoft uses data to provide intelligent recap","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data in Teams resides in the geographic region associated with your Microsoft 365 (or Office 365) organization."},{"key":"dpa","value":"Yes. Microsoft's Data Protection Addendum is part of the customer's licensing agreement and prevails over other terms on data protection (no separate signing described).","status":"verified","url":"https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/MOSA","locator":"Privacy & Security Terms: General","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In the event of any conflict or inconsistency between the DPA and any other terms in Customer’s licensing agreement (including these terms), the DPA shall prevail."},{"key":"subprocessor_list","value":"Yes, a list exists (Microsoft Online Services Subprocessors List on the Microsoft Trust Center), but the list page needs a browser; entry count and AI providers were not read.","status":"not_captured","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview","locator":"AI Subprocessors overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subprocessors authorized to process Customer Data or Personal Data in Microsoft Online Services are listed on the Microsoft Trust Center."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Recap notes, tasks and markers follow the organisation's meeting recording retention policy (admin-set via Teams and Purview); audio recaps are kept 60 days in the user's OneDrive.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/privacy/intelligent-recap","locator":"What content is used to provide intelligent recap and where is it stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All the features listed in the table follow the meeting recording retention policy."},{"key":"certifications","value":"Microsoft Teams is listed in scope for ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701 and SOC 2 (4 named on Microsoft's compliance pages); these cover Teams, not recap specifically.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001","locator":"Microsoft 365 in-scope services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Entra ID, Microsoft Purview portal, Microsoft Teams, Microsoft Viva Topics, MyAnalytics"},{"key":"admin_ai_controls","value":"Partly. Recap works only for users with a Teams Premium or Copilot licence and with transcription (and recording for the full experience) allowed by policy, so admins limit it by licensing and those policies. No separate on/off switch is described.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoftteams/intelligent-recap-calls-meetings","locator":"Prerequisites","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You must assign a Teams Premium license or Microsoft Copilot license to your users."},{"key":"price_eur","value":"Not captured: the Microsoft Teams Premium price page is a script-rendered shell with no price in its text.","status":"not_captured","url":"https://www.microsoft.com/en-us/microsoft-teams/premium","locator":"Price section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"midjourney","name":"Midjourney","vendor":"Midjourney, Inc.","category":"design-images-and-video","plans":[{"id":"T119","plan":"Pro","tier":"business","price":{"label":"$60 / mo","amount":60,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated explicitly: the terms give Midjourney a perpetual, irrevocable licence to reproduce, make derivative works of and distribute your prompts and images, and images are public and remixable by default unless Stealth Mode is on (Pro and Mega)","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083055291277-Terms-of-Service","locator":"Sections on rights granted to Midjourney and 'Remixing and Stealth Mode' (effective 27 May 2026)","url2":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Not published: no training opt-out is described; Stealth Mode (Pro and Mega) only keeps images from being published","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083055291277-Terms-of-Service","locator":"Section 'Remixing and Stealth Mode'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Section 2.5","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not stated: data is processed at Midjourney's operating offices and wherever the parties involved are located","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Section 2.5 'Transfer of Your Personal Data'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Not published: no data processing agreement was found; the privacy policy treats Midjourney as handling users' own data","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Whole policy","url2":"https://docs.midjourney.com/hc/en-us/articles/32083055291277-Terms-of-Service","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Not published: the privacy policy refers to service providers and vendors without listing them","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Sharing section ('With Service Providers, Third Party Vendors…')","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Midjourney'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Midjourney' returned no results","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: personal data is kept as long as necessary; users can delete their account and data from their account page","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Section 2.4 'Retention of Your Personal Data'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"Not published: no security certification is named on the pages read","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy","locator":"Whole policy","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not published: subscriptions are per user; no team admin controls are described","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/27870484040333-Comparing-Midjourney-Plans","locator":"Plan table","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 60 per month, or USD 576 a year (USD 48 a month) on the annual plan","status":"not_published","url":"https://docs.midjourney.com/hc/en-us/articles/27870484040333-Comparing-Midjourney-Plans","locator":"Plan table, column 'Pro Plan'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"miro","name":"Miro","vendor":"Miro","category":"workspace-and-projects","plans":[{"id":"T16","plan":"Business","tier":"business","price":{"label":"€20 / user / mo","amount":20,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Only Free-plan AI interactions are collected to improve Miro AI; Miro does not train or fine-tune models on AI interactions and bars model providers from doing so","status":"verified","url":"https://help.miro.com/hc/en-us/articles/22874000865554-Miro-AI-quality-improvements","locator":"Help article","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: only Free-plan AI interactions are collected to improve Miro AI, and Miro does not use AI interactions to train or fine-tune models","status":"verified","url":"https://help.miro.com/hc/en-us/articles/22874000865554-Miro-AI-quality-improvements","locator":"Sections 'Which Miro Plans contribute AI interaction data' and 'Measures we apply to safeguard your data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Yes: EU residency on all plans at no extra cost; US, Australia and Japan for Enterprise only","status":"verified","url":"https://help.miro.com/hc/en-us/articles/23084283851026-Data-residency-at-Miro","locator":"Header and cost section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"EU by default (primary data centre Ireland, backup Germany); Miro AI data stored in-region but may be processed outside it","status":"verified","url":"https://help.miro.com/hc/en-us/articles/23084283851026-Data-residency-at-Miro","locator":"Regions and governance sections","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Customer DPA (effective 17 Sep 2024) is incorporated into the Master Cloud Agreement or Terms; counterparty RealtimeBoard, Inc. (US)","status":"verified","url":"https://miro.com/legal/customer-data-processing-addendum/","locator":"Preamble, sections 3 and 8","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public PDF (8 Jul 2026): 12 third parties, all listed US; AI: Anthropic, Google, Microsoft (Azure OpenAI), OpenAI, ElevenLabs; at least 10 days' notice to subscribers","status":"verified","url":"https://miro.com/legal/documents/Miro-Current-Subprocessors-List.pdf","locator":"Sub-processor and AI model provider tables","url2":"https://miro.com/legal/customer-data-processing-addendum/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Miro; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'RealtimeBoard'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Miro says Miro AI interaction data isn't retained; board content follows the account. No retention period for boards is stated on the AI pages","status":"verified","url":"https://help.miro.com/hc/en-us/articles/11277533556626-Miro-AI-Admin-security","locator":"Section 'Miro AI' ('Data isn't retained and isn't used to train AI models')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"Miro AI conforms to Miro's ISO 27001 and SOC 2 certifications","status":"verified","url":"https://help.miro.com/hc/en-us/articles/11277533556626-Miro-AI-Admin-security","locator":"Section 'Miro AI'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"No on Business. Turning Miro AI off for the company, or limiting it to specific teams or capabilities, is available on Enterprise and Education plans only","status":"verified","url":"https://help.miro.com/hc/en-us/articles/11277533556626-Miro-AI-Admin-security","locator":"Section 'How to enable and disable Miro AI' ('Available for: Enterprise, Education Plans')","url2":"https://help.miro.com/hc/en-us/articles/32486862599442-Miro-AI-admin-controls","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 20 per member/month billed annually","status":"verified","url":"https://miro.com/de/pricing/","locator":"Business card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"missive","name":"Missive","vendor":"Heliom Inc. (Missive)","category":"writing-and-email","plans":[{"id":"T362","plan":"Productive","tier":"business","price":{"label":"$24 / user / mo","amount":24,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per Missive's AI page: it says it does not train on your emails (marketing page, not the privacy policy)","status":"vendor_statement","url":"https://missiveapp.com/ai-assistant","locator":"AI assistant page > Your AI, your way","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Every AI request is routed through your chosen provider. Missive doesn't train on your emails, ever."},{"key":"training_opt_out","value":"Nothing to do per Missive's AI page: it says it does not train on your emails","status":"vendor_statement","url":"https://missiveapp.com/ai-assistant","locator":"AI assistant page > Your AI, your way","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Every AI request is routed through your chosen provider. Missive doesn't train on your emails, ever."},{"key":"eu_residency_option","value":"Not stated; no EU region setting or plan found","status":"not_published","url":"https://missiveapp.com/gdpr","locator":"Looked at: GDPR page, privacy policy, security page, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: GDPR page lists AWS (servers, file hosting) and Crunchy Data (databases) with US location","status":"verified","url":"https://missiveapp.com/gdpr","locator":"Missive and GDPR > Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Servers, file hosting, compute, transactional emails, secrets management"},{"key":"dpa","value":"Yes, on request: customers ask privacy@missiveapp.com for a data processing addendum","status":"verified","url":"https://missiveapp.com/gdpr","locator":"Missive and GDPR > Data Processing Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our users can request a data processing addendum with us by contacting privacy@missiveapp.com."},{"key":"subprocessor_list","value":"Yes, public on the GDPR page (https://missiveapp.com/gdpr): 12 entries, 12 companies; AI provider listed: Anthropic (customer support)","status":"verified","url":"https://missiveapp.com/gdpr","locator":"Missive and GDPR > Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"here is the complete list of providers who come in direct contact with our users’ personal data:"},{"key":"dpf_status","value":"No listing found for search term 'Heliom'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Heliom' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: data stays on Missive's servers while used; users can delete their account and personal data themselves at any time; AI page says Missive does not store emails sent to AI providers","status":"verified","url":"https://missiveapp.com/privacy","locator":"Privacy Policy > Your rights","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Users have the right to access, correct and delete their personal data at any time."},{"key":"certifications","value":"SOC 2 Type II (report on request) plus Google's mandatory security assessment; 1 named certification","status":"verified","url":"https://missiveapp.com/security","locator":"Security > External audit > SOC 2 Type II Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Missive has achieved SOC 2 Type II compliance, a widely recognized auditing standard for service providers"},{"key":"admin_ai_controls","value":"Yes: AI works only once an organization admin adds an AI provider in Settings > AI; only admins can add or manage providers","status":"verified","url":"https://missiveapp.com/docs/ai/overview","locator":"AI > Overview > Two ways to connect","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Only organization admins can add or manage AI providers, and every provider is linked to the organization"},{"key":"price_eur","value":"Shown in USD only: $24 per user/month (Productive plan; page has a billed-yearly and billed-monthly toggle, VAT not shown)","status":"not_published","url":"https://missiveapp.com/pricing","locator":"Pricing > Productive","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"mistral","name":"Mistral Vibe","vendor":"Mistral AI","category":"assistants","plans":[{"id":"T34","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: individual Vibe users are not opted out of training by default; uploaded documents count as input","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Section 'Opt out of Vibe data training' ('Vibe: users are not opted out by default')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off training: in the web app, Admin panel > Manage > Vibe > Privacy, disable 'Allow your interactions to be used to train our models'; in the mobile app, Settings > Data & Account Controls, untick 'Enable data sharing'","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Sections for the Admin panel and for iOS and Android","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU is the default. Switching off features that transfer data outside the EU is offered only to Enterprise","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Paragraph on Enterprise solutions","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU by default; some features may send data temporarily to the sub-processor locations listed in Mistral's Trust Center","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Article body (dated 12 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Only for business use. The EEA consumer terms cover personal use of Vibe; business use falls under Mistral's commercial terms, which incorporate the DPA","status":"verified","url":"https://legal.mistral.ai/terms/eu-consumers-terms-of-service","locator":"Opening paragraphs (scope of the consumer terms)","url2":"https://legal.mistral.ai/terms/data-processing-addendum","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. Same Trust Center list as for Vibe Team: 25 entries; Vibe hosted by Microsoft (Sweden, Norway), Google (Netherlands, Belgium) and Mistral Compute","status":"verified","url":"https://trust.mistral.ai/subprocessors","locator":"Subprocessors tab (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Mistral AI SAS, Paris)","status":"verified","url":"https://legal.mistral.ai/terms/eu-consumers-terms-of-service","locator":"'Who we are' paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Chats are kept until the user deletes the conversation or the account; backend copies may be kept longer under the privacy policy","status":"verified","url":"https://legal.mistral.ai/terms/privacy-policy","locator":"Section 5 'How long do we keep your personal data?'","url2":"https://help.mistral.ai/en/articles/347613-can-i-delete-a-chat-conversation","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Company-level ISO/IEC 27001:2022, ISO/IEC 27701:2019 and SOC 2 Type II for Mistral AI; scope per product not broken out","status":"verified","url":"https://trust.mistral.ai/","locator":"Trust Center compliance tiles and documents list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal plan has no organisation admin; the user controls training and connectors in their own settings","status":"verified","url":"https://help.mistral.ai/en/articles/455796-as-an-admin-on-team-plan-or-enterprise-do-i-have-company-wide-controls","locator":"Title: company-wide controls are for Team and Enterprise","url2":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 0","status":"verified","url":"https://mistral.ai/pricing/","locator":"Plan cards after selecting currency 'EUR (€)' and country 'Germany'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T35","plan":"Pro","tier":"personal","price":{"label":"€17.84 / mo","amount":17.84,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the user opts out: individual Vibe users are not opted out of training by default; uploaded documents count as input","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Section 'Opt out of Vibe data training' ('Vibe: users are not opted out by default')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The user turns off training: in the web app, Admin panel > Manage > Vibe > Privacy, disable 'Allow your interactions to be used to train our models'; in the mobile app, Settings > Data & Account Controls, untick 'Enable data sharing'","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Sections for the Admin panel and for iOS and Android","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU is the default. Switching off features that transfer data outside the EU is offered only to Enterprise","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Paragraph on Enterprise solutions","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU by default; some features may send data temporarily to the sub-processor locations listed in Mistral's Trust Center","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Article body (dated 12 Aug 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Only for business use. The EEA consumer terms cover personal use of Vibe; business use falls under Mistral's commercial terms, which incorporate the DPA","status":"verified","url":"https://legal.mistral.ai/terms/eu-consumers-terms-of-service","locator":"Opening paragraphs (scope of the consumer terms)","url2":"https://legal.mistral.ai/terms/data-processing-addendum","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. Same Trust Center list as for Vibe Team: 25 entries; Vibe hosted by Microsoft (Sweden, Norway), Google (Netherlands, Belgium) and Mistral Compute","status":"verified","url":"https://trust.mistral.ai/subprocessors","locator":"Subprocessors tab (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Mistral AI SAS, Paris)","status":"verified","url":"https://legal.mistral.ai/terms/eu-consumers-terms-of-service","locator":"'Who we are' paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Chats are kept until the user deletes the conversation or the account; backend copies may be kept longer under the privacy policy","status":"verified","url":"https://legal.mistral.ai/terms/privacy-policy","locator":"Section 5 'How long do we keep your personal data?'","url2":"https://help.mistral.ai/en/articles/347613-can-i-delete-a-chat-conversation","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Company-level ISO/IEC 27001:2022, ISO/IEC 27701:2019 and SOC 2 Type II for Mistral AI; scope per product not broken out","status":"verified","url":"https://trust.mistral.ai/","locator":"Trust Center compliance tiles and documents list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: a personal plan has no organisation admin; the user controls training and connectors in their own settings","status":"verified","url":"https://help.mistral.ai/en/articles/455796-as-an-admin-on-team-plan-or-enterprise-do-i-have-company-wide-controls","locator":"Title: company-wide controls are for Team and Enterprise","url2":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 17.84 per month including taxes with Germany selected (EUR 14.99 before VAT)","status":"verified","url":"https://mistral.ai/pricing/","locator":"Plan cards after selecting currency 'EUR (€)' and country 'Germany'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T05","plan":"Team","tier":"business","price":{"label":"€29.74 / user / mo","amount":29.74,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, until an administrator opts the organisation out (Enterprise is opted out by default). Thumbs-up/down feedback may be used for training regardless","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Article body (updated 3 Sep 2026)","url2":"https://legal.mistral.ai/terms/data-processing-addendum","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"An administrator must act: Admin panel > Manage > Vibe > Privacy, turn off 'Allow your interactions to be used to train our models'. The API has its own separate switch (Admin panel > Privacy > Anonymous improvement data)","status":"verified","url":"https://help.mistral.ai/en/articles/455207-can-i-opt-out-of-my-input-or-output-data-being-used-for-training","locator":"Sections 'Opt out of Vibe data training (via the Admin panel)' and 'Opt out of Mistral Studio and API data training' (article dated 3 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU is the default for Vibe; regional EU/US endpoints for the API","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Article body","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU by default; US only if the US API endpoint is chosen; some features may transfer data temporarily outside the EU","status":"verified","url":"https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data","locator":"Article body (updated 12 Aug 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA effective 27 Jul 2026 forms part of the Agreement (incorporated by reference); counterparty Mistral AI, Paris","status":"verified","url":"https://legal.mistral.ai/terms/data-processing-addendum","locator":"Preamble, sections 11.1-11.2","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 25 entries; Vibe hosted by Microsoft (Sweden, Norway), Google (Netherlands, Belgium), Mistral Compute (France), CoreWeave (EEA); US-located: Stripe, Black Forest Labs (images), Brave (web search), Twilio, Gradual","status":"verified","url":"https://trust.mistral.ai/subprocessors","locator":"Subprocessors table, '1-10 of 25 results'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Mistral AI SAS, Paris)","status":"verified","url":"https://legal.mistral.ai/terms/data-processing-addendum","locator":"Preamble (Mistral AI, Paris)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Vibe chats are kept until the user deletes the conversation or the account; backend copies may stay longer under the privacy policy or DPA. After the contract ends, data is deleted or returned and is no longer accessible after 30 days","status":"verified","url":"https://legal.mistral.ai/terms/privacy-policy","locator":"Section 5 'How long do we keep your personal data?'","url2":"https://legal.mistral.ai/terms/data-processing-addendum","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022, ISO/IEC 27701:2019 and SOC 2 Type II (letter of attestation) for Mistral AI; scope per product not broken out","status":"verified","url":"https://trust.mistral.ai/","locator":"Trust Center compliance tiles and documents list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Team admins can opt the organisation out of training and of Flash Answers, manage users and SSO, and disconnect or disable knowledge connectors","status":"verified","url":"https://help.mistral.ai/en/articles/455796-as-an-admin-on-team-plan-or-enterprise-do-i-have-company-wide-controls","locator":"List of company-wide controls (article dated 12 Aug 2026)","url2":"https://help.mistral.ai/en/articles/661571-how-can-i-control-or-delete-data-connected-to-third-party-tools","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 29.74 per user/month including taxes with Germany selected (EUR 24.99 before VAT); sold from 2 users","status":"verified","url":"https://mistral.ai/pricing/","locator":"Team card after selecting currency 'EUR (€)' and country 'Germany'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"modjo","name":"Modjo","vendor":"RINGO (trading as Modjo), Neuilly-sur-Seine, France","category":"meetings-and-notes","plans":[{"id":"T400","plan":"Order Form","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Modjo itself. Its help article says its AI subcontractors (Azure OpenAI, Google Cloud, OpenAI) do not use the data to train or improve their models, contractually guaranteed.","status":"not_published","url":"https://help.modjo.ai/en/articles/7129430","locator":"Help article 'Our AI Subcontractor: Transparency and Compliance', section 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our subcontractors do not use your data to train or improve their models or algorithms. This is contractually guaranteed."},{"key":"training_opt_out","value":"Not stated; no training setting or opt-out is described. The DPA says AI features are part of the product and cannot be deactivated; the help article says AI subcontractors do not train on the data.","status":"not_published","url":"https://help.modjo.ai/en/articles/7129430","locator":"Help article section 4; DPA AI paragraph; terms; privacy commitment; security pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our subcontractors do not use your data to train or improve their models or algorithms. This is contractually guaranteed."},{"key":"eu_residency_option","value":"Yes, by default: data is hosted in the EEA, and the DPA says data processed by the AI features is hosted exclusively within the EU. No setting is needed.","status":"verified","url":"https://www.modjo.ai/en/trust-center/data-processing-agreement","locator":"Section on AI features and sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data processed within this framework is hosted exclusively within the European Union, in accordance with the requirements of the RGPD."},{"key":"default_data_location","value":"European Economic Area, on Amazon Web Services servers.","status":"verified","url":"https://www.modjo.ai/en/trust-center/data-processing-agreement","locator":"Section 11 Storage of Data inside the European Union","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Personal data processed by RINGO on behalf of the Client and RINGO’s websites and databases are hosted by Amazon Web Services on servers located in the European Economic Area"},{"key":"dpa","value":"Yes: a Data Processing Agreement is attached to the Order Form and the General Terms, so it applies to every client contract.","status":"verified","url":"https://www.modjo.ai/en/trust-center/data-processing-agreement","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Protection Agreement is attached to the Order Form and the General Terms and Conditions of Sales Modjo."},{"key":"subprocessor_list","value":"Yes, public: https://www.modjo.ai/en/trust-center/subprocessors lists 9 entries, all marked EU. AI providers: OpenAI, Microsoft, Google Cloud Platform. Also AWS, Datadog, Sentry, Deepl, Recall, Neo4j.","status":"verified","url":"https://www.modjo.ai/en/trust-center/subprocessors","locator":"Our subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI is used for AI capabilities, such as smart recording summarisation, automatic CRM filling, and the generation of personalised content for strategic and commercial purposes."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, RINGO SAS trading as Modjo, Neuilly-sur-Seine, France)","status":"verified","url":"https://www.modjo.ai/en/trust-center/terms-and-conditions","locator":"Section 1 Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These General Terms and Conditions (hereinafter “T&Cs”) are applicable to commercial relations between the company RINGO (trading under the name MODJO), a simplified joint stock company"},{"key":"data_retention","value":"Admins set the retention period for recordings and transcripts (Security Settings > Data Retention Policy); new clients since 20 Nov 2024 get defaults, changeable any time. AI subcontractors keep data up to 90 days. After termination data is inaccessible in 24 hours, deleted from production after 30 days.","status":"verified","url":"https://www.modjo.ai/en/trust-center/data-processing-agreement","locator":"Section 1 Duration of the processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The retention period can be set by the client. For new clients since November 20, 2024, default retention periods have been introduced. The Client may change these retention periods at any time."},{"key":"certifications","value":"Not stated: the security page names no ISO 27001, SOC 2 or similar certification; it lists annual third-party penetration tests and says a policy overview and test summary are available on request.","status":"not_published","url":"https://www.modjo.ai/en/trust-center/security-compliance","locator":"Security & Compliance (last updated 28/09/2024)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"No: AI features cannot be switched off. The DeepL translation sub-processor only receives data when a user activates translation for a record.","status":"verified","url":"https://www.modjo.ai/en/trust-center/data-processing-agreement","locator":"AI features paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Artificial intelligence features are an integral part of the product and cannot be deactivated."},{"key":"price_eur","value":"Not published: the pricing page shows no prices or plan names; the price per licence is set on the Order Form each client signs. Prices are in euros, excluding VAT.","status":"not_published","url":"https://www.modjo.ai/en/pricing","locator":"Pricing page; Terms section 7 Price","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"moinai","name":"moinAI","vendor":"knowhere GmbH (moinAI), Hamburg","category":"phone-and-voice","plans":[{"id":"T433","plan":"Business","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The pages say the chatbot is self-learning and does not need to be trained by the customer, but say nothing on whether customer content trains AI models.","status":"not_published","url":"https://www.moin.ai/preise","locator":"Looked in pricing page, FAQ, data-protection page, AI-agent page, Lexikon article, privacy policy (website only)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training statement or opt-out found.","status":"not_published","url":"https://www.moin.ai/preise","locator":"Looked in pricing page, FAQ, data-protection page, website privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Included by default: German servers (OVH) and European-only Azure processing are marked for Business. A stricter 'Extended' EU-only AI option is marked for Professional only.","status":"verified","url":"https://www.moin.ai/preise","locator":"Comparison table, Sicherheit & Datenschutz","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Datenhaltung ausschließlich auf deutschen Servern"},{"key":"default_data_location","value":"Germany. All servers and stored data are hosted in Germany (OVH named in the pricing comparison); AI/LLM processing via Microsoft Azure on European servers only.","status":"verified","url":"https://www.moin.ai/chatbots-dsgvo","locator":"Section on server location","url2":"https://www.moin.ai/preise","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alles ist in Deutschland gehostet."},{"key":"dpa","value":"Yes. An AVV (Auftragsverarbeitungsvertrag, Art. 28 GDPR) is offered; you request it by email. The comparison table marks it as included in Business.","status":"verified","url":"https://www.moin.ai/chatbots-dsgvo","locator":"Section on Auftragsverarbeitung","url2":"https://www.moin.ai/preise","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"moinAI bietet einen Auftragsverarbeitungsvertrag (AVV), dessen Inhalt vom Datenschutzrecht im Art. 28 DSGVO vorgegeben wird."},{"key":"subprocessor_list","value":"Not published. No sub-processor list found; the pricing table shows a Trust Center as 'Coming soon' for all plans.","status":"not_published","url":"https://www.moin.ai/preise","locator":"Looked in pricing page, data-protection page, FAQ, website privacy policy, imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, knowhere GmbH, Hamburg)","status":"verified","url":"https://www.moin.ai/impressum","locator":"Impressum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"knowhere GmbH Karolinenstraße 9 20357 Hamburg"},{"key":"data_retention","value":"The customer sets how long conversations are stored, from 'nie' (never) up to 1 year, in Bot-Einstellungen > Generelles & Datenschutz; automatic deletion after the chosen period is possible. Deletion after cancellation is not stated.","status":"verified","url":"https://www.moin.ai/chatbot-lexikon/chatbots-datenschutz-dsgvo","locator":"Requirement 1, right to be forgotten","url2":"https://www.moin.ai/chatbots-dsgvo","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die Speicherdauer der KI-Chatbot-Unterhaltungen kann individuell definiert werden. Möglich sind Zeiträume von nie bis 1 Jahr."},{"key":"certifications","value":"Data-centre ISO 27001 is marked for Business; moinAI's own ISO 27001 is 'Coming soon' for all plans. No SOC 2 named.","status":"vendor_statement","url":"https://www.moin.ai/preise","locator":"Comparison table, Sicherheit & Datenschutz","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 27001-Zertifizierung Rechenzentren Zertifizierte Sicherheitsstandards der Rechenzentren"},{"key":"admin_ai_controls","value":"Not stated. The table lists roles and permissions but no organisation-wide AI off switch (guardrails limit what the bot answers).","status":"not_published","url":"https://www.moin.ai/preise","locator":"Looked in pricing comparison table, FAQ, AI-agent page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From 750 EUR per month with annual payment, or from 880 EUR per month paid monthly (Business; unlimited conversations, 15 AI agents, 3-month minimum term). VAT not stated.","status":"verified","url":"https://www.moin.ai/preise","locator":"Plan overview, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business ab 880 € pro Monat (monatliche Zahlung) ab 750 € pro Monat (jährliche Zahlung)"}]}]},{"slug":"monday-crm","name":"monday CRM","vendor":"monday.com Ltd. (Israel)","category":"sales-marketing-and-support","plans":[{"id":"T500","plan":"Pro","tier":"business","price":{"label":"€28 / user / mo","amount":28,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. monday.com states it does not use Customer Data or Content to train AI models and does not allow others to do so.","status":"verified","url":"https://monday.com/l/legal/ai/","locator":"monday AI Terms, section 6 Monitoring and Improvement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so."},{"key":"training_opt_out","value":"Nothing to do: monday.com states it does not train on customer content, whether or not an admin opts out of the separate product-improvement use.","status":"verified","url":"https://monday.com/l/legal/ai/","locator":"monday AI Terms, section 6","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"regardless of whether your Admin(s) opts-out, such data will not be used to train models."},{"key":"eu_residency_option","value":"Not stated for this plan: accounts are assigned a data region (EU exists) but how to choose it and for which plan is in a help article that could not be read.","status":"not_captured","url":"https://support.monday.com/hc/en-us/articles/360002582619-Data-residency","locator":"Data residency help article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Stored in the US, Germany or Australia, in the data centre closest to the first user who created the account; some data may sit in other regions at sub-processors.","status":"verified","url":"https://monday.com/l/security/","locator":"FAQ: Where is account data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is stored in the data center closest to the location of the first user who created the account."},{"key":"dpa","value":"Yes. A Data Processing Addendum is incorporated by reference into the Terms of Service, so it applies without a separate signature.","status":"verified","url":"https://monday.com/l/legal/dpa/","locator":"DPA preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) is incorporated by reference into monday.com’s Terms of Service"},{"key":"subprocessor_list","value":"Yes, public list at monday.com/l/privacy/subprocessors: 14 infrastructure rows + 15 AI rows (29 rows) plus 13 monday.com entities and support providers. AI providers listed include OpenAI, Anthropic, Microsoft, Google Cloud, AWS and Nebius.","status":"verified","url":"https://monday.com/l/privacy/subprocessors/","locator":"Sub-processors tables and AI Work Platform table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic PBC AI Work Platform LLM provider"},{"key":"dpf_status","value":"Active (monday.com Inc.; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'monday.com'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Interaction data with monday AI is kept up to 60 days. After termination, customer data stays until the customer or monday.com deletes it; customer is responsible for exporting or deleting it first.","status":"verified","url":"https://monday.com/l/legal/ai/","locator":"monday AI Terms, section 6","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Such data will not be shared with third parties and may be retained by us for up to 60 days."},{"key":"certifications","value":"SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, 27018, 27017, 27032 and 27701, and CSA STAR (9 listed), plus TX-RAMP.","status":"verified","url":"https://monday.com/trustcenter","locator":"Compliance/Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 1 Type II Report SOC 2 Type II Report SOC 3 Report ISO/IEC 27001:2022"},{"key":"admin_ai_controls","value":"Not captured: the help article on turning AI features off for an account returned 403.","status":"not_captured","url":"https://support.monday.com/hc/en-us/articles/17251905174290-Turn-on-or-off-AI-features-for-your-account","locator":"AI help article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€28 per seat per month for monday CRM Pro, billed annually (shown for 3 seats; monthly billing costs more); prices exclude tax. AI credits are included in this plan.","status":"verified","url":"https://monday.com/pricing","locator":"monday CRM pricing, Pro plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prices do not include tax. The price is determined by the user's billing country."}]}]},{"slug":"monday-com","name":"monday.com","vendor":"monday.com","category":"workspace-and-projects","plans":[{"id":"T104","plan":"Pro","tier":"business","price":{"label":"€19 / user / mo","amount":19,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. monday.com does not use Customer Data or Content to train AI models and does not allow others to do so","status":"verified","url":"https://monday.com/l/legal/ai/","locator":"Section 'Monitoring and Improvement' (AI terms, last updated 5 May 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off for training. Admins can opt the account out of use of its data to improve the Services by contacting Support","status":"verified","url":"https://monday.com/l/legal/ai/","locator":"Section 'Monitoring and Improvement' (last sentence)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, with limits: Pro accounts created on or after 23 Jan 2023 can sit in the EU Data Region, but their Customer Data may also be processed in the US under Standard Contractual Clauses; only Enterprise keeps Customer Data solely in the EU, sub-processors included. An account's region cannot be changed later","status":"verified","url":"https://support.monday.com/hc/en-us/articles/4404392703250-Data-residency","locator":"Sections 'EU Data Region', 'Where is my data stored?' and 'Can I change my data region?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Set by where the first user opens the account: accounts opened from the EU, Africa or the Middle East are stored in the EU Data Region (AWS); profiles, credentials, usage analytics and app data stay in the US Data Region","status":"verified","url":"https://support.monday.com/hc/en-us/articles/4404392703250-Data-residency","locator":"Sections 'How is my account's data region determined?' and 'What type of data is stored there?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. The Data Processing Addendum is incorporated by reference into monday.com's Terms of Service","status":"verified","url":"https://monday.com/l/legal/dpa/","locator":"Opening paragraph (last updated 20 Dec 2023)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 15 platform sub-processors (one row shows no name) and 15 AI sub-processors, including OpenAI, Anthropic, AWS, Google and Microsoft, plus 13 monday.com entities and support providers; hosting regions given per row","status":"verified","url":"https://monday.com/l/privacy/subprocessors/","locator":"Page 'Sub-Processors, Subsidiaries & Support' (last updated 24 Jun 2026)","url2":"https://monday.com/l/legal/dpa/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active, re-certification under review (monday.com Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'monday.com'","url2":"https://monday.com/l/privacy/privacy-policy/","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data is kept for the term of the agreement; after termination monday.com deletes or returns personal data at the customer's choice (no period stated). Data about monday AI use kept for monitoring and improvement is held for up to 60 days","status":"verified","url":"https://monday.com/l/legal/dpa/","locator":"Section 'Return and Deletion of Personal Data'","url2":"https://monday.com/l/legal/ai/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1 Type II, SOC 2 Type II and SOC 3 reports; ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27032:2023 and 27701:2019; HIPAA BAA available","status":"verified","url":"https://monday.com/trustcenter","locator":"Compliance list","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. Account admins can switch monday AI on or off for the whole account (Administration > AI Governance > Settings) and set AI credit limits; per-role and per-workspace AI permissions are Enterprise only","status":"verified","url":"https://support.monday.com/hc/en-us/articles/30934592475410-AI-Permissions-and-Governance","locator":"Sections 'Enable or disable AI capabilities' and 'AI permissions'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 19 per seat/month billed annually, including 3,000 AI credits a month; VAT basis not stated","status":"verified","url":"https://monday.com/pricing","locator":"Plan card 'Pro' (10 seats, Yearly)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"moss","name":"Moss Platform","vendor":"Nufin GmbH","category":"documents-hr-and-finance","plans":[{"id":"T600","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The privacy policy says customer data is used for testing, research and statistical analysis to improve the service, but it names no training of AI models.","status":"not_published","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPP_v3.0.pdf","locator":"Data Privacy and Cookie Policy, 5.2 'Improving services'; T&C v11.0 and DPA have no AI-training clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"training_opt_out","value":"Not published. No training opt-out is described because no model-training use of customer content is described.","status":"not_published","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPP_v3.0.pdf","locator":"Section 5.2; T&C v11.0; DPA v3.0 (no training clause, no opt-out)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"eu_residency_option","value":"No separate EU-residency option is published. Processing already takes place in the EU/EEA and UK by default.","status":"not_published","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPP_v3.0.pdf","locator":"Section 8; pricing, security and legal pages checked for a residency setting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"Generally the EU/EEA and UK for customers using Moss there; transfers to other countries only under an adequacy decision or standard contractual clauses. The DPA lists Google Ireland (Cloud Platform, BigQuery); US-based Cloudinary, Intercom and Twilio are also listed.","status":"verified","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPP_v3.0.pdf","locator":"Data Privacy and Cookie Policy, 8 'Data processing in the EU/EEA and UK'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The processing of personal data generally takes place within the member states of the EU/EEA and UK when Moss Platform Services are used there."},{"key":"dpa","value":"Yes. A data processing agreement is concluded automatically when the Moss Platform agreement starts; the standard DPA v3.0 is published as a PDF.","status":"verified","url":"https://getmoss.com/public/terms-and-conditions/20250101_INT-en_Nufin_GmbH_Terms_and_Conditions_v11.0.pdf","locator":"T&C v11.0, 15.3.3 (DPA automatically concluded)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"a data processing agreement is automatically concluded between the"},{"key":"subprocessor_list","value":"Yes. DPA Annex 4 lists 6 companies: Cloudinary, Gini (receipt OCR), Google Ireland (Cloud Platform, BigQuery), Intercom, Klippa (receipt OCR) and Twilio.","status":"verified","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPA_v3.0.pdf","locator":"Annex 4 Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Gini GmbH, Ridlerstraße 57, 80339 Munich, Germany (OCR of receipts)"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Nufin GmbH, Berlin)","status":"verified","url":"https://www.getmoss.com/imprint","locator":"Imprint, name and address","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Nufin GmbH Saarbrücker Str. 37A 10405 Berlin Germany"},{"key":"data_retention","value":"Kept while needed for the service. German tax and commercial law require 2 to 10 years, and up to 30 years for legal claims. On termination the DPA requires deletion or return.","status":"verified","url":"https://getmoss.com/public/terms-and-conditions/20240701_INT-en_Nufin_GmbH_DPA_v3.0.pdf","locator":"DPA preface, 'Deletion or Return of Data' row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Upon termination of the DPA, all data must be deleted or returned at the choice of the controller"},{"key":"certifications","value":"ISO/IEC 27001:2022 certified. The security page also states BaFin regulation and DORA compliance; ISO 27001 is the only security certification named.","status":"verified","url":"https://www.getmoss.com/security","locator":"Security page, 'Trusted standards and security'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"BaFin-regulated, ISO/IEC 27001:2022 certified platform, and advanced security features keep your financial operations protected, every step of the way."},{"key":"admin_ai_controls","value":"Not published. The pricing page names AI-based pre-accounting automation, but no administrator switch to turn AI features off for the organisation is described.","status":"not_published","url":"https://www.getmoss.com/pricing","locator":"Pricing page, module descriptions; security and legal pages (no AI control found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"No list price published. Moss charges a platform fee plus a fee based on the transaction volume you expect each month; the site directs buyers to book an intro call.","status":"not_published","url":"https://www.getmoss.com/pricing","locator":"Pricing page, 'How our plans work' FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""}]}]},{"slug":"motion","name":"Motion","vendor":"NexusBird, Inc. (d/b/a Motion), San Francisco, California","category":"research-forms-and-storage","plans":[{"id":"T635","plan":"Business AI","tier":"business","price":{"label":"$29 / user / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Privacy Policy lists training machine learning algorithms as a use of collected information, and the Master Subscription Agreement allows anonymised service data for ML training. The security page's no-training promise does not override this.","status":"verified","url":"https://www.usemotion.com/legal/privacy-policy","locator":"2. How we use your information","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Training and developing machine learning algorithms, and identification of industry trends and developments, and anonymous benchmarking;"},{"key":"training_opt_out","value":"None described: the Privacy Policy and Master Subscription Agreement permit machine learning training and offer no setting or request to stop it.","status":"not_published","url":"https://www.usemotion.com/legal/privacy-policy","locator":"Searched Privacy Policy, Terms of Service, MSA, security page for an opt-out of training: none found","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Motion does not—and never will—train AI models using your data."},{"key":"eu_residency_option","value":"No. The security page says data is not stored in the EU and it is not possible to request EU-only storage.","status":"verified","url":"https://www.usemotion.com/security","locator":"Security page > Data hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is not stored in the European Union, and at this time unfortunately it is not possible to request your data to only be stored in the European Union."},{"key":"default_data_location","value":"United States: customer data is stored on Google Cloud Platform in the Central-1 region, in Iowa.","status":"verified","url":"https://www.usemotion.com/security","locator":"Security page > Data hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is stored in Google’s Central-1 region, based in Iowa."},{"key":"dpa","value":"Not found. The MSA says Motion processes personal data for the customer (Customer as controller) but no separate DPA or SCC document was found.","status":"not_published","url":"https://www.usemotion.com/legal/master-subscription-agreement","locator":"MSA Section 7 Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer determines the purpose and means of processing such Personal Data, and Motion processes such information on behalf of Customer."},{"key":"subprocessor_list","value":"Yes: public list at https://www.usemotion.com/legal/subprocessors (last updated April 29, 2025), 22 entries, all in the United States. Only OpenAI is named as an AI provider; Google Cloud Platform is listed as compute.","status":"verified","url":"https://www.usemotion.com/legal/subprocessors","locator":"Motion Subprocessors table","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Motion may engage third-party service providers to assist in providing our Services"},{"key":"dpf_status","value":"No listing found for search term 'NexusBird'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'NexusBird' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal information is kept for the life of the account and up to one year after deletion unless earlier deletion is requested, then deleted or de-identified from active systems and backups. LLM inputs and outputs are held briefly for debugging.","status":"verified","url":"https://www.usemotion.com/legal/privacy-policy","locator":"Privacy Policy > Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain personal information for the duration of your account and for up to one year after an account is deleted, unless you request earlier deletion."},{"key":"certifications","value":"1 named: SOC 2 Type II (audited by Prescient Assurance).","status":"verified","url":"https://www.usemotion.com/security","locator":"Security page > SOC 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"NexusBird, Inc (dba Motion) successfully completed the AICPA Service Organization Control (SOC) 2 Type II audit."},{"key":"admin_ai_controls","value":"Not stated. The Business AI plan has Permissions & Access Control, but no admin switch for AI features is described.","status":"not_published","url":"https://www.usemotion.com/pricing","locator":"Pricing page, Business AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Permissions & Access Control Central Billing Priority Support"},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: Business AI is $29 per seat/month (monthly vs annual billing toggle state not readable; annual saves 33%).","status":"not_published","url":"https://www.usemotion.com/pricing","locator":"Pricing page, Teams > Business AI card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business AI For power users and businesses with complex needs This plan is not available $ 29 /seat /mo"}]}]},{"slug":"mural","name":"Mural","vendor":"Tactivos, Inc. d/b/a Mural","category":"workspace-and-projects","plans":[{"id":"T466","plan":"Business","tier":"business","price":{"label":"$17.99 / user / mo","amount":17.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Mural does not use your content, or let others use it, to improve, train or develop machine-learning models. It may use anonymised, de-identified AI inputs to analyse usage and improve the AI features.","status":"verified","url":"https://www.mural.co/terms/ai-features","locator":"AI Addendum, 2. Customer Content, Ownership and Use","url2":"https://www.mural.co/ai","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mural does not use your Content or permit others to use your Content to improve, train, or develop any machine learning models."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train on customer content.","status":"verified","url":"https://www.mural.co/terms/ai-features","locator":"AI Addendum, 2. Customer Content, Ownership and Use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mural does not use your Content or permit others to use your Content to improve, train, or develop any machine learning models."},{"key":"eu_residency_option","value":"Not on Business: regional data residency is offered to Enterprise plan customers, set per workspace.","status":"verified","url":"https://www.mural.co/trust-and-security","locator":"Trust and security FAQ, Does Mural support data residency?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mural's data residency capabilities enable Enterprise plan customers to designate the region where data is stored."},{"key":"default_data_location","value":"United States, hosted on Microsoft Azure.","status":"verified","url":"https://www.mural.co/trust-and-security","locator":"Trust and security FAQ, Where is Mural data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, Mural customer data is stored in the United States and hosted on Microsoft Azure."},{"key":"dpa","value":"Yes. A Data Processing Addendum is part of the agreement and is incorporated by reference into the Mural agreement; questions go to privacy@mural.co.","status":"verified","url":"https://www.mural.co/terms/data-processing-addendum","locator":"Data Processing Addendum, introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum sets forth the parties’ obligations with respect to the Processing of Personal Data (definitions in the DPA) and is incorporated by reference into the Agreement."},{"key":"subprocessor_list","value":"Yes: https://www.mural.co/terms/subprocessors lists 14 sub-processors (Adobe, Amazon Web Services, Chorus, Databricks, Coresignal, Fivetran, Mandrill/Mailchimp, Microsoft Azure, MongoDB, Salesforce, Twilio Segment, Pendo, Amplitude, New Relic), all in the United States. No AI model provider is named.","status":"verified","url":"https://www.mural.co/terms/subprocessors","locator":"Subprocessors Disclosure table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Azure Cloud Service Provider United States"},{"key":"dpf_status","value":"Active (Tactivos, Inc. DBA MURAL; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Tactivos'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Content is kept during the subscription. After termination Mural may delete it under its standard data retention policies; no number of days is stated in the terms.","status":"verified","url":"https://www.mural.co/terms/terms-of-service","locator":"Terms of Service, 4.5 What happens to your Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"may thereafter, unless legally prohibited, delete any associated Content in our systems or otherwise in our possession or under our control pursuant to our standard data retention policies and procedures."},{"key":"certifications","value":"4 named: SOC 2 Type 2, SOC 3, ISO 27001, ISO 42001; also Microsoft SSPA certified.","status":"verified","url":"https://www.mural.co/trust-and-security","locator":"Trust and security, certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Mural maintains SOC 2 Type 2, SOC 3, ISO 27001, ISO 42001, and other certifications and attestations"},{"key":"admin_ai_controls","value":"Not stated; the Mural AI page says availability may vary by feature or account settings, but no admin switch to turn AI off is described.","status":"not_published","url":"https://www.mural.co/mural-ai","locator":"Mural AI FAQ; AI Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $17.99 per member/month, billed annually (Business plan).","status":"not_published","url":"https://www.mural.co/pricing","locator":"Pricing, Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Collaborate across teams with the security of SSO and unlimited guests"}]}]},{"slug":"murf","name":"Murf Studio","vendor":"Murf Inc.","category":"phone-and-voice","plans":[{"id":"T423","plan":"self-serve","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for self-serve plans (Terms of Service and privacy policy are silent); only the Master Service Agreement for signed order-form customers says use of customer data excludes training Murf's or other AI models","status":"not_published","url":"https://murf.ai/resources/terms_of_service/","locator":"Section 3.1 Your License to the Service; privacy policy; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated for self-serve plans: no opt-out setting or email described","status":"not_published","url":"https://murf.ai/resources/terms_of_service/","locator":"Terms of Service, privacy policy, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No: Murf says it does not store or replicate customer data outside AWS US-East-2 (Ohio)","status":"verified","url":"https://murf.ai/security","locator":"Data Residency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Murf does not replicate or store Customer Data outside of the US-East-2 region"},{"key":"default_data_location","value":"United States: all customer data is stored and processed on AWS in Ohio (US-East-2)","status":"verified","url":"https://murf.ai/security","locator":"Data Residency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Murf securely stores and processes all Customer Data within the United States, leveraging Amazon Web Services (AWS) cloud infrastructure."},{"key":"dpa","value":"Not stated: no data processing agreement found for self-serve plans (none linked in Terms, privacy policy, GDPR policy or security page)","status":"not_published","url":"https://murf.ai/legal","locator":"Legal Hub, GDPR policy, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes, public: https://murf.ai/legal/sub-processors (last updated 30/01/2025): 21 third-party entries plus 1 affiliate (Murf Software Solutions Private Limited, India). AI-related: OpenAI, Google (Gen AI, text to speech), Microsoft (Azure speech), AssemblyAI, IBM, Lambda Labs, AWS","status":"verified","url":"https://murf.ai/legal/sub-processors/","locator":"Third Party Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Murf engages the following entities to provide processing activities for Customer Data."},{"key":"dpf_status","value":"Active (Murf Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Murf'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data, including projects, media and text, is permanently deleted within 30 days of account termination, except what is kept for legal duties, security or fraud prevention. You can delete content or request deletion at any time; backups clear after a short delay.","status":"verified","url":"https://murf.ai/resources/privacy_policy/","locator":"Account Closure","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We permanently delete account information, including any project, media or text information uploaded by you, within 30 days of account termination, except as noted below."},{"key":"certifications","value":"3 named: ISO 42001, ISO 27001, SOC 2 Type II (also states GDPR and CCPA compliance)","status":"verified","url":"https://murf.ai/security","locator":"Compliance section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are ISO 42001, ISO 27001, SOC 2 Type II, CCPA and GDPR compliant, and we undergo regular third-party audits"},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide AI feature switch described","status":"not_published","url":"https://murf.ai/security","locator":"Security page, Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Pricing page is JavaScript-only and could not be read by server fetch","status":"not_captured","url":"https://murf.ai/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"n8n","name":"n8n Cloud","vendor":"n8n","category":"automation","plans":[{"id":"T23","plan":"Pro","tier":"business","price":{"label":"€50 / mo","amount":50,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. n8n will not use customer content or output to train ML models; aggregated, de-identified usage data and prompts may be used to improve its AI services","status":"verified","url":"https://n8n.io/legal/ai-terms/","locator":"AI Terms s.1.3-1.4 (updated 6 Jul 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: n8n's AI terms say it will not use customer content or output to train any ML models. It may use aggregated, de-identified usage data and prompts to improve its AI services","status":"verified","url":"https://n8n.io/legal/ai-terms/","locator":"AI terms, customer content clause (a) and the usage-data clause","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default for hosted plans","status":"verified","url":"https://n8n.io/pricing/","locator":"FAQ 'Where is my data stored?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"EU: hosted plans store data on servers in Frankfurt, Germany","status":"verified","url":"https://n8n.io/pricing/","locator":"FAQ 'Where is my data stored?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Self-serve terms (updated 28 Aug 2026) apply n8n's DPA; a pre-signed copy is available to countersign","status":"verified","url":"https://n8n.io/legal/self-serve-terms/","locator":"Section 2.8","url2":"https://n8n.io/legal/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public (updated 22 Sep 2026): 8 third parties in the main table (Azure hosting in the EU; AI from OpenAI, Anthropic, LangChain, Daytona, Modal, Google, Baseten) plus 8 'n8n Gateway' sub-processors, including Moonshot AI (Singapore) and Alibaba Qwen (EU)","status":"verified","url":"https://n8n.io/legal/sub-processors/","locator":"Sub-processor table and 'n8n Gateway sub-processors' table","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, n8n GmbH, Berlin)","status":"verified","url":"https://n8n.io/legal/self-serve-terms/","locator":"Parties","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"For AI features, n8n keeps no customer content beyond processing and delivering the output. No retention period for workflow execution data on Cloud Pro is published; Pro shows 7 days of insights, and extended data retention is an Enterprise feature","status":"verified","url":"https://n8n.io/legal/ai-terms/","locator":"AI terms clause (b) on retention","url2":"https://n8n.io/pricing/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Annual SOC 2 audit: the SOC 2 report goes to Enterprise customers, others can download the SOC 3 report. No ISO certification listed","status":"verified","url":"https://n8n.io/legal/security/","locator":"Sections 'SOC 2 report' and 'SOC 3 report'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Instance owners and admins can stop sending actual workflow data to the n8n AI assistant (Settings > AI Usage), which also turns off the AI Workflow builder for everyone","status":"verified","url":"https://docs.n8n.io/manage-cloud/ai-assistant/","locator":"Section on AI usage settings ('Send actual data values')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 50 per month billed annually (per account, 10,000 executions)","status":"verified","url":"https://n8n.io/pricing/","locator":"Pro card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"nele-ai","name":"nele.ai","vendor":"GAL Digital GmbH (nele.ai)","category":"assistants","plans":[{"id":"T332","plan":"usage-based credit subscription","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. nele.ai says all available AI models contractually guarantee that customer data is not used to train future models, and that even local, dedicated models are not trained on customer data.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'No training data for LLMs'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All available AI models contractually guarantee that your data will not be used to train future models."},{"key":"training_opt_out","value":"Nothing to do: the vendor states customer data is not used to train models, and no setting is needed.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'No training data for LLMs'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Even with local, dedicated models, no training is performed using your data."},{"key":"eu_residency_option","value":"Yes. Customers choose whether AI models run on European servers, international servers, or (for some models) their own server environment. Storage is in Germany.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'Self-determination'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can decide whether you want to run AI models on European servers, international servers, or, for certain large language models, within your own server environment."},{"key":"default_data_location","value":"Germany. Inputs, chats and knowledge bases are stored only on servers in Germany.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page FAQ, 'What happens to my data?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data, including your inputs, chats, and knowledge bases, is stored exclusively on servers located in Germany."},{"key":"dpa","value":"Yes. A data processing agreement (AVV) is published at nele.ai/avv and takes effect when signed or concluded electronically; technical and organisational measures are in section 6. It is published in German.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'Data Processing' under Data Protection Standard","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In our DPA, we contractually define how we process and protect your data. You can find all technical and organizational measures (TOMs) in Section 6."},{"key":"subprocessor_list","value":"Yes: a list is published in the DPA annex at nele.ai/avv (German). 14 entries counted, including AI and model providers Azure OpenAI, OpenAI, Anthropic, Google Gemini, Mistral AI, Scaleway Generative APIs, Brave Search API and ElevenLabs.","status":"verified","url":"https://www.nele.ai/avv","locator":"AVV, 'Anhang: Unterauftragsverarbeiter'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Auftragsverarbeiter setzt die folgenden Unterauftragsverarbeiter im Rahmen der Verarbeitung von Daten für den Auftraggeber ein:"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, GAL Digital GmbH, Hungen, Germany)","status":"verified","url":"https://nele.ai/en/imprint","locator":"Legal Notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GAL Digital GmbH\nUnter den Linden 26\n35410 Hungen"},{"key":"data_retention","value":"The customer sets how long chats and documents are kept on the German servers and can delete them at any time. After the contract ends, the DPA requires deletion or return of personal data, at the customer's choice.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'Customizable retention periods'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You decide how long your chats and documents remain stored on our German servers."},{"key":"certifications","value":"1: ISO 27001 for its information security management system, certified by TÜV Rheinland.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page, 'No training data for LLMs' and FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our Information Security Management System (ISMS) is certified according to ISO 27001 by TÜV Rheinland."},{"key":"admin_ai_controls","value":"Partly. A central admin account manages users, AI models and knowledge bases. Nothing says an admin can switch AI features off as a whole.","status":"verified","url":"https://nele.ai/en/ai-security","locator":"Security page FAQ, 'Simple integration and secure operation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Users, AI models, and knowledge bases can be conveniently managed via a central administration account."},{"key":"price_eur","value":"From 10.00 EUR per month for 1,000 credits (AI volume), shared by all employees, no per-user fee; 5,000 credits 47.50 EUR, 10,000 credits 90.00 EUR. Net prices plus statutory VAT. Monthly cancellation. Knowledge-base add-on 19.95 EUR per month.","status":"verified","url":"https://nele.ai/en/ai-pricing","locator":"AI pricing, price configurator and footnote","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"*The prices mentioned are net prices plus statutory VAT."}]}]},{"slug":"neuroflash","name":"neuroflash","vendor":"neuroflash GmbH","category":"assistants","plans":[{"id":"T315","plan":"Pro","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No, according to the vendor: pricing-page FAQ says no training of its models with your data. The privacy statement and terms do not mention training.","status":"vendor_statement","url":"https://neuroflash.com/pricing","locator":"FAQ: What happens to my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Servers are located in Germany, we are ISO/IEC 27001:2022 certified, and we process your content exclusively to provide the service. No transfer to third parties, no training of our models with your data."},{"key":"training_opt_out","value":"Nothing to do according to the vendor, which says it does not train its models with your data. No setting is described.","status":"vendor_statement","url":"https://neuroflash.com/pricing","locator":"FAQ: What happens to my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Servers are located in Germany, we are ISO/IEC 27001:2022 certified, and we process your content exclusively to provide the service. No transfer to third parties, no training of our models with your data."},{"key":"eu_residency_option","value":"Storage is in the EU by default. AI queries are processed in the EU and the USA, and no setting to restrict them to the EU is described.","status":"verified","url":"https://neuroflash.com/legal/privacy","locator":"XIII. Server location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We process your AI queries within the neuroflash app in the EU and in the USA on servers of external providers."},{"key":"default_data_location","value":"Personal data is stored in the EU (Google Cloud Platform and Raidboxes, Germany); AI queries are processed in the EU and the USA on external providers' servers, with US providers on the Data Privacy Framework.","status":"verified","url":"https://neuroflash.com/legal/privacy","locator":"XIII. Server location","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"We process your AI queries within the neuroflash app in the EU and in the USA on servers of external providers."},{"key":"dpa","value":"Not published for Pro. The neuroflash B2B page mentions a custom DPA only under the Enterprise plan; no DPA was found in the public terms or privacy statement.","status":"not_published","url":"https://neuroflash.com/legal/privacy","locator":"Looked at neuroflash.com/terms, /legal/privacy, German Datenschutz page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found. Privacy statement names Google Cloud Platform, Raidboxes, HubSpot, Usercentrics and Stape; AI providers are not named.","status":"not_published","url":"https://neuroflash.com/legal/privacy","locator":"Looked at privacy statement, terms, legal page, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, neuroflash GmbH, Hamburg)","status":"verified","url":"https://neuroflash.com/legal/","locator":"Legal notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"neuroflash GmbH Managing Director: Dr. Jonathan Taddäus Mall (LinkedIn) Wulfsdorfer Weg 100 22359 Hamburg, Germany"},{"key":"data_retention","value":"No period stated for content. The privacy statement says data is deleted once the purpose no longer applies, subject to legal retention.","status":"not_published","url":"https://neuroflash.com/legal/privacy","locator":"Looked at privacy statement and terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022 (1 certification), claimed on the pricing page.","status":"vendor_statement","url":"https://neuroflash.com/pricing","locator":"FAQ: What happens to my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Servers are located in Germany, we are ISO/IEC 27001:2022 certified, and we process your content exclusively to provide the service. No transfer to third parties, no training of our models with your data."},{"key":"admin_ai_controls","value":"Not stated; Pro lists workspace roles and team invitations, with no switch for AI features.","status":"not_published","url":"https://neuroflash.com/pricing","locator":"Looked at pricing comparison and privacy statement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"84 EUR per user per month, billed annually, plus VAT.","status":"verified","url":"https://neuroflash.com/pricing","locator":"Compare plans, Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro 84€/ month per user billed annually · plus VAT"}]}]},{"slug":"nextcloud-assistant","name":"Nextcloud Assistant","vendor":"Nextcloud GmbH","category":"workspace-and-projects","plans":[{"id":"T465","plan":"Nextcloud Enterprise, Ultimate","tier":"enterprise","price":{"label":"€204.75 / user / yr","amount":204.75,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Nextcloud itself. Nextcloud says the Assistant works with models you choose; with an on-premises model, data stays local and is not used to train new AI models. Its trusted European AI-as-a-Service partners do not train on customer data.","status":"not_published","url":"https://nextcloud.com/assistant/","locator":"Assistant page, Ultimate control and Trusted SaaS options","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The on-premises solution guarantees data stays local and is not leaked to third parties through training of new AI models."},{"key":"training_opt_out","value":"Not stated: Nextcloud describes no training setting. Protection comes from the model the customer connects: an on-premises model keeps data local, and its European AI-as-a-Service partners say they do not leak data through training.","status":"not_published","url":"https://nextcloud.com/assistant/","locator":"Assistant page, Ultimate control","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The on-premises solution guarantees data stays local and is not leaked to third parties through training of new AI models."},{"key":"eu_residency_option","value":"Yes by design: the customer chooses where the server runs, including a server in their own country; the compliance page says to keep the server location in your country.","status":"verified","url":"https://nextcloud.com/compliance/","locator":"Compliance page, legal compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Legal compliance: Federal data protection and GDPR-compliant, protecting data sovereignty, keep the server location in your country."},{"key":"default_data_location","value":"Wherever the customer (or the hosting partner they pick) runs the server: Enterprise is installed on the customer's own infrastructure, so Nextcloud has no default region.","status":"verified","url":"https://nextcloud.com/compliance/","locator":"Compliance page, hosting responsibility","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The actual compliance with regulations depends on the hosting solution used for Nextcloud Enterprise."},{"key":"dpa","value":"Not needed in the usual setup: Nextcloud says Nextcloud GmbH has no access to customer data in self-hosted Enterprise, so no data processor agreement is required. A DPA would apply to a hosted setup, but none is published.","status":"verified","url":"https://nextcloud.com/compliance/","locator":"Compliance page, GDPR","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Nextcloud is fundamentally designed so that Nextcloud GmbH does not have any access to customer data, removing the need for a data processor or controller agreement"},{"key":"subprocessor_list","value":"No sub-processor list: Nextcloud GmbH does not process customer data in self-hosted Enterprise. The Assistant page names optional model back ends: Deutsche Telekom, IONOS, OVHcloud, plusserver, OpenAI and Gemini (customer's choice).","status":"not_published","url":"https://nextcloud.com/assistant/","locator":"Assistant page, Back-end options for Nextcloud Assistant","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Nextcloud GmbH, Stuttgart, Germany)","status":"verified","url":"https://nextcloud.com/privacy/","locator":"Entity line","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Nextcloud GmbH (hereinafter collectively referred to as “the controller” or “Nextcloud” or “we” or “us”) as the operator of this website"},{"key":"data_retention","value":"Not stated for Assistant prompts or content. Because Enterprise is self-hosted, the customer decides retention on their own server.","status":"not_published","url":"https://nextcloud.com/assistant/","locator":"Assistant, compliance and privacy pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Compliance page shows 7 badges: PCI DSS, ANSSI CSPN, Blauer Engel, ISO/IEC 27001, BSI C5, REUSE, OpenSSF Best Practices. It adds that Enterprise can only be certified together with a deployment, and Nextcloud Files is CSPN-certified.","status":"verified","url":"https://nextcloud.com/compliance/","locator":"Compliance page, certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As we do not operate Nextcloud Enterprise for our customers nor control how they use it, as a on-premises hosted solution, Nextcloud Enterprise can only be certified as a whole in combination with a deployment."},{"key":"admin_ai_controls","value":"Yes: AI features are optional and only run if an administrator installs the separate AI apps and connects a model back end; for example Mail's AI text processing is switched on under Administration settings > Groupware > Mail.","status":"verified","url":"https://docs.nextcloud.com/server/latest/admin_manual/ai/overview.html","locator":"Admin manual: Artificial Intelligence, Overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All of these features are completely optional. If you want to have them on your server, you need to install them via separate Nextcloud Apps."},{"key":"price_eur","value":"€204.75 per user per year for Ultimate, minimum 100 users, sold by quote (no self-serve purchase). VAT treatment not shown.","status":"verified","url":"https://nextcloud.com/pricing","locator":"Enterprise pricing table, Ultimate column","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Starting at 100 users for 204.75€/user/year"}]}]},{"slug":"nitro-pdf","name":"Nitro PDF","vendor":"Nitro Software, Inc.","category":"documents-hr-and-finance","plans":[{"id":"T584","plan":"Standard","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Nitro says your inputs are never used to train OpenAI or other generative AI models; Nitro builds no models of its own.","status":"verified","url":"https://www.gonitro.com/security-compliance/artificial-intelligence","locator":"Data privacy and security at Nitro: Nitro's Document Assistant","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data is not used for training generative AI: Your inputs are never used to train OpenAI LLMs or other generative AI models."},{"key":"training_opt_out","value":"Nothing to do: Nitro states it does not use customer inputs to train generative AI models. Document Assistant itself is opt-in for larger organisations.","status":"verified","url":"https://www.gonitro.com/security-compliance/artificial-intelligence","locator":"Data privacy and security at Nitro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your inputs are never used to train OpenAI LLMs or other generative AI models."},{"key":"eu_residency_option","value":"Not stated how a customer selects a region; the sub-processor list shows EU, US and Australian data centres for hosting, and the AI processing on Azure in EU and US.","status":"not_published","url":"https://www.gonitro.com/security-compliance/data-protection/subprocessors-and-subcontractors","locator":"Nitro PDF sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; Nitro PDF is hosted on Amazon Web Services with data centres in the EU, US and Australia, and no default region is named.","status":"not_published","url":"https://www.gonitro.com/security-compliance/compliance","locator":"Data Center Security table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. An EU Data Processing Addendum applies to business customers and forms part of the Terms of Service as a single agreement; Order Forms are signed for the services.","status":"verified","url":"https://www.gonitro.com/legal/pdf-sign/data-processing-addendum/eu","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum supplements and forms part of the Terms of Service, and together the Terms of Service and this Data Processing Addendum constitute a single legal agreement"},{"key":"subprocessor_list","value":"Yes, public list at https://www.gonitro.com/security-compliance/data-protection/subprocessors-and-subcontractors: 18 sub-processors for Nitro PDF. AI providers: Microsoft Azure (OpenAI hosted on Azure) and Amazon Comprehend (form and table extraction).","status":"verified","url":"https://www.gonitro.com/security-compliance/data-protection/subprocessors-and-subcontractors","locator":"Nitro PDF - All sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Nitro uses certain sub-processors to provide services to its customers."},{"key":"dpf_status","value":"Active (Nitro Software; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Nitro Software'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"AI Document Assistant: documents are processed temporarily and deleted when the task finishes. Other data is kept until you delete it or the contract ends, plus up to 30 days; you can have data deleted or returned at contract end.","status":"verified","url":"https://www.gonitro.com/security-compliance/artificial-intelligence","locator":"Data privacy and security at Nitro: Nitro's Document Assistant","url2":"https://www.gonitro.com/legal/pdf-sign/data-processing-addendum/eu","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Documents are processed temporarily for the requested task and deleted once the task is complete."},{"key":"certifications","value":"SOC 2 Type 2 and ISO 27001:2022 are certified for Nitro PDF; HIPAA/HiTrust is assessed. 2 certifications (plus DPF participation and QTSP accreditation for Nitro Sign).","status":"verified","url":"https://www.gonitro.com/security-compliance/compliance","locator":"Compliance across Nitro solutions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We undergo independent third-party audits and maintain internationally recognized certifications, including ISO 27001, SOC 2, HIPAA, QTSP accreditation, and Data Privacy Framework certification"},{"key":"admin_ai_controls","value":"Partly: Document Assistant requires opt-in for larger organisations, so it is not on by default. The pages do not describe an admin switch to turn it off afterwards.","status":"verified","url":"https://www.gonitro.com/security-compliance/artificial-intelligence","locator":"FAQ: Responsible AI at Nitro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Document Assistant is enabled for individual online purchasers and requires opt-in for larger organizational users."},{"key":"price_eur","value":"Not captured: the Nitro PDF Standard price (per user/month, billed annually) loads with JavaScript and is blank in the page text.","status":"not_captured","url":"https://www.gonitro.com/pricing","locator":"Nitro PDF Standard card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"noota","name":"Noota","vendor":"NOOTA (Toulouse, France)","category":"meetings-and-notes","plans":[{"id":"T401","plan":"Business","tier":"business","price":{"label":"$39 / mo","amount":39,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No: Noota says conversations are not used to train its models or anyone else's, on any plan including Free.","status":"verified","url":"https://noota.io/security","locator":"Three things we never do - Never train","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your conversations are not used to train our models, or anyone else's, on any plan including Free."},{"key":"training_opt_out","value":"Nothing to do: Noota states it does not train on customer content on any plan.","status":"verified","url":"https://noota.io/security","locator":"FAQ: Is my data used to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your recordings, transcripts, emails and metadata are never used to train any model, ours or our providers'."},{"key":"eu_residency_option","value":"Yes by default: EU customer data stays in the EU. A stricter sovereign environment (Scaleway in Paris, European sub-processors only) is an Enterprise option, not part of Business.","status":"verified","url":"https://noota.io/security","locator":"Hosting: Sovereign","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The sovereign environment is an Enterprise option: hosting on Scaleway in Paris and on Bleu, a SecNumCloud trusted cloud, with Mistral and open-weight models."},{"key":"default_data_location","value":"For EU customers: data centres in Belgium and the Netherlands, on Google Cloud Platform.","status":"verified","url":"https://noota.io/security","locator":"FAQ: Where is my data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For EU customers, in data centres in Belgium and the Netherlands, on Google Cloud Platform."},{"key":"dpa","value":"Yes, a DPA exists and is shared through Noota's Trust Center after a quick review by Noota; the page does not tie it to a particular plan.","status":"verified","url":"https://noota.io/security","locator":"FAQ: How do I get the security documentation","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Request access in the trust center: the ISO 27001 certificate, the penetration testing reports, the security assurance plan, the policies, the DPA and the AI Act analysis are shared after a quick review by our team."},{"key":"subprocessor_list","value":"Yes, public: 7 providers on the security page and in the trust centre (https://trust.noota.io/): Google Cloud Platform, Scaleway, Mistral AI (language models), Gladia (transcription), Recall, Brevo, Bastion Technologies. Page also names Claude, Gemini via Vertex AI.","status":"verified","url":"https://noota.io/security","locator":"Sub-processors: Seven providers, all hosted in Europe","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The live list is published in the trust center, with update notifications."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, NOOTA, Toulouse, France)","status":"verified","url":"https://noota.io/terms","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"NOOTA, located at 13 Rue Sainte Ursule 31000 Toulouse and registered with the Registre du Commerce et des Sociétés de Toulouse under the number 888965951"},{"key":"data_retention","value":"Any meeting can be deleted at any time and is erased from production and backups within 24 hours. Admin-set retention (1 day to 3 years) is for Enterprise; Business has unlimited storage. Free accounts archive after 30 days. All data is purged when the contract ends.","status":"verified","url":"https://noota.io/security","locator":"FAQ: Can I delete my data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Delete any meeting at any time: it is erased from production and backups within 24 hours, with no delayed copies."},{"key":"certifications","value":"ISO 27001 certified and SOC 2 Type II. The trust centre says it publishes 6 compliance certifications in total; only the ISO 27001 certificate is listed by name, and certificates are request-only.","status":"verified","url":"https://trust.noota.io/","locator":"FAQ: Does Noota have ISO 27001 certification?","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Yes. Noota is ISO 27001 certified."},{"key":"admin_ai_controls","value":"Partly: admins can switch sentiment analysis off for the whole organisation, and users or admins can turn Noota off for specific meetings. No single switch for all AI features is described. Business adds 'admin controls'.","status":"verified","url":"https://noota.io/security","locator":"Controls: User privacy controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Administrators can switch sentiment analysis off for the whole organisation."},{"key":"price_eur","value":"Not shown in euros in the page text: Business is 39 per user per month billed annually (49 if billed monthly). The page's meta description gives it as $39/month; a EUR/USD toggle exists but the saved text carries no currency symbol.","status":"not_published","url":"https://noota.io/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"notion","name":"Notion","vendor":"Notion","category":"workspace-and-projects","plans":[{"id":"T08","plan":"Business","tier":"business","price":{"label":"€19.50 / user / mo","amount":19.5,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Notion and its AI sub-processors do not train on customer data by default; LLM providers keep data up to 30 days outside Enterprise","status":"verified","url":"https://www.notion.com/help/notion-ai-security-practices","locator":"Help page (undated)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Notion and its AI sub-processors do not train on customer data by default","status":"verified","url":"https://www.notion.com/help/notion-ai-security-practices","locator":"Security practices summary and data-use section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Business. Enterprise only (Frankfurt or Ireland); excludes account and usage data, sub-processor processing, Calendar, Mail and beta features","status":"verified","url":"https://www.notion.com/help/data-residency","locator":"Eligibility and exclusions","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States","status":"verified","url":"https://www.notion.com/help/data-residency","locator":"Help page (undated)","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA effective 14 Aug 2026 forms part of the Master Subscription Agreement with Notion Labs, Inc.","status":"verified","url":"https://notion.notion.site/Data-Processing-Addendum-361b540101274b1fa7e16b90402b0d99","locator":"Header and section 1.2","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 26 third-party entries; 9 host AI models (Anthropic, OpenAI, Google, Fireworks, Baseten, Modal, Cerebras, xAI, Parallel), most listed as Global or USA; email sign-up for notices, 10-day objection window","status":"verified","url":"https://notion.notion.site/Notion-s-List-of-Subprocessors-268fa5bcfa0f46b6bc29436b21676734","locator":"Infrastructure, Platform, Customer and Support Services tables","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active, re-certification under review (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Notion Labs'","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On Business, the AI provider keeps data for 30 days or fewer, then deletes it. Deleted pages can be restored for 30 days, then are permanently deleted; embeddings go within 60 days","status":"verified","url":"https://www.notion.com/help/notion-ai-security-practices","locator":"Section 'How your Data is Protected and Retained' and 'Deleting and Restoring your Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Notion AI is in scope of Notion's SOC 2 Type 2 report and ISO 27001 certification","status":"verified","url":"https://www.notion.com/help/notion-ai-security-practices","locator":"Section 'Compliance and Certifications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Owners can turn off web search and image generation, choose which AI models the team can use, cap credit spend and set AI Meeting Notes options; the help centre describes no single switch that removes Notion AI from a Business workspace","status":"verified","url":"https://www.notion.com/help/notion-ai-faqs","locator":"List under 'Workspace owners on any Notion plan can go to Settings → Notion AI'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 19.50 per member/month billed annually; EUR 23.50 billed monthly","status":"verified","url":"https://www.notion.com/de/pricing","locator":"Business card, annual and monthly toggles","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"notta","name":"Notta","vendor":"Notta","category":"meetings-and-notes","plans":[{"id":"T65","plan":"Business","tier":"business","price":{"label":"$16.67 / user / mo","amount":16.67,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. Notta's privacy policy and help centre do not say whether recordings or transcripts are used to train AI models; they say only that Google Workspace data is not used for training and that files are transcribed by machines, not read by people","status":"not_published","url":"https://www.notta.ai/en/privacy","locator":"Full privacy policy (effective 2 Sep 2025)","url2":"https://support.notta.ai/hc/en-us/articles/4403031459355-Data-security-and-privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not described: no training setting or opt-out is documented","status":"not_published","url":"https://support.notta.ai/hc/en-us/articles/18548578499355-Security-Privacy","locator":"Security & Privacy settings list","url2":"https://www.notta.ai/en/privacy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://support.notta.ai/hc/en-us/articles/4403031459355-Data-security-and-privacy-policy","locator":"Section 'Data Storage and Security'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Japan: data is stored in an AWS data centre in Tokyo","status":"verified","url":"https://support.notta.ai/hc/en-us/articles/4403031459355-Data-security-and-privacy-policy","locator":"Section 'Data Storage and Security'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Not found. Neither the terms of service nor the privacy policy mention a data processing agreement, and no DPA page is published","status":"not_published","url":"https://www.notta.ai/en/terms","locator":"Terms of Service (effective 2 Sep 2026)","url2":"https://www.notta.ai/en/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list. The privacy policy names only Stripe (payments) and AWS appears in the help centre","status":"not_published","url":"https://www.notta.ai/en/privacy","locator":"Sections on payment details and sharing","url2":"https://www.notta.ai/en/security","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (vendor in Japan; the DPF covers US organisations). Search 'Notta' returned no results","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Notta' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Files stay until deleted; deleted files are removed from the Trash after 30 days. Workspace-wide auto-deletion is an Enterprise feature","status":"verified","url":"https://support.notta.ai/hc/en-us/articles/18548578499355-Security-Privacy","locator":"Section 'Auto Deletion'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II and ISO 27001; Notta also lists GDPR, CCPA, APPI and HIPAA compliance","status":"verified","url":"https://www.notta.ai/en/security","locator":"Compliance section","url2":"https://support.notta.ai/hc/en-us/articles/18548578499355-Security-Privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly. Business owners can block public sharing, hide the member list, lock email changes and restrict access by IP address; disabling AI features is Enterprise only","status":"verified","url":"https://support.notta.ai/hc/en-us/articles/18548578499355-Security-Privacy","locator":"Section 'Features Restriction' and 'IP restrictions'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 16.67 per seat/month, billed annually (USD 199.99 per seat per year)","status":"not_published","url":"https://www.notta.ai/en/pricing","locator":"Plan card 'Business'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"omnisend","name":"Omnisend","vendor":"Omnisend, UAB","category":"sales-marketing-and-support","plans":[{"id":"T516","plan":"Standard","tier":"business","price":{"label":"$11.20 / mo","amount":11.2,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The AI Features terms cover ownership of AI input and output and mention third-party AI providers, but say nothing about model training.","status":"not_published","url":"https://www.omnisend.com/terms/","locator":"11. AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training opt-out described.","status":"not_published","url":"https://www.omnisend.com/terms/","locator":"11. AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no setting to pin data to the EU found. The privacy policy says processing is normally within the EEA.","status":"not_published","url":"https://www.omnisend.com/privacy/","locator":"Privacy policy section 5; DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Mostly inside the EEA: Omnisend says it normally processes personal data within the EEA; hosting is on Google Cloud Platform, region not named.","status":"verified","url":"https://www.omnisend.com/privacy/","locator":"5.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We normally process Personal Data within the EEA, but in some cases your Personal Data may be transferred outside the EEA."},{"key":"dpa","value":"Yes, published DPA is part of the agreement: it is subject to the terms and takes precedence over them on personal data; includes EU Standard Contractual Clauses.","status":"verified","url":"https://www.omnisend.com/data-processing-agreement/","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Agreement (the “DPA”) reflects the Parties’ agreement with respect to the terms governing the Processing of Customer Personal Data"},{"key":"subprocessor_list","value":"Yes, Annex III of the DPA (https://www.omnisend.com/data-processing-agreement/): 17 entries. No AI model provider is named; Vercel Inc. is listed for development of internal AI-powered analytics tools.","status":"verified","url":"https://www.omnisend.com/data-processing-agreement/","locator":"Annex III - List of Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Omnisend has authorized the use of the following Sub-Processors:"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Omnisend, UAB, Vilnius, Lithuania)","status":"verified","url":"https://www.omnisend.com/terms/","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Omnisend, UAB, legal entity code 302530363, address Verkių g. 25C-1, LT-08223 Vilnius, Republic of Lithuania"},{"key":"data_retention","value":"Personal data is kept no longer than needed for the agreement; at the end of service Omnisend deletes or returns it at the customer's choice and certifies deletion. Accounts inactive for 3 months can be deleted with all data.","status":"verified","url":"https://www.omnisend.com/data-processing-agreement/","locator":"3.1.6 and 4.6.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Customer Personal Data shall be retained for no longer than is necessary to fulfill its obligations under the Agreement"},{"key":"certifications","value":"Not stated; no ISO 27001 or SOC 2 certification found in the DPA security annex, terms or privacy policy.","status":"not_published","url":"https://www.omnisend.com/data-processing-agreement/","locator":"Annex I Security Measures","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to switch AI features off found. Customers authorise any outside AI agent connection themselves.","status":"not_published","url":"https://www.omnisend.com/terms/","locator":"11.6","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in euros. Shown in USD only: Standard $11.20 per month billed monthly (500 contacts) with a 30% discount for the first 3 months; the page shows $48.00 for 3 months before the discount, about $16 per month.","status":"not_published","url":"https://www.omnisend.com/pricing/","locator":"Standard plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"After 3 months, you will be billed monthly"}]}]},{"slug":"onedrive-microsoft-365","name":"OneDrive for Business","vendor":"Microsoft Corporation (Microsoft 365)","category":"research-forms-and-storage","plans":[{"id":"T641","plan":"Plan 1","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for OneDrive itself; no AI feature or training clause found on its service description or retention pages. Microsoft says only that Copilot prompts, responses and Graph data are not used to train foundation models.","status":"not_published","url":"https://learn.microsoft.com/en-us/office365/servicedescriptions/onedrive-for-business-service-description","locator":"Pages checked: OneDrive service description; retention and deletion; Copilot enterprise data protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated for OneDrive; no training clause found, so no opt-out is described. For Copilot, Microsoft says nothing needs switching off.","status":"not_published","url":"https://learn.microsoft.com/en-us/office365/servicedescriptions/onedrive-for-business-service-description","locator":"Pages checked: OneDrive service description; retention and deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes. The Product Terms data-residency commitment is open to tenants whose sign-up country is in the EU; country-level residency (e.g. Germany) needs the paid Advanced Data Residency add-on.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-spo","locator":"Data Residency Commitments Available","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tenant has a sign-up country/region included in Local Region Geography, the European Union or the United States."},{"key":"default_data_location","value":"No fixed country: Microsoft ties data-at-rest commitments to the tenant's sign-up country or region (EU, US or a local-region country); the admin centre shows the actual location under Settings > Org Settings > Organization Profile > Data Location.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-spo","locator":"Data Residency Commitments Available; How can I determine customer data location?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tenant has a sign-up country/region included in Local Region Geography, the European Union or the United States."},{"key":"dpa","value":"Yes. OneDrive is a Microsoft Online Service governed by the Microsoft Products and Services Data Protection Addendum, part of Microsoft's standard commercial contract.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"List of subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This list is applicable for all Microsoft Online Services governed by the Microsoft Data Protection Addendum."},{"key":"subprocessor_list","value":"Yes: the Microsoft Online Services Subprocessor List, downloadable via the Trust Center and Service Trust Portal. Entries not counted (document download); AI providers not read.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"List of subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After a subscription ends, Microsoft keeps data in a limited-function account for 90 days, then deletes it within a further 90 days. A deleted user's OneDrive is kept 30 days by default (admins can change this).","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-management","locator":"Data deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft will store your customer data in a limited-function account for 90 days (the “retention period”) to give you time to extract the data or renew your subscription."},{"key":"certifications","value":"Microsoft lists ISO 27001, 27017, 27018, 27701, 42001, 9001 and SOC 1/2/3 (9 standards) among its Microsoft 365 compliance offerings; the page does not say which apply to OneDrive specifically.","status":"verified","url":"https://learn.microsoft.com/en-us/compliance/regulatory/offering-home","locator":"Global","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 27017 ISO 27018 ISO 27701 ISO 42001 ISO 9001 SOC 1 SOC 2 SOC 3"},{"key":"admin_ai_controls","value":"Not stated for the OneDrive plan; the pages read describe no AI feature in OneDrive itself. Copilot (a separate licence) has its own admin controls.","status":"not_published","url":"https://learn.microsoft.com/en-us/office365/servicedescriptions/onedrive-for-business-service-description","locator":"Pages checked: OneDrive service description","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: Microsoft's OneDrive pricing pages return a blocked shell without a browser.","status":"not_captured","url":"https://www.microsoft.com/en-ie/microsoft-365/onedrive/compare-onedrive-plans","locator":"Compare OneDrive plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"openai-codex","name":"OpenAI Codex","vendor":"OpenAI (ChatGPT Business: OpenAI OpCo, LLC; OpenAI Ireland Ltd for EEA customers)","category":"code-and-app-builders","plans":[{"id":"T531","plan":"ChatGPT Business","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per the Codex pricing page: it says there is no training on business data by default. Only the pricing page was readable; the policy and business terms were blocked.","status":"vendor_statement","url":"https://developers.openai.com/codex/pricing","locator":"Plans, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No training on your business data by default."},{"key":"training_opt_out","value":"Nothing to do: the pricing page states business data is not used for training by default; no opt-out step is described.","status":"vendor_statement","url":"https://developers.openai.com/codex/pricing","locator":"Plans, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No training on your business data by default."},{"key":"eu_residency_option","value":"Not offered on Business per the Codex pricing page: 'Data retention and data residency controls' are listed under Enterprise & Edu (on top of Business), not on the Business card. Which regions Enterprise covers was not captured.","status":"vendor_statement","url":"https://developers.openai.com/codex/pricing","locator":"Plans, Enterprise & Edu card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data retention and data residency controls"},{"key":"default_data_location","value":"Not captured: OpenAI's help-centre data and residency pages returned 403 to a non-browser fetch.","status":"not_captured","url":"https://help.openai.com/en/articles/8265053-what-is-chatgpt-business","locator":"Business data help article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not captured: OpenAI's DPA page returned 403 to a non-browser fetch.","status":"not_captured","url":"https://openai.com/policies/data-processing-addendum/","locator":"DPA page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not captured: OpenAI's sub-processor list returned 403 to a non-browser fetch.","status":"not_captured","url":"https://openai.com/policies/sub-processor-list/","locator":"Sub-processor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'OpenAI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'OpenAI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not captured: OpenAI's business-data and help-centre pages returned 403. The Codex Enterprise admin guide says local computer access with Work Cloud does not give strict zero data retention.","status":"not_captured","url":"https://openai.com/enterprise-privacy/","locator":"Enterprise privacy page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Not captured: trust.openai.com returned 403 to a non-browser fetch.","status":"not_captured","url":"https://trust.openai.com","locator":"Trust portal","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for Business in the readable pages. The pricing page lists 'essential admin controls, SAML SSO, and MFA'; the detailed Codex admin guide on model, tool and cloud controls is written for Enterprise.","status":"not_published","url":"https://developers.openai.com/codex/pricing","locator":"Looked in: Plans, Business card; Codex Enterprise admin setup and governance guides","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A secure, dedicated workspace with essential admin controls, SAML SSO,"},{"key":"price_eur","value":"Shown in USD only: Business $20 per user/month billed annually (2+ users), $25 per user/month billed monthly. Codex is included; extra usage is bought as credits.","status":"not_published","url":"https://developers.openai.com/codex/pricing","locator":"Plans, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$20/ user / month*"}]}]},{"slug":"opera-aria","name":"Opera Aria / Opera AI","vendor":"Opera Norway AS","category":"assistants","plans":[{"id":"T311","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Opera; it says chats are not retained by OpenAI or Google but does not mention model training.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Looked at Aria / AI Chat section of Opera Privacy Statement, features/opera-ai, legal/terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training opt-out described. The Google Search Suggestions switch in Aria settings is not a training opt-out.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Aria / AI Chat section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data-location choice for Aria is described.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Aria / AI Chat section; International Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated where Opera's servers holding chats are located. Prompts go to OpenAI or Google (US-based) to generate answers.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Aria / AI Chat section; International Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not published. Consumer browser feature with no business plan; no data processing agreement found.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Looked at privacy statement and legal/terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found. The privacy statement names OpenAI and Google as the AI providers.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Aria / AI Chat section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (Norwegian vendor, Opera Norway AS, Oslo)","status":"verified","url":"https://www.opera.com/legal/privacy","locator":"Data Controller & Internal Processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Opera browsers are developed and published by Opera Norway AS, a company registered under the laws of Norway."},{"key":"data_retention","value":"Chats are kept on Opera servers (encrypted) and deleted after 365 days if logged in, or 30 days if not logged in. Users can delete chats at any time.","status":"verified","url":"https://www.opera.com/legal/privacy","locator":"AI Chat section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The aforementioned data is stored, fully encrypted, on Opera’s servers, and will be automatically deleted after 365 days if you use AI Chat while logged into your Opera Account."},{"key":"certifications","value":"Not published; no security certification named for Aria on the pages read.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Looked at privacy statement and features/opera-ai","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered; consumer browser with no admin console for Aria. Users can switch features on or off themselves.","status":"not_published","url":"https://www.opera.com/legal/privacy","locator":"Aria / AI Chat section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Free, no login or sign-up needed. No paid plan is shown.","status":"verified","url":"https://www.opera.com/features/opera-ai","locator":"Opera AI hero","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Support your ideas with Opera browser’s free and accountless AI."}]}]},{"slug":"opus-clip","name":"Opus Clip","vendor":"Opusclip Inc.","category":"design-images-and-video","plans":[{"id":"T558","plan":"Pro","tier":"business","price":{"label":"$29 / mo","amount":29,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for customer videos. The policy never says content is used for model training, but it offers EU/EEA users an opt-out from use of personal data for 'AI research and model-development'.","status":"not_published","url":"https://www.opus.pro/privacy-policy","locator":"Looked in: Privacy Policy (use of data; Opt-Out & Right to Object to AI Research and Development), Terms of Service (Rights You Grant)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"EU/EEA users only: email contact@opus.pro with the subject 'AI R&D – Opt-Out' and the account email, and OpusClip opts the data out of AI research and model development. No in-app setting is described.","status":"verified","url":"https://www.opus.pro/privacy-policy","locator":"Opt-Out & Right to Object to AI Research and Development","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Under Article 21 GDPR, you may object at any time to such processing. Send an e-mail to contact@opus.pro with the subject line"},{"key":"eu_residency_option","value":"Not offered; data is stored in the United States and EU data is transferred there under standard contractual clauses. No EU storage option is described.","status":"verified","url":"https://www.opus.pro/privacy-policy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you normally reside in the European Region, the personal data that we collect from you will be further transferred to, and stored at, a destination outside of the EEA"},{"key":"default_data_location","value":"United States: OpusClip runs on Google Cloud servers located in the United States.","status":"verified","url":"https://www.opus.pro/privacy-policy","locator":"International transfers / data location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpusClip runs on secure Google Cloud servers located in the United States."},{"key":"dpa","value":"Not stated for customers; the policy says OpusClip signs data protection agreements with its own sub-processors, but no customer DPA is offered on the public pages.","status":"not_published","url":"https://www.opus.pro/privacy-policy","locator":"Looked in: Privacy Policy (Subprocessors), Terms of Service, Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public on the Trust Center (https://trust.opus.pro/subprocessors). Nine are shown: Google, OpenAI, Stripe, Github, Intercom, MongoDB, Redis, WorkOS, Cloudflare. The full 'View all' list was not readable, so the total count is unknown.","status":"not_captured","url":"https://trust.opus.pro/subprocessors","locator":"Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (OpusClip; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Opusclip'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: profile data is kept while the account exists, other data as long as necessary. Closing an account can destroy its content, and the Terms warn it cannot always be fully removed from records.","status":"verified","url":"https://www.opus.pro/terms-of-service","locator":"Termination / account deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Account termination may result in destruction of any Content associated with your account, so keep that in mind before you decide to terminate your account."},{"key":"certifications","value":"2: SOC 2 Type 2 (report on request) and SOC 3; GDPR compliance is also listed on the Trust Center.","status":"verified","url":"https://trust.opus.pro/","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"## Compliance ### SOC 2 Type 2 Request ### SOC 3 ### GDPR"},{"key":"admin_ai_controls","value":"Not stated; the pricing page lists a team workspace but no admin setting to switch AI features off.","status":"not_published","url":"https://www.opus.pro/pricing","locator":"Looked in: Pricing page, Terms of Service, Privacy Policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Pro $29 per month on monthly billing, or $14.50 per month billed annually ($174 a year); includes a team workspace with 2 seats and 300 credits a month.","status":"not_published","url":"https://www.opus.pro/pricing","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"otter","name":"Otter","vendor":"Otter.ai","category":"meetings-and-notes","plans":[{"id":"T38","plan":"Pro","tier":"personal","price":{"label":"$8.33 / user / mo","amount":8.33,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. Otter trains its own models on de-identified recordings and transcripts; only Enterprise workspaces are opted out by default","status":"verified","url":"https://otter.ai/privacy-security","locator":"FAQ 'Do you use recordings and transcriptions to train your models?'","url2":"https://otter.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not published: no opt-out from training is documented for Pro","status":"not_published","url":"https://otter.ai/privacy-security","locator":"FAQ on training","url2":"https://otter.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://otter.ai/privacy-security","locator":"Privacy & Security page","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: AWS is the cloud provider and all listed sub-processors are in the US","status":"verified","url":"https://otter.ai/subprocessors","locator":"Core infrastructure (AWS, United States)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, inside the Terms of Service (Appendix 1, GDPR DPA), which apply to all plans","status":"verified","url":"https://otter.ai/terms-of-service","locator":"Section 18.2 and Appendix 1","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 17 entries, all US (one also in the Philippines and Honduras); AI: Anthropic, OpenAI; effective 31 Mar 2026","status":"verified","url":"https://otter.ai/subprocessors","locator":"Core and other sub-processors","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Otter.ai, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Otter.ai'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Conversations stay until deleted; deleted conversations sit in the Trash for 30 days, or go at once if the Trash is cleared","status":"verified","url":"https://otter.ai/privacy-security","locator":"Paragraph on deleting conversations","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2 report; follows HIPAA requirements; no ISO certificate is claimed","status":"verified","url":"https://otter.ai/privacy-security","locator":"Sections 'SOC 2 TYPE 2' and 'HIPAA'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for Pro: admin controls are documented for Business and Enterprise workspaces","status":"not_published","url":"https://help.otter.ai/hc/en-us/articles/13352505516695-Enterprise-Admin-Controls-Overview","locator":"Overview","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 8.33 per user/month with annual billing ('save 51%')","status":"not_published","url":"https://otter.ai/pricing","locator":"Plan card 'Pro' with annual billing shown","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T17","plan":"Business","tier":"business","price":{"label":"$19.99 / user / mo","amount":19.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: Otter trains its own models on de-identified recordings and transcripts. Enterprise workspaces are opted out by default; no opt-out for Business is documented","status":"verified","url":"https://otter.ai/privacy-policy","locator":"Uses of data (effective 16 Jun 2026)","url2":"https://help.otter.ai/hc/en-us/articles/13352505516695-Enterprise-Admin-Controls-Overview","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"No opt-out is documented for Business: Otter trains its own models on de-identified recordings and transcripts, and only Enterprise workspaces are opted out by default. Imported documents are never used for training","status":"not_published","url":"https://otter.ai/privacy-security","locator":"FAQ 'Do you use recordings and transcriptions to train your models?' and 'Do you use imported customer data…'","url2":"https://otter.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://otter.ai/privacy-security","locator":"Privacy & Security page","url2":"https://otter.ai/subprocessors","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: AWS named as cloud provider; all listed sub-processors in the US","status":"verified","url":"https://otter.ai/subprocessors","locator":"Core infrastructure (AWS, United States)","url2":"https://otter.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, inside the Terms of Service (Appendix 1, GDPR DPA); terms effective 19 Sep 2025; a signing step is referenced but not described","status":"verified","url":"https://otter.ai/terms-of-service","locator":"Section 18.2 and Appendix 1","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 17 entries, all US (one also Philippines and Honduras); AI: Anthropic, OpenAI; effective 31 Mar 2026; changes posted on the page","status":"verified","url":"https://otter.ai/subprocessors","locator":"Core and other sub-processors","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Otter.ai, Inc.; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Otter.ai'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Conversations stay until deleted; deleted conversations sit in the Trash and are removed after 30 days, or at once if the Trash is cleared","status":"verified","url":"https://otter.ai/privacy-security","locator":"Paragraph on deleting conversations","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2 report; follows HIPAA requirements. Security policies are based on the ISO 27001/2 framework, but no ISO certificate is claimed","status":"verified","url":"https://otter.ai/privacy-security","locator":"Sections 'SOC 2 TYPE 2', 'HIPAA' and the frameworks FAQ","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for Business. The workspace admin guide covers members, sharing, security settings and apps; locking notetaker settings and other admin controls are documented for Enterprise","status":"not_published","url":"https://help.otter.ai/hc/en-us/articles/360050540033-Otter-Workspace-Admin-Guide","locator":"Steps 'Configure workspace and security settings' and 'Apps'","url2":"https://help.otter.ai/hc/en-us/articles/13352505516695-Enterprise-Admin-Controls-Overview","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 19.99 per user/month with annual billing","status":"not_published","url":"https://otter.ai/pricing","locator":"Business card ('save 33%')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"outlook-copilot","name":"Outlook with Copilot","vendor":"Microsoft Corporation (Redmond, Washington)","category":"writing-and-email","plans":[{"id":"T375","plan":"Microsoft 365 Business Standard with Copilot","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models behind Copilot.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"How does Microsoft Copilot use your proprietary organizational data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."},{"key":"training_opt_out","value":"Nothing to do: Microsoft states prompts, responses and Graph data are not used to train foundation models. Optional feedback is managed by admins and is not used to train them either.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Feedback and training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don't use this feedback to train the foundation LLMs used by Microsoft Copilot."},{"key":"eu_residency_option","value":"Yes: Copilot is an EU Data Boundary service for EU customers (no extra setting). Anthropic models, if the admin allows them, are excluded from the boundary. Advanced Data Residency and Multi-Geo add in-country commitments.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Microsoft Copilot and the EU Data Boundary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For EU customers, Microsoft Copilot is an EU Data Boundary service."},{"key":"default_data_location","value":"EU customers: stored inside the EU Data Boundary. Outside the EU, queries can be processed in the US, EU or other regions. For EU tenants created after 25 March 2026, flex routing may send inference outside the EU at peak load.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Microsoft Copilot and the EU Data Boundary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing."},{"key":"dpa","value":"Yes. Data processing terms for Microsoft online services are set in the Microsoft Products and Services Data Protection Addendum, which accompanies the Product Terms when you subscribe.","status":"verified","url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","locator":"Microsoft Products and Services Data Protection Addendum (DPA)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA)."},{"key":"subprocessor_list","value":"Yes: the Microsoft Online Services Subprocessor List is published (downloadable via the Trust Center / Service Trust Portal); entries not countable as text. Anthropic and OpenAI are named as AI model subprocessors in Copilot.","status":"verified","url":"https://www.microsoft.com/en-us/trust-center/privacy/data-access","locator":"List of subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services."},{"key":"dpf_status","value":"Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Microsoft Corporation'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Copilot prompts and responses are stored with the organisation's Microsoft 365 data; admins set retention in Microsoft Purview and users can delete their Copilot history. After a subscription ends, data is kept 90 days, then deleted.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Retention and deleting history","url2":"https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot."},{"key":"certifications","value":"Copilot page names ISO 27001 and ISO 42001 certifications plus GDPR and HIPAA compliance (4 items, only 2 are certificates); it also cites ISO/IEC 27018. Audit reports are in the Service Trust Portal.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Meeting regulatory compliance requirements","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems."},{"key":"admin_ai_controls","value":"Yes. Admins choose which agents are allowed and whether Anthropic or OpenAI models are used, and turning off connected experiences that analyze content removes Copilot features in Outlook, Word, Excel and OneNote.","status":"verified","url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","locator":"Third-party models; privacy controls for connected experiences","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"As an admin, you can decide whether to use these models to power your experiences"},{"key":"price_eur","value":"20.36 EUR per user per month, billed annually (auto-renewing yearly subscription), excluding VAT. Includes Copilot in Outlook, Word, Excel, PowerPoint and Teams.","status":"verified","url":"https://www.microsoft.com/de-de/copilot/solutions/business?market=de","locator":"Preise für Microsoft Copilot / Business Standard","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft 365 Business Standard mit Copilot Leistungsstarke Apps auf allen Geräten – mit integriertem Copilot für mehr Kreativität, bessere Zusammenarbeit und höhere Effizienz 20,36 € Benutzer/Monat, jährliche Abrechnung"}]}]},{"slug":"outreach","name":"Outreach","vendor":"Outreach Corporation (Seattle, Washington)","category":"writing-and-email","plans":[{"id":"T372","plan":"Amplify Essentials","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for call transcription: Outreach says its speech-recognition model trains on your content. No general statement found for other features; terms allow aggregated use of customer data to improve the service. Privacy page says customer data is used 'to provide our service and improve our platforms'.","status":"vendor_statement","url":"https://www.outreach.io/platform/sales-ai","locator":"Automated speech recognition","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Outreach's delivers real-time call transcription by using a customized speech recognition model that trains on your content to learn the terms that are important to your business or industry."},{"key":"training_opt_out","value":"Not stated; no opt-out from training on customer content found on the trust, privacy, governance, AI or terms pages.","status":"not_published","url":"https://www.outreach.io/platform/sales-ai","locator":"Our commitment to responsible AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: Outreach says EU citizen data is hosted in the EU for customers with data-residency requirements; how it is switched on and which plan is not described.","status":"verified","url":"https://www.outreach.io/platform/privacy","locator":"Data localization","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We support customers with organizational requirements around data residency, with EU citizen data hosted in the EU."},{"key":"default_data_location","value":"Amazon Web Services, United States & Ireland (primary hosting). Google Cloud (US & Belgium) is used for storage, AI and enrichment.","status":"verified","url":"https://www.outreach.io/sub-processors","locator":"Infrastructure Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. United States & Ireland"},{"key":"dpa","value":"Yes. A Data Processing Agreement is incorporated by reference into the Terms of Service.","status":"verified","url":"https://www.outreach.io/terms","locator":"Your Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"each Party will comply with the obligations set forth in this Data Processing Agreement, which is incorporated by reference into these Terms."},{"key":"subprocessor_list","value":"Yes: https://www.outreach.io/sub-processors, 32 entries (last modified July 13, 2026). AI/model providers listed: Anthropic, OpenAI (platform LLM providers), Google Cloud (Gemini), Microsoft Azure, Databricks (ML/AI models).","status":"verified","url":"https://www.outreach.io/sub-processors","locator":"List of Outreach Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic, PBC Outreach Platform LLM Provider United States"},{"key":"dpf_status","value":"Active (Outreach; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Outreach'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Admins can set retention rules for voice recordings, meeting recordings and emails; admins can process right-to-be-forgotten deletions. No fixed default or post-cancellation deletion period is published.","status":"verified","url":"https://www.outreach.io/platform/governance","locator":"Data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We enforce company policies for retention of Outreach Voice recordings, Meeting recordings, and Emails with flexible configurations based on the length of times data should be stored prior to deletion."},{"key":"certifications","value":"6 named: SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, HIPAA, Cloud Security Alliance STAR.","status":"verified","url":"https://www.outreach.io/platform/trust","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"### SOC 2 Type II ### ISO 27001 ### ISO 27701 ### ISO 42001 ### HIPAA ### Cloud Security Alliance (CSA)"},{"key":"admin_ai_controls","value":"Not stated; governance page describes admin profiles, roles, retention and consent-to-record controls but no switch for AI features.","status":"not_published","url":"https://www.outreach.io/platform/governance","locator":"Governance features at a glance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published. Pricing is by quote only ('Request pricing'); the Essentials package includes 10,000 AI credits. Seat-based plus AI-credit pricing.","status":"not_published","url":"https://www.outreach.io/pricing","locator":"Choose your package / Amplify Essentials","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"parloa","name":"Parloa AI Agent Management Platform","vendor":"Parloa GmbH","category":"phone-and-voice","plans":[{"id":"T414","plan":"enterprise, consumption-based","tier":"enterprise","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No under the current AI Terms (V3, in force since December 2025): Parloa may use your input and output solely to operate and provide the service. The earlier V2 let it use customer data to improve its AI models.","status":"verified","url":"https://a.storyblok.com/f/330303/x/b929373b6e/parloa_group_customeraiterms_v3_2025_en.pdf","locator":"8.2 Intellectual Property Rights","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Output solely to operate, maintain, and provide the"},{"key":"training_opt_out","value":"Nothing to do under the current V3 terms: Parloa may use your input and output solely to operate and provide the service, so there is no training to switch off.","status":"verified","url":"https://a.storyblok.com/f/330303/x/b929373b6e/parloa_group_customeraiterms_v3_2025_en.pdf","locator":"8.2 Intellectual Property Rights","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Output solely to operate, maintain, and provide the"},{"key":"eu_residency_option","value":"Yes: Parloa Zones lets a customer deploy in its own region with customer data staying local (stated on the product page; enterprise).","status":"vendor_statement","url":"https://www.parloa.com/platform/enterprise-security-governance/","locator":"Retain your data in your preferred region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"With Parloa Zones, deploy wherever you operate, with customer data staying local and under your control."},{"key":"default_data_location","value":"Not stated: the site says data residency is built in, chosen per deployment, but no default country or hosting provider is named.","status":"not_published","url":"https://www.parloa.com/platform/enterprise-security-governance/","locator":"Data Sovereignty & GDPR/CCPA Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data location, control, and jurisdiction are built in."},{"key":"dpa","value":"Yes: the GTC say the parties conclude a Data Processing Agreement that is part of the agreement. The DPA text itself is not published.","status":"verified","url":"https://a.storyblok.com/f/330303/x/0499c72658/parloa_gmbh_gtc_v2_2024_en.pdf","locator":"9. Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Processing Agreement (\"DPA\") which is part of"},{"key":"subprocessor_list","value":"Not published on the pages read; the trust centre (trust.parloa.com) returned a block and could not be read.","status":"not_captured","url":"https://trust.parloa.com/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Parloa GmbH, Berlin)","status":"verified","url":"https://a.storyblok.com/f/330303/x/0499c72658/parloa_gmbh_gtc_v2_2024_en.pdf","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"GmbH, Schönhauser Allee 9, 10119 Berlin"},{"key":"data_retention","value":"Not a fixed default: the site says retention policies are set to each customer's requirements. No period is published.","status":"vendor_statement","url":"https://www.parloa.com/platform/enterprise-security-governance/","locator":"Custom data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data retention policies are set based on individual requirements, not a one-size-fits-all default."},{"key":"certifications","value":"7 named on the product page: ISO 27001, SOC 2 Type 1 and 2, PCI DSS, HIPAA, DORA, GDPR and the EU AI Act (compliance frameworks; only ISO 27001, SOC 2 and PCI DSS are certifications in the strict sense).","status":"vendor_statement","url":"https://www.parloa.com/platform/enterprise-security-governance/","locator":"Industry certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certification spans ISO 27001, SOC 2 Type 1 and 2, PCI DSS, HIPAA, DORA, GDPR, and the EU AI Act"},{"key":"admin_ai_controls","value":"Partly: per-agent safety controls and topic enforcement can be configured for each AI agent; no organisation-wide switch to turn AI off is described.","status":"vendor_statement","url":"https://www.parloa.com/platform/enterprise-security-governance/","locator":"Configurable LLM Guardrails","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Per-agent safety controls address harmful or abusive contents, and off-topic conversations."},{"key":"price_eur","value":"Not published. Consumption-based: per minute for voice and per interaction for chat; rates are agreed per deployment and no amounts are shown.","status":"not_published","url":"https://www.parloa.com/platform/pricing/","locator":"Pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Parloa uses consumption-based pricing: per minute for voice and per interaction for chat."}]}]},{"slug":"pcloud","name":"pCloud Business","vendor":"pCloud International AG","category":"research-forms-and-storage","plans":[{"id":"T642","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training clause found. The Business Agreement licenses pCloud to use customer data 'in connection with providing Customer access to the Services only'.","status":"not_published","url":"https://www.pcloud.com/business_agreement","locator":"Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://www.pcloud.com/business_agreement","locator":"Pages checked: business_agreement, terms_and_conditions, privacy_policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes. Choose the European Union (Luxembourg) at sign-up; files, account metadata and backups stay in that region. A later change costs a one-time $19.99 and only the account owner can request it on Business accounts.","status":"verified","url":"https://www.pcloud.com/data-regions","locator":"Can I change my data region after signing up?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All your files, account metadata, and backups are stored exclusively in the data region you select."},{"key":"default_data_location","value":"No default: the customer chooses EU (Luxembourg) or US (Dallas, Texas) before signing up.","status":"verified","url":"https://www.pcloud.com/data-regions","locator":"Pick your data's home - EU or US","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"pCloud offers two options: the United States (Dallas, Texas) and the European Union (Luxembourg)."},{"key":"dpa","value":"Not stated: no data processing agreement is published or referenced for Business accounts in the Business Agreement, terms or privacy policy; the GDPR page offers a white paper.","status":"not_published","url":"https://www.pcloud.com/business_agreement","locator":"Pages checked: business_agreement, terms_and_conditions, privacy_policy, gdpr","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not published: no sub-processor list found on the terms, privacy policy, Business Agreement, GDPR or security pages.","status":"not_published","url":"https://www.pcloud.com/privacy_policy","locator":"Pages checked: privacy_policy, terms_and_conditions, business_agreement, gdpr","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, pCloud International AG, Baar)","status":"verified","url":"https://www.pcloud.com/business_agreement","locator":"Parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Business Agreement (the \"Agreement\") is between pCloud International AG, a Swiss corporation (\"pCloud\") with principal place of business 74 Zugerstrasse at Str, 6340 Baar, Switzerland"},{"key":"data_retention","value":"Deleting an account removes files and personal data from pCloud's servers after 30 days. The Business Agreement says only that pCloud may delete data 'after a commercially reasonable period' once the agreement ends. Business plans keep file history up to 180 days.","status":"verified","url":"https://www.pcloud.com/privacy_policy","locator":"Deleting your data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you delete your pCloud account, your files and personal data will be permanently removed from our servers after 30 days."},{"key":"certifications","value":"ISO 27001:2013 is listed on the security page (shown as two certificates, ISMS and QMS); the Business page also names ISO 9001. 2 standards.","status":"verified","url":"https://www.pcloud.com/features/security","locator":"Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certifications ISO 27001:2013 ISMS Helps businesses manage risks, safeguard sensitive information, and comply with global security best practices."},{"key":"admin_ai_controls","value":"Not stated; the Business page lists no AI feature and no AI admin setting.","status":"not_published","url":"https://www.pcloud.com/business","locator":"Pages checked: business, business_agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"9.99 EUR per user on the first plan card (3-user minimum: 29.97 EUR for 3 users, 3 TB storage); the next card shows 14.98 EUR per user (6 TB for 3 users). Card names and the monthly/annual toggle state did not render, so billing basis is unconfirmed.","status":"verified","url":"https://www.pcloud.com/business","locator":"Plan cards (Business page)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"3 USERS / 3 TB STORAGE 29.97EURMONTH 9.99 EUR PER USER"}]}]},{"slug":"perplexity","name":"Perplexity","vendor":"Perplexity","category":"assistants","plans":[{"id":"T36","plan":"Pro","tier":"personal","price":{"label":"$17 / mo","amount":17,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless you opt out: on Free, Pro and Max, AI Data Retention is on by default and Perplexity may use your data to train AI models","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11564572-data-collection-at-perplexity","locator":"Sections on data uses and 'How to Opt Out of AI Training Data Collection'","url2":"https://www.perplexity.ai/help-center/en/articles/10352990-account-settings","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Yes. Account settings > Preferences > turn off 'AI data retention'; the opt-out applies only to data collected afterwards","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11564572-data-collection-at-perplexity","locator":"Numbered steps under 'How to Opt Out of AI Training Data Collection'","url2":"https://www.perplexity.ai/help-center/en/articles/10352990-account-settings","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://www.perplexity.ai/hub/legal/privacy-policy","locator":"Whole notice","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: the sub-processors Perplexity lists are all in the US","status":"not_published","url":"https://trust.perplexity.ai/subprocessors","locator":"Sub-processor list (locations)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"No. On consumer plans Perplexity AI, Inc. handles personal data under its privacy notice; its DPA forms part of business agreements that reference it","status":"verified","url":"https://www.perplexity.ai/hub/legal/privacy-policy","locator":"Opening paragraph ('This Privacy Notice applies to personal data Perplexity AI, Inc. … collects')","url2":"https://www.perplexity.ai/hub/legal/dpa","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public for business customers: 23 entries, all in the US, including Anthropic, OpenAI, Google Cloud, Amazon Bedrock, Microsoft Azure and xAI; the consumer privacy notice describes recipients by category","status":"verified","url":"https://trust.perplexity.ai/subprocessors","locator":"Sub-processor list","url2":"https://www.perplexity.ai/hub/legal/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Perplexity AI, Inc.; EU-US DPF and UK Extension; no Swiss-US listing shown)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Perplexity'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: personal data is kept as long as necessary for the purposes in the notice; users can ask for deletion","status":"not_published","url":"https://www.perplexity.ai/hub/legal/privacy-policy","locator":"Section 'How We Protect and Retain Data'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 (Type 2 report) and ISO/IEC 27001:2022 (company-wide trust centre)","status":"verified","url":"https://trust.perplexity.ai/","locator":"Trust Center compliance tiles","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: Pro is a personal plan with no admin","status":"verified","url":"https://www.perplexity.ai/hub/pricing","locator":"Individual tab","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 17 per month billed annually","status":"not_published","url":"https://www.perplexity.ai/hub/pricing","locator":"Individual tab, 'Popular' plan card","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T11","plan":"Enterprise Pro","tier":"business","price":{"label":"$34 / user / mo","amount":34,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Enterprise Pro and Max do not use customer data to train AI models; the DPA excludes personal data from model training","status":"verified","url":"https://www.perplexity.ai/hub/pricing?p=enterprise","locator":"Enterprise FAQ on the pricing page","url2":"https://www.perplexity.ai/hub/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Enterprise data is never used to train or fine-tune Perplexity's models, and its contracts bar third-party AI providers from training on it","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11187708-data-retention-and-privacy-for-enterprise-organizations-and-users","locator":"Section 'Model training and third parties'","url2":"https://www.perplexity.ai/hub/pricing?p=enterprise","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option documented","status":"not_published","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"Full DPA text","url2":"https://www.perplexity.ai/hub/pricing?p=enterprise","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated. All 23 listed sub-processors are located in the US","status":"not_published","url":"https://trust.perplexity.ai/subprocessors","locator":"Subprocessors table","url2":"https://www.perplexity.ai/hub/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. DPA (last updated 13 Aug 2026) forms part of business agreements that reference it; counterparty Perplexity AI, Inc.; SCCs for EU and UK transfers","status":"verified","url":"https://www.perplexity.ai/hub/legal/dpa","locator":"Preamble and section 11","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 23 entries, all US; model providers include Anthropic, OpenAI, Google Cloud, Amazon Bedrock, Microsoft Azure and xAI; 10 business days' notice for non-model sub-processors","status":"verified","url":"https://trust.perplexity.ai/subprocessors","locator":"'1-10 of 23 results'","url2":"https://www.perplexity.ai/hub/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF and UK Extension; no Swiss-US listing shown)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Perplexity'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Uploaded files are deleted after seven days (the conversation stays unless deleted). Admins can set session retention windows and enforce Incognito Mode under Organization Settings > Data and privacy, where configurable retention is enabled","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11187708-data-retention-and-privacy-for-enterprise-organizations-and-users","locator":"Sections 'Data retention' and 'Admin controls for Enterprise organizations'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 (Type 2 report) and ISO/IEC 27001:2022; HIPAA gap assessment and PCI DSS SAQ A documents","status":"verified","url":"https://trust.perplexity.ai/","locator":"Trust Center compliance tiles and documents list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. Admins set file, sharing and connector permissions per role, choose the AI models and providers, can turn off public sharing, and can enforce Incognito Mode","status":"verified","url":"https://www.perplexity.ai/help-center/en/articles/11187708-data-retention-and-privacy-for-enterprise-organizations-and-users","locator":"Section 'Admin controls for Enterprise organizations'","url2":"https://www.perplexity.ai/help-center/en/articles/10517443-enterprise-security-hub-settings","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. USD 34 per seat/month billed annually","status":"not_published","url":"https://www.perplexity.ai/hub/pricing?p=enterprise","locator":"Enterprise tab, Enterprise Pro card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"personio","name":"Personio","vendor":"Personio SE & Co. KG","category":"documents-hr-and-finance","plans":[{"id":"T113","plan":"Core","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Personio does not use the customer's data, Input or Output to train or improve AI models, and the same applies to its AI providers","status":"verified","url":"https://www.personio.com/terms/","locator":"Supplemental Terms for AI Features (version 08-2026), Section 4.1","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: customer data is not used to train AI models","status":"verified","url":"https://www.personio.com/terms/","locator":"Supplemental Terms for AI Features, Section 4.1","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Yes, for all customers: the DPA limits processing to the EU, EEA or adequate countries","status":"verified","url":"https://www.personio.com/terms/","locator":"DPA Section 1.2.4","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"EU/EEA by contract: processing takes place only in an EU or EEA state, or a country the European Commission rates as adequate","status":"verified","url":"https://www.personio.com/terms/","locator":"DPA Section 1.2.4","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. The Data Processing Addendum on Personio's terms page is agreed and forms an integral part of the agreement","status":"verified","url":"https://www.personio.com/terms/","locator":"GTC (version 08-2026) Section 11.1; DPA version 09-2024","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Not public: the current list is only available inside the software (Settings > Support > Subscription & Billing > Data Processing Information)","status":"not_published","url":"https://www.personio.com/terms/","locator":"DPA Section 7.1","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Personio SE & Co. KG, Munich)","status":"verified","url":"https://www.personio.com/terms/","locator":"GTC Section 1.1","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the agreement; Personio keeps the data for 30 days after it ends so the customer can export or ask for deletion, then deletes it","status":"verified","url":"https://www.personio.com/terms/","locator":"DPA Sections 10.2 to 10.4","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"ISO 27001, audited yearly by an independent firm","status":"verified","url":"https://www.personio.com/security/","locator":"Section on controls and standards","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. AI features are optional: admins can enable or disable any AI feature, or all AI Credit consumption, at any time, and can set a spend limit","status":"verified","url":"https://www.personio.com/terms/","locator":"Supplemental Terms for AI Features, Sections 2.1 and 7.3","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published: Personio quotes Core and Core PRO individually after a demo; a one-time setup fee depends on company size","status":"not_published","url":"https://www.personio.com/pricing/","locator":"Plan section 'Core' and FAQ on additional monthly costs","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"photoroom","name":"Photoroom Pro","vendor":"Photoroom SAS","category":"design-images-and-video","plans":[{"id":"T571","plan":"","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the account opt-out is used: Photoroom uses uploaded content to improve, train and develop its products. API images are treated differently (privacy policy excludes them; the security page says self-serve API plans train by default).","status":"verified","url":"https://www.photoroom.com/legal/terms-and-conditions","locator":"2.2.c License to User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By using the Services, you acknowledge and expressly authorize Photoroom to use User Content to improve, train and develop Photoroom’s products and services."},{"key":"training_opt_out","value":"In the app, go to account settings and use Data Control to opt out. It is not retroactive.","status":"verified","url":"https://www.photoroom.com/legal/terms-and-conditions","locator":"2.2.c License to User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can opt-out of this at any time by changing the settings on your account in the app under Data Control."},{"key":"eu_residency_option","value":"No: Photoroom states EU-only data residency is not available today.","status":"verified","url":"https://www.photoroom.com/platform/security","locator":"04 Hosting region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EU-only data residency isn't available today."},{"key":"default_data_location","value":"United States: Photoroom says its infrastructure runs in the US (hosted on Google Cloud and AWS).","status":"verified","url":"https://www.photoroom.com/platform/security","locator":"04 Hosting region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our infrastructure runs in the United States."},{"key":"dpa","value":"Not described for Pro. The security page says a DPA is available for Enterprise customers through the account team.","status":"verified","url":"https://www.photoroom.com/platform/security","locator":"FAQ: Is Photoroom GDPR-compliant? And is a DPA available?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A Data Processing Agreement is available for Enterprise customers through your account team."},{"key":"subprocessor_list","value":"No public list: the security page says the list is published for API customers. It names 5 providers: Google Cloud, AWS, Cloudflare, Datadog and Vercel. No AI model providers named.","status":"not_published","url":"https://www.photoroom.com/platform/security","locator":"03 Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The current sub-processor list is published for API customers and refreshed the list evolves."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Photoroom SAS, Paris, France)","status":"verified","url":"https://www.photoroom.com/legal/privacy","locator":"Introduction (publisher)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Photoroom, a French joint stock company having its head office located 229 rue Saint-Honoré"},{"key":"data_retention","value":"Account data is kept until you delete the account or up to 2 years after your last login, then archived for 5 years. How long uploaded images are kept in the app is not stated.","status":"verified","url":"https://www.photoroom.com/legal/privacy","locator":"3. Purposes, retention table (account management)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Until the account is deleted by you or up to a period of 2 years from your last connection to your account"},{"key":"certifications","value":"1: SOC 2 Type 2, but scoped to the API service only (report April 2026); nothing stated for the app plan. The Trust Center needs a browser.","status":"verified","url":"https://www.photoroom.com/platform/security","locator":"FAQ: Is Photoroom SOC 2 certified?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Photoroom holds a SOC 2 Type 2 attestation scoped to our API service."},{"key":"admin_ai_controls","value":"Not stated for Pro; no admin switch for AI features described. Team roles are listed under Enterprise.","status":"not_published","url":"https://www.photoroom.com/pricing","locator":"Plans and pricing, Pro vs Enterprise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: plan prices are not in the page text without a browser (the page lists Pro with 8,000 AI credits and 1,000 exports, billed yearly).","status":"not_captured","url":"https://www.photoroom.com/pricing","locator":"Plans and pricing, Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"phrase","name":"Phrase Language Intelligence Platform","vendor":"Phrase a.s. (Prague, Czech Republic)","category":"writing-and-email","plans":[{"id":"T351","plan":"Software UI/UX","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for some models: Phrase may train its own non-text AI models (e.g. MT engine selection, quality scoring) on customer content, no opt-out stated. Text-generating models are trained only with your prior approval.","status":"verified","url":"https://phrase.com/legal/","locator":"Terms of Service, 3.4.1 and 3.4.2 (ML Models used in the Phrase Solutions)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Phrase Group may use the Customer Content to train ML Models which are not designed to deliver an output to a customer in the form of a sequence of words or phrases."},{"key":"training_opt_out","value":"No opt-out is described for the non-text models (MT engine selection, quality scoring, non-translatables). Training of text-generating models happens only with your prior approval.","status":"verified","url":"https://phrase.com/legal/","locator":"Terms of Service, 3.4.2 Text Generative Output","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subject to Customer’s prior approval, the Phrase Group may use the Customer Content to train ML Models which are designed to deliver an output in the form of words or phrases"},{"key":"eu_residency_option","value":"Not stated how to choose: sub-processor list shows AWS data centres in the EU (France, Ireland) and the USA, but no setting or plan for picking a region was found.","status":"not_published","url":"https://phrase.com/subprocessor-overview/","locator":"List of Phrase Sub-Processors, Amazon Web Services EMEA SARL","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: security page says the platform runs on Amazon Web Services (Phrase Studio on Google Cloud) but names no country or region.","status":"not_published","url":"https://phrase.com/security/","locator":"Data Centers and Locations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: the Data Processing Addendum is Annex 1 of the Terms of Service and applies automatically; no separate signing described.","status":"verified","url":"https://phrase.com/legal/","locator":"Terms of Service, Section 1 Definitions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Processing Addendum means the data processing addendum contained in Annex 1 to these Terms of Service."},{"key":"subprocessor_list","value":"Yes: https://phrase.com/subprocessor-overview/ lists 15 sub-processors. AI/model providers: Microsoft, Google Ireland, OpenAI Ireland, Anthropic Ireland, Eleven Labs, Palabra.AI; machine translation: Rozetta, Tencent Cloud Europe, Unbabel.","status":"verified","url":"https://phrase.com/subprocessor-overview/","locator":"Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Get a detailed overview of all sub-processors for all Phrase Solutions."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Phrase a.s., Prague, Czech Republic)","status":"verified","url":"https://phrase.com/legal/","locator":"Terms of Service, Section 1 Definitions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Phrase means Phrase a.s. (formerly Memsource a.s.), a joint stock company incorporated under the laws of the Czech Republic"},{"key":"data_retention","value":"After the terms end: 30 days to export, deletion starts then and finishes within 60 days of termination. Personal data stays up to 60 days after you delete it in the product.","status":"verified","url":"https://phrase.com/legal/","locator":"Terms of Service Annex 1 (DPA), 10.1 and 3.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Phrase will retain the Customer Content for thirty (30) days following termination or expiration of the Terms of Service"},{"key":"certifications","value":"ISO 27001 certified; SOC 2 Type I (Type II expected in 2026). 1 full certification plus 1 attestation.","status":"verified","url":"https://phrase.com/security/","locator":"Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Phrase is SOC 2 Type I certified, with Type II certification expected in 2026."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch to turn AI features off found.","status":"not_published","url":"https://phrase.com/legal/","locator":"Terms 7.7; AI statement; pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Software UI/UX plan: 525 per month, billed annually; the page has a USD/EUR/GBP/CZK selector and the saved text does not show which currency was active.","status":"not_captured","url":"https://phrase.com/pricing/","locator":"Developer & Designer plans tab: Software UI/UX","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"pictory","name":"Pictory","vendor":"Pictory Corp","category":"design-images-and-video","plans":[{"id":"T557","plan":"Team","tier":"business","price":{"label":"$119 / mo","amount":119,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Pictory states it will not use customer content or generated videos to train or fine-tune its general AI or machine-learning models unless the customer agrees in writing.","status":"verified","url":"https://pictory.ai/terms-of-service","locator":"AI Usage Policy, point 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pictory will not use your Customer Content or Pictoried Content to train or fine-tune its general artificial intelligence or machine learning models, except as expressly agreed by you in writing."},{"key":"training_opt_out","value":"Nothing to do: Pictory states it will not train on customer content unless the customer agrees in writing.","status":"verified","url":"https://pictory.ai/terms-of-service","locator":"AI Usage Policy, point 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pictory will not use your Customer Content or Pictoried Content to train or fine-tune its general artificial intelligence or machine learning models, except as expressly agreed by you in writing."},{"key":"eu_residency_option","value":"Not stated; no EU data-storage option is described.","status":"not_published","url":"https://pictory.ai/privacy-policy","locator":"Looked in: Privacy Policy, Terms of Service, Pricing page, Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the privacy policy mentions staff and contractors outside your home country but names no storage region or host.","status":"not_published","url":"https://pictory.ai/privacy-policy","locator":"Looked in: Privacy Policy, Terms of Service, Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; no data processing agreement is offered or mentioned in the Terms, privacy policy or pricing page.","status":"not_published","url":"https://pictory.ai/terms-of-service","locator":"Looked in: Terms of Service, Privacy Policy, Pricing page, Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not published; the Terms mention third-party subprocessors for avatar verification, but no list or count was found.","status":"not_published","url":"https://pictory.ai/terms-of-service","locator":"Looked in: Terms of Service (Custom Avatar), Privacy Policy, Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Pictory'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Pictory' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: personal information is kept as long as needed or required by law. Customers can delete their content, but the Terms warn that some copies can remain on the service.","status":"verified","url":"https://pictory.ai/privacy-policy","locator":"Security, Data Retention, and Storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will retain your personal information for as long as needed for the purposes described above and/or as required by law."},{"key":"certifications","value":"2: SOC 2 and ISO 27001, both shown as 'Compliant' on the Trust Center (SOC 2 type not stated).","status":"verified","url":"https://pictory-corp.trust.site/","locator":"Compliances","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Details ### SOC 2 Compliant ### ISO 27001 Compliant"},{"key":"admin_ai_controls","value":"Not stated; the Team plan lists a shared workspace, but no admin setting to switch AI features off is described.","status":"not_published","url":"https://pictory.ai/pricing","locator":"Looked in: Pricing page, Terms of Service (AI Usage Policy)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Team $119 per month billed annually ($199 per month on monthly billing), for 3 or more users.","status":"not_published","url":"https://pictory.ai/pricing","locator":"Pricing page, Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"pika","name":"Pika","vendor":"Mellis, Inc. (Pika)","category":"design-images-and-video","plans":[{"id":"T552","plan":"Creator","tier":"personal","price":{"label":"$35 / mo","amount":35,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. The Terms say Pika uses anonymized or aggregated content, including prompts and outputs, to train its models unless a separate written agreement says otherwise.","status":"verified","url":"https://pika.art/terms-of-service","locator":"Usage Data / data use clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unless otherwise agreed in writing, you acknowledge that Pika may use anonymized or aggregated Content, including Inputs, Outputs, and your interactions with the Service"},{"key":"training_opt_out","value":"No self-serve opt-out found. The Terms say enterprise customers with a separate written agreement get their own data-use and training terms.","status":"verified","url":"https://pika.art/terms-of-service","locator":"Usage Data / data use clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are an enterprise customer with a separate written agreement, the terms of that agreement will govern data use and training."},{"key":"eu_residency_option","value":"Not stated; no EU data-storage option is described in the Terms or privacy policy.","status":"not_published","url":"https://pika.art/privacy","locator":"Looked in: Terms of Service, Privacy Policy, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Pika says the service is operated from the US and that EEA, Swiss and UK data is transferred to the US. No hosting provider or region is named.","status":"verified","url":"https://pika.art/terms-of-service","locator":"Governing law / operation clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Service is operated from the United States and might not be available or appropriate in all jurisdictions."},{"key":"dpa","value":"Yes, on request: customers in a jurisdiction that requires one (such as GDPR) can ask Pika for a Data Processing Agreement, which is then incorporated into the Terms.","status":"verified","url":"https://pika.art/terms-of-service","locator":"Data protection clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you may request that Pika enter into a Data Processing Agreement, which will be incorporated by reference into these terms of service."},{"key":"subprocessor_list","value":"Not published; no sub-processor list found. The privacy policy only says third-party AI model providers in its API platform receive inputs and act as independent controllers.","status":"not_published","url":"https://pika.art/privacy","locator":"Looked in: Privacy Policy (disclosures), Terms of Service, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Mellis', 'Pika'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Mellis', 'Pika' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for prompts or content: kept only as long as necessary, and storage limits and retention periods vary by plan. Biometric data is kept at most three years after account deletion. Deleting personal data requires deleting the account.","status":"verified","url":"https://pika.art/privacy","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for as set forth in this privacy policy"},{"key":"certifications","value":"Not stated; no security certification is named in the Terms, privacy policy or pricing page.","status":"not_published","url":"https://pika.art/privacy","locator":"Looked in: Privacy Policy (security section), Terms of Service, Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the Terms let organisation admins invite users, but no setting to switch AI features off is described.","status":"not_published","url":"https://pika.art/terms-of-service","locator":"Looked in: Terms of Service (organisation accounts), Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Creator $35 per month billed monthly, or $28 per month billed annually (3,150 credits a month, commercial licence).","status":"not_published","url":"https://pika.art/pricing","locator":"Compare plans table, Creator column","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"piktochart","name":"Piktochart","vendor":"Piktochart LLC","category":"design-images-and-video","plans":[{"id":"T574","plan":"Business","tier":"business","price":{"label":"$17 / user / mo","amount":17,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: all created visuals (thumbnails) and uploaded images are included in AI training by default unless you opt out by email. The Terms also give Piktochart a broad licence to use Your Content 'for any purpose'.","status":"verified","url":"https://piktochart.com/privacy-policy/","locator":"5.1 Overview of AI Training Program","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, all Content you create and/or upload to Piktochart is automatically included in our AI training program."},{"key":"training_opt_out","value":"Email ai-privacy @ piktochart.com to opt out. It applies to future training only; content already used may stay in trained models.","status":"verified","url":"https://piktochart.com/privacy-policy/","locator":"5.1 Overview of AI Training Program; 5.3 Your Rights Regarding AI Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can opt-out of this program at any time by emailing ai-privacy @ piktochart.com."},{"key":"eu_residency_option","value":"Not stated; no EU data-residency option found.","status":"not_published","url":"https://piktochart.com/privacy-policy/","locator":"Privacy policy, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Hosted on Amazon (RDS database, S3 files) and Google Cloud (Cloud SQL); no country or region named.","status":"not_published","url":"https://piktochart.com/privacy-policy/","locator":"4.3 Third parties, Hosting & Storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To host our application databases using Amazon RDS. We also use Amazon S3 for file storage and backups."},{"key":"dpa","value":"Not stated for Business; no DPA found. Enterprise lists 'Advanced security review & MSA support'.","status":"not_published","url":"https://piktochart.com/privacy-policy/","locator":"Privacy policy, terms of use, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No separate list; the privacy policy has a third-party table: 21 rows, 17 companies. AI providers: Google and Replicate.","status":"verified","url":"https://piktochart.com/privacy-policy/","locator":"4.3 Third Parties We Share Your Information With","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We use third-party services to help us provide some of our services (e.g., web hosting, data storage, communication, customer support, payment, maintenance, development and analysis, etc.)."},{"key":"dpf_status","value":"No listing found for search term 'Piktochart'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Piktochart' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for content; erasure on request (not absolute). Temporary image-processing files in Google Cloud Storage are removed within 48 hours.","status":"verified","url":"https://piktochart.com/privacy-policy/","locator":"4.3 Hosting & Storage; 6. Your Rights (erasure)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data in Cloud Storage is automatically removed within 48 hours."},{"key":"certifications","value":"Not stated; no certification found in the privacy policy, terms or pricing.","status":"not_published","url":"https://piktochart.com/privacy-policy/","locator":"Privacy policy, terms of use, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features or AI training described. Workspace management control is listed under Enterprise.","status":"not_published","url":"https://piktochart.com/pricing/","locator":"Pricing, Business vs Enterprise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $17 per member/month billed annually ($20 per member/month billed monthly).","status":"not_published","url":"https://piktochart.com/pricing/","locator":"Pricing, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business 1-100 Best for teams who needs advanced brand controls $20"}]}]},{"slug":"pipedream","name":"Pipedream","vendor":"Pipedream, Inc. (a Workday company)","category":"automation","plans":[{"id":"T482","plan":"Startup","tier":"business","price":{"label":"$99 / mo","amount":99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no training clause found in the security page, privacy statement, terms or DPA. The subprocessor list names Anthropic and OpenAI for AI services.","status":"not_published","url":"https://pipedream.com/docs/privacy-and-security","locator":"Privacy and Security page; also read /privacy, /terms, /dpa","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://pipedream.com/docs/privacy-and-security","locator":"Privacy and Security page; /privacy; /terms; /dpa","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option found; the docs describe hosting only in AWS us-east-1.","status":"not_published","url":"https://pipedream.com/docs/privacy-and-security","locator":"Infrastructure; pricing page compare table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: hosted on Amazon Web Services in the us-east-1 region.","status":"verified","url":"https://pipedream.com/docs/privacy-and-security","locator":"Infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pipedream is hosted on the Amazon Web Services (AWS) platform in the us-east-1 region."},{"key":"dpa","value":"Yes. A Data Protection Addendum with Standard Contractual Clauses is part of the standard Terms of Service.","status":"verified","url":"https://pipedream.com/docs/privacy-and-security","locator":"GDPR","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"includes a Data Protection Addendum as part of our standard Terms of Service."},{"key":"subprocessor_list","value":"Public list at https://pipedream.com/docs/subprocessors: 11 entries (updated 20 Aug 2025). AI providers: Anthropic and OpenAI (AI services), Langfuse (AI application monitoring).","status":"verified","url":"https://pipedream.com/docs/subprocessors","locator":"Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Below, you’ll find a list of Pipedream’s Subprocessors in our capacity as a Processor"},{"key":"dpf_status","value":"Not listed under its own name (Pipedream, Inc.); its parent Workday, Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Workday'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Code and configuration are kept until you delete them; event data and logs follow the retention rules on your account; backups of deleted customer data are cleared within 30 days.","status":"verified","url":"https://pipedream.com/docs/privacy-and-security","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pipedream deletes customer data in backups within 30 days."},{"key":"certifications","value":"One named: SOC 2 Type 2 (report on request). GDPR compliance is also stated; no ISO certification is named.","status":"verified","url":"https://pipedream.com/docs/privacy-and-security","locator":"SOC 2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pipedream has demonstrated SOC 2 compliance and can provide a SOC 2 Type 2 report upon request"},{"key":"admin_ai_controls","value":"Not stated; the Startup plan description and security page describe no admin switch for AI features.","status":"not_published","url":"https://pipedream.com/pricing","locator":"Compare plans table; security docs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Startup $99 per month on the annual option or $150 per month on the monthly option, with 100 users included then $2 per user.","status":"not_published","url":"https://pipedream.com/pricing","locator":"Startup plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$99 per month $150 per month"}]}]},{"slug":"pipedrive","name":"Pipedrive","vendor":"Pipedrive","category":"sales-marketing-and-support","plans":[{"id":"T110","plan":"Growth","tier":"business","price":{"label":"€39 / user / mo","amount":39,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No without permission (vendor statement): Pipedrive's AI page says it does not use client data to train its models without permission. The Terms only bar third parties from training on client data, and allow training on beta AI features solely to provide those beta features","status":"vendor_statement","url":"https://www.pipedrive.com/en/products/ai-crm","locator":"FAQ 'Does Pipedrive use client data to train AI models?'","url2":"https://www.pipedrive.com/en/terms-of-service","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not published: no setting is documented; Pipedrive says it needs permission before training on client data","status":"not_published","url":"https://www.pipedrive.com/en/products/ai-crm","locator":"FAQ 'Does Pipedrive use client data to train AI models?'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by default for EU sign-ups on any plan (Frankfurt or Dublin); Support can confirm the exact data centre","status":"verified","url":"https://www.pipedrive.com/en/subprocessors","locator":"Section 'Data Hosting Locations'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU for EU sign-ups: new accounts from the EU are primarily hosted in AWS Frankfurt or Dublin; accounts can land elsewhere because of IP mapping","status":"verified","url":"https://www.pipedrive.com/en/subprocessors","locator":"Section 'Data Hosting Locations' (current as of 28 Aug 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The DPA (last updated 2 Jul 2026) forms part of and is subject to the Pipedrive Terms of Service","status":"verified","url":"https://www.pipedrive.com/en/privacy/dpa","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 20 rows: 3 hosting (AWS, Cloudflare, Rackspace), 6 feature-specific, 6 AI (AWS twice, Anthropic, AssemblyAI, Recall.ai, OpenAI Ireland) and 5 support; plus 8 Pipedrive companies","status":"verified","url":"https://www.pipedrive.com/en/subprocessors","locator":"Page 'Sub-processors' (current as of 28 Aug 2026)","url2":"https://www.pipedrive.com/en/privacy/dpa","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Pipedrive Inc.; EU-US DPF and UK Extension; not Swiss-US)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Pipedrive'","url2":"https://www.pipedrive.com/en/terms-of-service","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On termination Pipedrive deletes or returns data as the client instructs; without instructions, closed accounts are typically deleted within 180 days (within 1 month on request) and server archival backups are typically kept for 90 days","status":"verified","url":"https://www.pipedrive.com/en/privacy/dpa","locator":"Section 5.11 Deletion and Return of Personal Data","url2":"https://www.pipedrive.com/en/terms-of-service","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022 and 27701; SOC 2 Type 2 and SOC 3","status":"verified","url":"https://trustcenter.pipedrive.com/","locator":"Compliance section","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not published: no admin switch for AI features was found on the pages read; the help centre search returned nothing","status":"not_published","url":"https://www.pipedrive.com/en/products/ai-crm","locator":"Whole page","url2":"https://www.pipedrive.com/en/terms-of-service-supplemental-terms","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 39 per seat/month billed annually (EUR 468 per seat a year); VAT basis not stated","status":"verified","url":"https://www.pipedrive.com/en/pricing","locator":"Plan card 'Growth'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"pitch","name":"Pitch","vendor":"Pitch Software GmbH","category":"design-images-and-video","plans":[{"id":"T561","plan":"Business","tier":"business","price":{"label":"€20 / user / mo","amount":20,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no model-training clause found. Pitch says it uses GPT-type language models for presentation generation, and lists OpenAI, Anthropic and fal as AI providers.","status":"not_published","url":"https://pitch.com/privacy-policy","locator":"Privacy policy, presentation processing section; DPA; terms of use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause or opt-out setting found.","status":"not_published","url":"https://pitch.com/privacy-policy","locator":"Privacy policy, DPA, terms of use, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Data is stored in the EU (Ireland) by default; no separate setting is needed. The DPA says processing happens inside the EU/EEA in principle, with other locations only after prior notice.","status":"verified","url":"https://pitch.com/dpa","locator":"Section on place of processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The processing of Customer Data by the Processor shall in principle take place inside the European Union or another contracting state of the European Economic Area (EEA)."},{"key":"default_data_location","value":"Ireland: Pitch is hosted on Amazon Web Services in the eu-west-1 region.","status":"verified","url":"https://pitch.com/gdpr","locator":"Where is my data stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The servers where Pitch's data is stored are located in Ireland (eu-west-1 region)."},{"key":"dpa","value":"Yes: a DPA is published at pitch.com/dpa, with a pre-signed PDF version customers download and sign.","status":"verified","url":"https://pitch.com/gdpr","locator":"Where is my data stored / compliance steps","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are a business customer of Pitch, you can find our Data Processing Agreement here. Download our pre-signed PDF version and sign it."},{"key":"subprocessor_list","value":"Yes: published in the DPA (Annex 7.2, Further Processors). 13 entries, including OpenAI OpCo, LLC, Anthropic PBC and fal (Features & Labels Inc.) as AI providers.","status":"verified","url":"https://pitch.com/dpa","locator":"Annex 7.2 Further Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA API platform for accessing Large Language Model Claude"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Pitch Software GmbH, Berlin).","status":"verified","url":"https://pitch.com/privacy-policy","locator":"Data controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data controller is Pitch Software GmbH, Joachimstraße 7, 10119 Berlin/Germany"},{"key":"data_retention","value":"Account data is usually deleted 3 years after last activity or after the account is deleted; on contract end the customer chooses deletion or return of data (DPA). Database backups are kept up to 30 days.","status":"verified","url":"https://pitch.com/privacy-policy","locator":"Presentation processing: retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subject to legal retention periods, we usually delete your data 3 years after the last user activity respectively after you have deleted your user account."},{"key":"certifications","value":"None named: the security policy describes measures (AES-256, TLS, AWS EU regions) but lists no ISO 27001 or SOC 2 certification.","status":"not_published","url":"https://pitch.com/security-policy","locator":"Security policy; GDPR page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch off AI features found. Pricing page shows AI credits per plan (750 a month on Business).","status":"not_published","url":"https://pitch.com/pricing","locator":"Pricing page, Business plan; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€20 per month per seat when paying yearly (Business plan, 1-200 seats); Team plan is €15.","status":"verified","url":"https://pitch.com/pricing","locator":"Pricing, Business plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€20 month(paying yearly) For larger teams delivering winning presentations at scale"}]}]},{"slug":"placetel-ai","name":"Placetel AI","vendor":"Gamma Placetel GmbH","category":"phone-and-voice","plans":[{"id":"T422","plan":"Grow","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: the service description says customer data is not used for training, improving, fine-tuning or optimising the AI or its internal models","status":"verified","url":"https://downloads.placetel.de/product/placetel_ai/placetel_leistungsbeschreibung_ai.pdf","locator":"Section 2.3 Datenmanagement und Mandantentrennung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Es werden keine Kunden- / Mandantendaten für Trainings-, Verbesserungs-, Feinjustierungs- bzw. Optimierungszwecke der KI und/oder von systeminternen Modellen genutzt."},{"key":"training_opt_out","value":"Nothing to do: the service description states customer data is not used for training or tuning the AI","status":"verified","url":"https://downloads.placetel.de/product/placetel_ai/placetel_leistungsbeschreibung_ai.pdf","locator":"Section 2.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Es werden keine Kunden- / Mandantendaten für Trainings-, Verbesserungs-, Feinjustierungs- bzw. Optimierungszwecke der KI und/oder von systeminternen Modellen genutzt."},{"key":"eu_residency_option","value":"Platform operator Miyon AG hosts Placetel AI in the EU (no setting needed). The service description also names OpenAI ChatGPT among the integrated models without saying where it runs; customers may use their own OpenAI key \"for desired data sovereignty\"","status":"verified","url":"https://downloads.placetel.de/product/placetel_ai/placetel_leistungsbeschreibung_ai.pdf","locator":"Section 2.1 Integrationen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Optional können Kunden einen eigenen OpenAI API-Schlüssel bei gewünschter Daten- hoheit verwenden."},{"key":"default_data_location","value":"EU: the Placetel AI platform is operated by sub-processor Miyon AG with hosting in the EU (country not stated); Placetel's phone platform is hosted in Frankfurt, Germany","status":"verified","url":"https://downloads.placetel.de/legal/placetel_adv.pdf","locator":"Subunternehmer table, row Miyon AG","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unterstützungsleistungen bei AVV, Hosting in EU Miyon AG der Einrichtung, der Placetel AI"},{"key":"dpa","value":"Yes: Placetel publishes a data processing agreement (AVV) that applies to its services; for Placetel AI the platform operator Miyon AG has its own AVV (Anlage 2)","status":"verified","url":"https://downloads.placetel.de/legal/placetel_adv.pdf","locator":"§1 Einleitung, Geltungsbereich","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die Anlage AVV kommt zur Anwendung für alle Leistungen und Leistungsteile des Auftraggebers"},{"key":"subprocessor_list","value":"Yes, public in the AVV: https://downloads.placetel.de/legal/placetel_adv.pdf lists 12 sub-processors (all products); Miyon AG is the one for Placetel AI, Google Ireland hosts applications; OpenAI is not listed though the service description names ChatGPT","status":"verified","url":"https://downloads.placetel.de/legal/placetel_adv.pdf","locator":"§ Subunternehmer table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"werden unter Einschaltung folgender Subunternehmer durchgeführt"},{"key":"dpf_status","value":"Not applicable (German vendor, Gamma Placetel GmbH, Köln)","status":"verified","url":"https://placetel.de/datenschutz","locator":"Datenschutzerklärung, Dienstanbieter","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Dienstanbieter ist die Gamma Placetel GmbH, Lothringer Straße 56, 50677 Köln."},{"key":"data_retention","value":"The customer sets it in 'Einstellungen': keep transcripts permanently, keep none, delete right after post-processing, or auto-delete after 1 day, 2 days, 3 days, 1 week, 2 weeks or 30 days","status":"verified","url":"https://downloads.placetel.de/product/placetel_ai/placetel_leistungsbeschreibung_ai.pdf","locator":"Section 2.4 Konfiguration","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Automatische Löschung nach Zeitraum: Transkripte werden nach Ablauf eines vom User individuell definierten Zeitraums automatisiert vom System entfernt."},{"key":"certifications","value":"1 named: ISO 27001 (data centres used by the Placetel platform); the AI service description only says ISO 27001 updates are implemented, without naming a certificate for the AI platform","status":"verified","url":"https://downloads.placetel.de/legal/placetel_anlage_tom.pdf","locator":"Section on Rechenzentren","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Alle Rechenzentren sind ISO 27001 zertifiziert."},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide AI on/off or restriction setting described (Placetel AI is an add-on that is booked separately)","status":"not_published","url":"https://downloads.placetel.de/product/placetel_ai/placetel_leistungsbeschreibung_ai.pdf","locator":"Sections 2 and 5 of the service description","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"79 EUR per month on the monthly-cancellable term, 69 EUR with a 24-month term (Grow, 750 minutes incl.), plus 9 EUR per month for the required AI phone number; VAT basis not shown","status":"verified","url":"https://placetel.de/placetel-ai-preise","locator":"Grow plan card; FAQ 1 and 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Placetel AI ist bereits ab 69 € pro Monat verfügbar."}]}]},{"slug":"plaud","name":"Plaud","vendor":"Plaud","category":"meetings-and-notes","plans":[{"id":"T60","plan":"Pro (with recorder)","tier":"personal","price":{"label":"$8.33 / mo","amount":8.33,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Plaud does not train its own or third-party models on recordings, photos or text unless the user opts in explicitly; its AI providers are contractually barred from training","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"'No training by default' and FAQ 'How can you guarantee that users' data is never used for training purposes?'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: training needs an explicit opt-in in the settings","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQ 'How can you guarantee that users' data is never used for training purposes?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default for users in Europe (Frankfurt), with EU-hosted AI processing; no private-cloud option","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQs on processing regions and private cloud","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"In the user's region: Plaud runs AWS data centres in the US (West), the EU (Frankfurt), Japan and Singapore; European users' AI processing goes to EU-hosted providers of GPT, Claude and Gemini","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQ 'Where and how does Plaud process users' data?'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"No. Individual plans fall under Plaud's consumer Terms of Service; the DPA is incorporated only into the Commercial Terms used for business plans","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQ 'Can you sign a Data Processing Agreement (DPA)?'","url2":"https://www.plaud.ai/pages/commercial-terms-of-service","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Offered as a document in Plaud's Trust Center (not readable on the page). The trust page names AWS and the GPT, Claude and Gemini model families, all under zero-retention, no-training terms","status":"verified","url":"https://app.drata.com/trust/8e587267-54ce-43cf-b52a-b71caf88c333","locator":"Documents list ('PLAUD SUB-PROCESSOR LIST')","url2":"https://www.plaud.ai/pages/trust","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Plaud'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Plaud' returned 'Query returned no results'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Data stays while the account is active and is deleted or anonymised after deactivation. With Cloud Sync off, audio and transcripts are deleted from the cloud once sent back to the phone","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQs on data retention and on local vs cloud processing","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2, HIPAA and GDPR validation reports, and EN 18031 for the recorders","status":"verified","url":"https://app.drata.com/trust/8e587267-54ce-43cf-b52a-b71caf88c333","locator":"Section 'Compliance'","url2":"https://www.plaud.ai/pages/trust","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: an individual plan has no admin","status":"verified","url":"https://www.plaud.ai/pages/plaud-ai-plan-pricing","locator":"Plan comparison (team features only in Team)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 8.33 per month shown for Pro on the plan page, also from Germany (billing basis not captured)","status":"not_published","url":"https://www.plaud.ai/pages/plaud-ai-plan-pricing","locator":"Plan card 'Pro'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]},{"id":"T61","plan":"Team","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Plaud does not train its own or third-party models on recordings, photos or text unless the user opts in explicitly; its AI providers are contractually barred from training","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"'No training by default' and FAQ 'How can you guarantee that users' data is never used for training purposes?'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: training needs an explicit opt-in in the settings","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQ 'How can you guarantee that users' data is never used for training purposes?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default for users in Europe (Frankfurt), with EU-hosted AI processing; no private-cloud option","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQs on processing regions and private cloud","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"In the user's region: Plaud runs AWS data centres in the US (West), the EU (Frankfurt), Japan and Singapore; European users' AI processing goes to EU-hosted providers of GPT, Claude and Gemini","status":"verified","url":"https://www.plaud.ai/pages/trust","locator":"FAQ 'Where and how does Plaud process users' data?'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Plaud's DPA with Standard Contractual Clauses is automatically part of its Commercial Terms of Service, accepted with the Order Form","status":"verified","url":"https://www.plaud.ai/pages/commercial-terms-of-service","locator":"Preamble ('our Data Processing Addendum') and definition 1.9","url2":"https://www.plaud.ai/pages/data-processing-addendum","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Offered as a document in Plaud's Trust Center (not readable on the page). The trust page names AWS and the GPT, Claude and Gemini model families, all under zero-retention, no-training terms","status":"verified","url":"https://app.drata.com/trust/8e587267-54ce-43cf-b52a-b71caf88c333","locator":"Documents list ('PLAUD SUB-PROCESSOR LIST')","url2":"https://www.plaud.ai/pages/trust","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Plaud'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Plaud' returned 'Query returned no results'","url2":"https://www.plaud.ai/pages/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customers configure retention in the account; after the contract ends Plaud returns or deletes all customer personal data on instruction","status":"verified","url":"https://www.plaud.ai/pages/commercial-terms-of-service","locator":"Customer responsibilities ('configuring retention, access controls…')","url2":"https://www.plaud.ai/pages/data-processing-addendum","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2, HIPAA and GDPR validation reports, and EN 18031 for the recorders","status":"verified","url":"https://app.drata.com/trust/8e587267-54ce-43cf-b52a-b71caf88c333","locator":"Section 'Compliance'","url2":"https://www.plaud.ai/pages/trust","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Team adds user and seat management, shared team files and a team workspace; switching AI features off for the team is not described","status":"verified","url":"https://www.plaud.ai/pages/plaud-ai-plan-pricing","locator":"Plan card 'Team' ('Team Includes')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 20 per user/month in the first year (offer until 30 Nov 2026), then USD 25","status":"not_published","url":"https://www.plaud.ai/pages/plaud-ai-plan-pricing","locator":"Plan card 'Team'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"pleo","name":"Pleo","vendor":"Pleo Technologies A/S","category":"documents-hr-and-finance","plans":[{"id":"T598","plan":"Build","tier":"business","price":{"label":"€14 / user / mo","amount":14,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, according to Pleo's MCP page FAQ: Pleo does not use your data (prompts, inputs or spend data) to train or retrain AI models. Product-page statement; the DPA and privacy policy say nothing on training.","status":"vendor_statement","url":"https://www.pleo.io/en/mcp","locator":"FAQ: Does Pleo use my data to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No. Pleo does not use your data - including prompts, inputs, or spend data - to train or retrain AI models."},{"key":"training_opt_out","value":"Nothing to do, according to Pleo's MCP page FAQ (no training on your data). Separately, admins can switch off the AI Access connection to Claude/ChatGPT in Settings > General > Pleo AI.","status":"vendor_statement","url":"https://www.pleo.io/en/mcp","locator":"FAQ: Does Pleo use my data to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No. Pleo does not use your data - including prompts, inputs, or spend data - to train or retrain AI models."},{"key":"eu_residency_option","value":"EU hosting is the default (AWS Ireland, EU/EEA data centres); no separate setting is described. The sub-processor list also shows US-based providers such as Anthropic (AI) and HubSpot.","status":"verified","url":"https://www.pleo.io/en/trust-and-security","locator":"Data Storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS data centres are located in the EU/EEA."},{"key":"default_data_location","value":"Ireland: customer data is stored and processed in AWS data centres in Ireland (eu-west-1).","status":"verified","url":"https://www.pleo.io/en/trust-and-security","locator":"Data Storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is stored and processed at data centers located in Ireland (eu-west-1)."},{"key":"dpa","value":"Yes. The Data Processing Agreement is an integral part of the Master Service Agreement and is deemed executed when the MSA is executed.","status":"verified","url":"https://www.pleo.io/legal-documents/pleo-data-processing-addendum-en.pdf","locator":"1. How to execute this DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The DPA shall be deemed executed at the same time as the execution of the MSA."},{"key":"subprocessor_list","value":"Yes, public at https://www.pleo.io/en/sub-processors (last updated 29.05.2025): the 'Pleo as a Processor' list has 10 entries, 10 companies (Enfuce, Saltedge, Google Cloud Platform, Microsoft Azure, AWS, Anthropic, Twilio, FreshWork/FreshDesk, HubSpot, Notion Labs). AI provider: Anthropic (US).","status":"verified","url":"https://www.pleo.io/en/sub-processors","locator":"Pleo as a Processor - Meet our Sub-Processors!","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pleo as a Processor - Meet our Sub-Processors!"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Pleo Technologies A/S, Copenhagen, Denmark)","status":"verified","url":"https://www.pleo.io/en/sub-processors","locator":"Pleo's Presence - Meet our Local Entities!","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pleo Technologies A/S c/o Ravnsborg Tvaergade 5c, 4, 2200 (HQ) Copenhagen Denmark"},{"key":"data_retention","value":"On termination Pleo deletes or returns all customer data at the customer's election, except what the law requires it to keep; backups are isolated until deletion is possible. The customer exports transaction data itself. No fixed number of days is stated.","status":"verified","url":"https://www.pleo.io/legal-documents/pleo-data-processing-addendum-en.pdf","locator":"11. Return or deletion of data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon termination or expiration of the Agreement, Pleo shall (at Customer's election) delete or return to Customer all Customer Data (including copies)"},{"key":"certifications","value":"PCI-DSS and Google's Cloud Application Security Assessment (CASA) are named (2), plus a HackerOne bug-bounty penetration test, a CAIQ self-assessment and GDPR adherence; no ISO 27001 or SOC 2 named.","status":"verified","url":"https://www.pleo.io/en/trust-and-security","locator":"Regulatory Compliance/Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These include PCI-DSS for secure payment processing, Google's Cloud Application Security Assessment (CASA) for cloud security"},{"key":"admin_ai_controls","value":"Yes for connecting outside AI tools: an admin can disable Pleo AI access at any time in Settings > General > Pleo AI, and users can revoke their own connections. Controls for Pleo's built-in AI features are not described.","status":"verified","url":"https://www.pleo.io/legal-documents/pleo-ai-access-terms-en.pdf","locator":"A note on data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can disable this at any time in Settings → General → Pleo AI ."},{"key":"price_eur","value":"€14 per user per month (Build), billed yearly, minimum 3 users; VAT not shown (German price page).","status":"verified","url":"https://pleo.io/de/pricing","locator":"Build","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"14 €Pro Nutzer:in/Monat Jährliche Zahlung Mindestens 3 Nutzer:innen"}]}]},{"slug":"poe","name":"Poe","vendor":"Poe (Quora, Inc.)","category":"assistants","plans":[{"id":"T300","plan":"paid subscription","tier":"personal","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Depends on the bot: official Poe bots and prompt bots on OpenAI, Anthropic, Google or Meta models do not train on chats; third-party developer bots and apps may train on them. Poe's privacy policy adds that model providers receive chats to improve their services.","status":"verified","url":"https://poe.com/privacy_center","locator":"FAQ: Are my chats used to train the AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Official Poe bots and user-created prompt bots using Open AI, Anthropic, Google, and Meta’s AI models do not train on your chats"},{"key":"training_opt_out","value":"No account-wide switch found. Check each bot's privacy shield icon: fully shaded bots are not used by AI providers for training; half-shaded third-party developer bots can use chats for training.","status":"verified","url":"https://poe.com/privacy_center","locator":"Understanding the privacy shield","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your interactions with the bot or app will not be used by AI model providers for training purposes."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://poe.com/privacy","locator":"Poe privacy policy, privacy center, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; no storage country or hosting region given.","status":"not_published","url":"https://poe.com/privacy","locator":"Poe privacy policy, privacy center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; no data processing agreement found in the Poe privacy policy, privacy center or terms.","status":"not_published","url":"https://poe.com/privacy","locator":"Poe privacy policy, privacy center, Poe terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found. The privacy center names the AI model providers that receive chats: OpenAI, Anthropic, Google, Meta and FireworksAI (5 named).","status":"not_published","url":"https://poe.com/privacy_center","locator":"Privacy shield section and FAQ: Are my chats shared with third parties?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Quora'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Quora' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Deleting chats or the account removes them from Poe's systems; memory summaries can persist until deleted in settings. Model providers set their own retention (Poe cites OpenAI and Anthropic at 30 days). No Poe retention period stated.","status":"verified","url":"https://poe.com/privacy_center","locator":"FAQ: How long do your AI model provider partners retain my chats for?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Each provider sets their own retention schedule (e.g. OpenAI and Anthropic retain your chats for 30 days)."},{"key":"certifications","value":"Not stated; no security certifications found on the Poe privacy pages or terms.","status":"not_published","url":"https://poe.com/privacy","locator":"Poe privacy policy, privacy center, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; terms allow shared team subscriptions but no admin control over AI features is described.","status":"not_published","url":"https://poe.com/tos","locator":"Terms 3.3 Shared subscription","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page needs a browser to read.","status":"not_captured","url":"https://poe.com/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"polyai","name":"PolyAI voice agent","vendor":"PolyAI Limited (with PolyAI Technologies, Inc.)","category":"phone-and-voice","plans":[{"id":"T412","plan":"enterprise, per-minute pricing","tier":"enterprise","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, where the client permits it: PolyAI uses snippets of call recordings and conversation turns for model training. Its public DPA also gives it a perpetual licence to use call data to develop and improve the service.","status":"verified","url":"https://poly.ai/privacy-policy","locator":"Personal Data we collect from conversations","url2":"https://poly.ai/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We extract snippets of voice recordings and/or conversation turns to improve our virtual assistant (including model training)."},{"key":"training_opt_out","value":"Not published: no setting or email is named. The privacy notice says improvement use happens only where the client permits it, so it is agreed in the contract with PolyAI.","status":"not_published","url":"https://poly.ai/privacy-policy","locator":"Personal Data we collect from conversations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where permitted by the client and applicable law, we and PolyAI Technologies, Inc. also use certain information collected from conversations to monitor the performance of the Service and improve the Service as set out below."},{"key":"eu_residency_option","value":"Not stated: no EU data-residency option found.","status":"not_published","url":"https://poly.ai/security","locator":"Looked at security, privacy notice, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for customer conversations. The DPA says PolyAI may process data anywhere it or its sub-processors have facilities; the security page says the platform is hosted on AWS.","status":"not_published","url":"https://poly.ai/security","locator":"Platform security","url2":"https://poly.ai/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Physical security – hosted on AWS providing robust physical data center security"},{"key":"dpa","value":"Yes: PolyAI publishes a Data Processing Agreement (last updated 1 October 2025). It takes effect when the customer agreement is signed and covers PolyAI acting as processor.","status":"verified","url":"https://poly.ai/dpa","locator":"13.1 Term, Deletion and Return","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA shall commence on the date the Agreement is signed by both parties"},{"key":"subprocessor_list","value":"Yes: the DPA says a sub-processor list is kept on PolyAI's trust centre, but that page loads by script, so the count and AI providers were not read.","status":"not_captured","url":"https://poly.ai/dpa","locator":"8.1 Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You grant us general authorisation to engage any of the Sub-processors listed at"},{"key":"dpf_status","value":"Not applicable (UK-based vendor, PolyAI Limited; the DPA uses the UK data-transfer addendum with PolyAI Limited as exporter). Its US affiliate PolyAI Technologies, Inc. is the importer under standard contractual clauses.","status":"verified","url":"https://poly.ai/dpa","locator":"Annex 1 - International Transfers, Table 1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Exporter - PolyAI Limited (as further identified in the Agreement)"},{"key":"data_retention","value":"Conversation data used for improvement is kept until annotation, evaluation or model training is complete. Under the DPA a customer can ask for a copy within 90 days of contract expiry, after which PolyAI deletes the data. Live recording retention is not stated.","status":"verified","url":"https://poly.ai/privacy-policy","locator":"Retention","url2":"https://poly.ai/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will keep this information until completion of the relevant annotation, evaluation or model training."},{"key":"certifications","value":"1 named: ISO 27001 (no SOC 2 or others named).","status":"verified","url":"https://poly.ai/security","locator":"Compliance certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO 27001-certified Physical security – hosted on AWS providing robust physical data center security"},{"key":"admin_ai_controls","value":"Not stated: no admin switch for AI features found; PolyAI is a managed voice-agent service configured with the vendor.","status":"not_published","url":"https://poly.ai/security","locator":"Looked at security, pricing, privacy notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published. Priced per minute of voice-agent use; the price list is only available by contacting sales.","status":"not_published","url":"https://poly.ai/pricing","locator":"Pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Ongoing use of the voice agent is priced on a per-minute basis, which includes proactive performance improvements, maintenance and 24/7 support."}]}]},{"slug":"prezi","name":"Prezi","vendor":"Prezi Inc.","category":"design-images-and-video","plans":[{"id":"T562","plan":"Teams","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for AI chats: Prezi may keep AI chat content, anonymized or aggregated, to improve its AI models. Content marked Public is also used for training. Business Terms allow analysing customer content for quality and improvement.","status":"verified","url":"https://prezi.com/legal/ai-product-terms/","locator":"Use of AI Products","url2":"https://prezi.com/legal/business-terms-and-conditions/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Prezi may retain the content of your AI chat sessions — in anonymized or aggregated form — for the purpose of further refining, enhancing, and improving its AI models"},{"key":"training_opt_out","value":"Not stated for business plans; no training opt-out setting found. Only the 'allow re-use' setting for Public content is mentioned.","status":"not_published","url":"https://prezi.com/legal/ai-product-terms/","locator":"AI Product Terms; Terms of Service; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://prezi.com/security/","locator":"Security page, DPA, privacy policy, business terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated by country; the subprocessor list names Amazon Web Services and Google (United States) as hosting providers.","status":"not_published","url":"https://prezi.com/legal/subprocessors/","locator":"Authorized Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: a Prezi/Infogram Data Processing Agreement is published and is a condition of the engagement; it incorporates the EU Standard Contractual Clauses (Annex D).","status":"verified","url":"https://prezi.com/legal/dpa/","locator":"Preamble and Section 7","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Partner / Customer's engagement with Prezi Inc. / Infogram is conditioned upon the agreement to this DPA."},{"key":"subprocessor_list","value":"Yes: https://prezi.com/legal/subprocessors/ lists 22 companies. No AI provider is listed, although the AI terms name OpenAI, LLC (United States) as an AI partner.","status":"verified","url":"https://prezi.com/legal/subprocessors/","locator":"Authorized Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Authorized Subprocessors Company Country Purpose Adyen Netherlands Payment Provider Amazon Web Services (AWS) United States Hosting Provider"},{"key":"dpf_status","value":"Active (Prezi Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Prezi'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not fixed. DPA: on termination Prezi returns or destroys the personal data at the customer's choice and keeps only what law requires. No period for AI chat content.","status":"verified","url":"https://prezi.com/legal/dpa/","locator":"8. Data return and Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"at the choice of Partner / Customer, return all the Partner / Customer Personal Data and copies of such data to Partner / Customer or securely destroy the data."},{"key":"certifications","value":"One: a SOC 2 Type 2 report on Security, available to Prezi Business subscribers who sign an NDA.","status":"verified","url":"https://prezi.com/security/","locator":"SOC 2 Type 2 report on Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We’ve successfully undergone an independent, external, third-party audit and obtained a SOC 2 Type 2 report on Security for Prezi."},{"key":"admin_ai_controls","value":"Not stated; no admin control to switch off AI features found. The AI Product Terms say AI features are marked where available.","status":"not_published","url":"https://prezi.com/legal/ai-product-terms/","locator":"AI Product Terms; business terms; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page needs a browser to read.","status":"not_captured","url":"https://prezi.com/pricing/","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"proton-lumo","name":"Proton Lumo","vendor":"Proton","category":"assistants","plans":[{"id":"T12","plan":"Professional","tier":"business","price":{"label":"€11.99 / user / mo","amount":11.99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No (vendor statement): the business page promises to prevent AI training on your data, and the DPA lists no training purpose. Feedback a user chooses to send may be shared with ETH Zurich and EPFL to train the Apertus models","status":"vendor_statement","url":"https://proton.me/business/lumo/pricing","locator":"Feature list","url2":"https://proton.me/lumo/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off (vendor statement): Proton markets Lumo for Business as preventing AI training on your data. Only feedback a user chooses to send may be shared with ETH Zurich and EPFL for model training","status":"vendor_statement","url":"https://proton.me/business/lumo/pricing","locator":"Feature list on the business pricing page","url2":"https://proton.me/lumo/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Europe by default (vendor statement); Switzerland has an EU adequacy decision","status":"vendor_statement","url":"https://proton.me/business/lumo/pricing","locator":"'Operate under European protection'","url2":"https://proton.me/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"Not named for Lumo. Operated by Proton AG under Swiss law; the DPA sends transfers to Switzerland, the EU or adequacy countries 'to the extent possible'","status":"not_published","url":"https://proton.me/lumo/privacy-policy","locator":"Controller and processors sections","url2":"https://proton.me/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA (last modified 10 Feb 2026) forms part of the contract under Proton's terms; Lumo is not named, but the DPA covers Proton services generally","status":"verified","url":"https://proton.me/legal/dpa","locator":"Preamble and definitions","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Named in the Lumo privacy policy: Zendesk (US), Stripe (US), PayPal group (US, Singapore), Chargebee (US), Atlassian (EU, US, UK); web-search partners not named","status":"verified","url":"https://proton.me/lumo/privacy-policy","locator":"Processors section","url2":"https://proton.me/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (Swiss vendor, Proton AG)","status":"verified","url":"https://proton.me/lumo/privacy-policy","locator":"Controller section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"No retention period stated. Saved chat history is stored with zero-access encryption that Proton cannot decrypt, and users can delete or export their data in the account interface","status":"not_published","url":"https://proton.me/lumo/privacy-policy","locator":"Section 2.1.2 'Account Activity' and the data-rights section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Proton's ISO 27001 and SOC 2 certifications back Lumo, per Proton; Lumo is described as supporting GDPR and HIPAA compliance","status":"vendor_statement","url":"https://proton.me/business/lumo","locator":"Section 'Certified and compliant'","url2":"https://proton.me/business/lumo/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Limited. Lumo for Business adds 'administrative tools to manage your team's access'; no organisation-wide switches for individual AI features are described","status":"verified","url":"https://proton.me/business/lumo","locator":"FAQ comparing Lumo Plus and Lumo for Business","url2":"https://proton.me/business/lumo/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 11.99 per user/month billed yearly (EUR 143.88); EUR 14.99 monthly; 'taxes may apply'","status":"verified","url":"https://proton.me/business/lumo/pricing","locator":"Lumo Professional card, Monthly/Yearly toggle","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"proton-mail-scribe","name":"Proton Mail with Scribe","vendor":"Proton AG (Plan-les-Ouates, Geneva, Switzerland)","category":"writing-and-email","plans":[{"id":"T376","plan":"Workspace Premium","tier":"business","price":{"label":"$19.99 / user / mo","amount":19.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Proton states Scribe does not use content data or any of the user's data to train its models.","status":"verified","url":"https://proton.me/legal/privacy","locator":"2.11 Proton Scribe","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Proton Scribe does not use content data or any of your data to train its models."},{"key":"training_opt_out","value":"Nothing to do: Proton states Scribe does not train on content or user data. Scribe can also run on the device only, or be switched off per user.","status":"verified","url":"https://proton.me/legal/privacy","locator":"2.11 Proton Scribe","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Proton Scribe does not use content data or any of your data to train its models."},{"key":"eu_residency_option","value":"No selectable setting. All servers are in Switzerland, Germany or Norway; Switzerland and Norway are outside the EU, and the pages do not let a customer pick Germany only.","status":"verified","url":"https://proton.me/mail/privacy-policy","locator":"Data security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"which are exclusively located in Switzerland, Germany or Norway"},{"key":"default_data_location","value":"Switzerland, Germany or Norway: Proton Mail servers are wholly owned and operated by Proton and located only in those countries.","status":"verified","url":"https://proton.me/mail/privacy-policy","locator":"Data security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is always stored in encrypted format on our servers, which are exclusively located in Switzerland, Germany or Norway"},{"key":"dpa","value":"Yes. A Data Processing Agreement with Proton AG forms part of the contract under Proton's Terms and Conditions.","status":"verified","url":"https://proton.me/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Agreement (\"Agreement\") forms part of the Contract for Services under Proton AG’s Terms and Conditions"},{"key":"subprocessor_list","value":"Yes, inside the privacy policy (section 4): 7 processors (2 Proton group companies, 5 third parties: Zendesk, Stripe, PayPal, Chargebee, Atlassian). No AI or model providers listed.","status":"verified","url":"https://proton.me/legal/privacy","locator":"4. Data processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To provide the Services, we rely on different data processors, which process different categories of data."},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, Proton AG, Plan-les-Ouates, Geneva)","status":"verified","url":"https://proton.me/legal/dpa","locator":"Preamble (parties)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"between Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, Company identification number CHE-354.686.492"},{"key":"data_retention","value":"Scribe: on Proton servers prompts are deleted immediately after use and no logs or content are stored. Mailbox backups are kept up to 30 days. On ending a service Proton deletes the company's personal data; request a copy before account deletion.","status":"verified","url":"https://proton.me/support/proton-scribe-writing-assistant","locator":"Decide where to run Scribe","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your prompts are encrypted in transit and deleted immediately after use."},{"key":"certifications","value":"2 named: ISO 27001 certification and SOC 2 Type II audit; the business page also links HIPAA and GDPR compliance information.","status":"verified","url":"https://proton.me/business/mail","locator":"Open source and audits","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Regular third-party audits, including our ISO 27001 certification and SOC 2 Type II audit"},{"key":"admin_ai_controls","value":"Yes. Admins can toggle the Writing assistant (Scribe) on or off for each user under Users and addresses.","status":"verified","url":"https://proton.me/support/proton-scribe-writing-assistant","locator":"Manage user access","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Click Edit next to a user. Toggle Writing assistant on or off."},{"key":"price_eur","value":"Shown in USD only: $19.99 per user/month on the yearly toggle (billed $239.88 every 12 months, taxes may apply). Scribe is included in Workspace Premium; on Workspace Standard it is a paid add-on.","status":"not_published","url":"https://proton.me/business/plans","locator":"Choose a plan / Workspace Premium","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"prowritingaid","name":"ProWritingAid","vendor":"Orpheus Technology Ltd (ProWritingAid)","category":"writing-and-email","plans":[{"id":"T343","plan":"Premium","tier":"personal","price":{"label":"€10.00 / user / mo","amount":10,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No: terms say your texts are not used to improve the services and are deleted after checking. It trains only on texts corrected by its own copyeditors.","status":"verified","url":"https://prowritingaid.com/en/Home/TermsOfService","locator":"4.1 (content use)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When using ProWritingAid, your texts will not be used to improve the quality of our services."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it never uses your data or writing to train its AI models.","status":"verified","url":"https://help.prowritingaid.com/article/14-is-my-data-safe-with-prowritingaid","locator":"Intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We never use your data or your writing to train our AI models or algorithms."},{"key":"eu_residency_option","value":"Business page says EU and US hosting options on Microsoft Azure for its business offer; no setting is described for Premium.","status":"vendor_statement","url":"https://prowritingaid.com/business","locator":"EU and US hosting options","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ProWritingAid partners with Microsoft Azure on EU and US servers so you know exactly where your data is processed."},{"key":"default_data_location","value":"United Kingdom, plus other countries where its service providers operate, including the EEA and the United States.","status":"verified","url":"https://prowritingaid.com/en/Home/Privacy","locator":"Where is my Information stored?","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Your personal data is stored and processed in the United Kingdom and in other countries where our service providers operate, including the European Economic Area and the United States."},{"key":"dpa","value":"Offered to enterprise customers on the business page; not stated for the Premium plan.","status":"vendor_statement","url":"https://prowritingaid.com/business","locator":"DPA and SSO enterprise options","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For enterprise customers, we offer data processing agreements as well as SSO logins and access control."},{"key":"subprocessor_list","value":"No dedicated list. The GDPR page names 10 providers in one sentence (Azure, Stripe, SendGrid, PayPal, Google, HotJar, Oribi, ShareASale, Microsoft Clarity, Iterable); AI model providers are not named.","status":"not_published","url":"https://prowritingaid.com/en/Home/GDPR","locator":"Looked at GDPR page, privacy policy, responsible AI page, trust center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Orpheus Technology Ltd, London)","status":"verified","url":"https://prowritingaid.com/en/Home/TermsOfService","locator":"1.2 Parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These Terms are between you (\"you\") and Orpheus Technology Ltd (\"Orpheus\", \"we\" or \"us\")."},{"key":"data_retention","value":"Text is kept only while it is analysed (seconds) except documents you save in the Web Editor. After you cancel, files are marked for deletion and deleted after 60 days.","status":"verified","url":"https://prowritingaid.com/en/Home/TermsOfService","locator":"7.1 Canceling your account","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon canceling your account, your files will be marked for deletion in sixty days, and will be deleted upon expiration of that sixty-day period."},{"key":"certifications","value":"1 named: SOC 2 (Security), assessed by third-party auditors. No ISO certification named.","status":"verified","url":"https://prowritingaid.com/trust-center","locator":"Compliance Standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We engage with third party auditors to assess our SOC 2 Security compliance."},{"key":"admin_ai_controls","value":"Individual users can switch Sparks (generative AI) off; no organisation-wide admin switch is stated for Premium, which is licensed per individual.","status":"verified","url":"https://help.prowritingaid.com/article/297-does-prowritingaid-use-ai","locator":"How does Sparks use generative AI?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you don’t want to use Sparks, you can turn the feature off."},{"key":"price_eur","value":"€10.00 per user/month billed yearly (€120 per year); €30 per month billed monthly. VAT not shown. Individual licence.","status":"verified","url":"https://prowritingaid.com/pricing","locator":"Premium card, yearly billing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€10.00 per month, billed yearly €120"}]}]},{"slug":"qonto","name":"Qonto","vendor":"Qonto SA","category":"documents-hr-and-finance","plans":[{"id":"T602","plan":"Smart","tier":"business","price":{"label":"€19 / mo","amount":19,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Qonto's AI-at-Qonto terms say Qonto does not train the models behind its AI agents (Google and Anthropic do) and collects no data for model training. The privacy policy adds no generative-AI training beyond what delivering the service needs.","status":"verified","url":"https://qonto.pactsafe.io/versions/69f8935b02722018b262089b.pdf","locator":"Artificial intelligence at Qonto v3.0 (effective 4 May 2026), section 6 Our Qonto AI Agents; privacy policy v7.0 AI paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Qonto does not train the AI models and therefore does not source or collect data for model training purposes."},{"key":"training_opt_out","value":"Nothing to do: Qonto states it does not train the AI models behind its agents and does not collect customer data for model training, so no opt-out step is described.","status":"verified","url":"https://qonto.pactsafe.io/versions/69f8935b02722018b262089b.pdf","locator":"Artificial intelligence at Qonto v3.0, section 6 Our Qonto AI Agents","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Qonto does not train the AI models and therefore does not source or collect data for model training purposes."},{"key":"eu_residency_option","value":"No separate option is published. Storage is already limited to France and Germany in the EU.","status":"not_published","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Section 7; pricing and security pages checked for a region setting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"France and Germany (EU), on Amazon AWS servers.","status":"verified","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Datenschutzbestimmungen v7.0, section 7 'Wo speichern wir Ihre Informationen?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"auf den Servern unseres Anbieters zur Datenspeicherung (Amazon AWS) in Frankreich und Deutschland (Europäische Union)"},{"key":"dpa","value":"No separate DPA for the account. Qonto states it processes customer data as an independent data controller, not as a processor.","status":"verified","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Datenschutzbestimmungen v7.0, section 1 (Hinweis)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Qonto handelt bei der Verarbeitung der Daten seiner Kunden als unabhängiger Datenverantwortlicher. Wir verarbeiten Ihre Daten für unsere eigenen Zwecke"},{"key":"subprocessor_list","value":"Not published. The legal centre and privacy policy name categories of providers but no public sub-processor list with entries.","status":"not_published","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Legal centre (de), privacy policy and framework contract; no sub-processor list found","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Qonto SA, Paris)","status":"verified","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Datenschutzbestimmungen v7.0, page footer","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Qonto (Qonto SA), rue de Navarin, 75009 Paris, SIREN 819 489 626"},{"key":"data_retention","value":"Account and transaction data is kept for 5 years after the account is closed, as financial law requires. Debt-collection data is kept up to 5 years after the case closes.","status":"verified","url":"https://qonto.pactsafe.io/versions/6a1dc4e59770d520dd1be18f.pdf","locator":"Datenschutzbestimmungen v7.0, section 5 (retention for account and transaction data)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Wir werden Ihre Daten für 5 Jahre nach der Schließung Ihres Kontos"},{"key":"certifications","value":"Not published. The security page describes controls and ACPR licensing but names no ISO, SOC 2 or PCI DSS certification.","status":"not_published","url":"https://qonto.com/en/security","locator":"Security page and framework contract checked for certification names","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"admin_ai_controls","value":"Not published. AI agents are included in every plan, and no administrator switch to disable them for the organisation is described.","status":"not_published","url":"https://qonto.com/en/pricing","locator":"Pricing page (AI agent listed in Basic); AI page FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"€19 per month excluding VAT on annual billing (€228 per year). Monthly billing is also available.","status":"verified","url":"https://qonto.com/en/pricing","locator":"Pricing page, Smart plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"€19 /month (excl. VAT)* Billed annually at €228"}]}]},{"slug":"quickbooks-online","name":"QuickBooks Online","vendor":"Intuit Inc.","category":"documents-hr-and-finance","plans":[{"id":"T606","plan":"Plus","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, as a stated purpose. Intuit says it may train its AI and machine-learning models on information it collects, including content customers send through its platform. Data processed on a customer's behalf is outside this statement; QuickBooks terms were not readable.","status":"verified","url":"https://www.intuit.com/privacy/statement/","locator":"Global Privacy Statement, 'How we use personal information'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"by training our artificial intelligence models and other machine learning models"},{"key":"training_opt_out","value":"Not published. Intuit describes model training but names no opt-out; account deletion is offered and is not a training opt-out.","status":"not_published","url":"https://www.intuit.com/privacy/statement/","locator":"Global Privacy Statement (training purpose and deletion rights)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"eu_residency_option","value":"Not published. Intuit describes transfers and SCCs but offers no EU-only storage option for QuickBooks.","status":"not_published","url":"https://www.intuit.com/privacy/statement/","locator":"Section 'International data transfers'; UK pricing page checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"Not fixed. Intuit reserves the right to store and process personal information in the United States and any other country where Intuit or its providers operate facilities.","status":"verified","url":"https://www.intuit.com/privacy/statement/","locator":"Global Privacy Statement, 'International data transfers'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Intuit reserves the right to store and process your personal information in the United States and in any other country where Intuit or its affiliates, subsidiaries, or service providers operate facilities"},{"key":"dpa","value":"Not captured. The QuickBooks product terms and any DPA page could not be read: the server fetch returned an empty response and the terms URL returned 404.","status":"not_captured","url":"https://quickbooks.intuit.com/global/legal/terms-of-service/","locator":"QuickBooks global terms of service (blocked / 404)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"subprocessor_list","value":"Not published. The privacy statement describes service providers, including generative AI providers, but publishes no list with entries.","status":"not_published","url":"https://www.intuit.com/privacy/statement/","locator":"Global Privacy Statement, 'With service providers or agents'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"dpf_status","value":"Active (Intuit; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Intuit'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as needed to provide the service and meet Intuit's retention requirements and legal duties; after a deletion request some records remain for legal, regulatory or fraud reasons.","status":"verified","url":"https://www.intuit.com/privacy/statement/","locator":"Global Privacy Statement, 'Data retention'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"we retain your personal information as long as it is necessary to comply with our data retention requirements and provide you with services"},{"key":"certifications","value":"Not published. Intuit's security pages describe MFA, AES-256 encryption and PCI guidance but name no ISO 27001 or SOC 2 certification.","status":"not_published","url":"https://security.intuit.com/security-practices","locator":"Security practices page (read in browser); no certification names","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"admin_ai_controls","value":"Not published. QuickBooks plans include Intuit Intelligence and AI insights, but no administrator switch to disable AI for the organisation is documented.","status":"not_published","url":"https://quickbooks.intuit.com/uk/pricing/","locator":"UK pricing page (AI features); security and privacy pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"Shown in GBP only: £56 per month for Plus with 5 users, after a 90% discount for the first 6 months. No euro price and no VAT shown.","status":"not_published","url":"https://quickbooks.intuit.com/uk/pricing/","locator":"UK pricing page, Plus plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Save 90% for 6 months, then £56/mo"}]}]},{"slug":"rapidmail","name":"rapidmail Newsletter Software","vendor":"Positive Group Deutschland GmbH (rapidmail)","category":"sales-marketing-and-support","plans":[{"id":"T512","plan":"Essential","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The terms disclose one AI service (OpenAI Ireland Ltd., subject-line suggestions from your text and website) and say nothing on training.","status":"not_published","url":"https://www.rapidmail.com/general-terms-and-conditions","locator":"§5 Integrated services appendix; data protection page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training opt-out described.","status":"not_published","url":"https://www.rapidmail.com/general-terms-and-conditions","locator":"Integrated services appendix; data protection page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not a setting: everything is stored in Germany by default.","status":"verified","url":"https://www.rapidmail.com/email-marketing-gdpr-compliant","locator":"Servers located in Germany","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored on servers in Germany. There is no risk of data being transferred to a third country or reliance on US corporations."},{"key":"default_data_location","value":"Germany: all data is stored on servers in Germany, in a German data centre; backups also in Germany.","status":"verified","url":"https://www.rapidmail.com/email-marketing-gdpr-compliant","locator":"Servers located in Germany","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored on servers in Germany. There is no risk of data being transferred to a third country or reliance on US corporations."},{"key":"dpa","value":"Yes, a data processing contract is concluded online in the rapidmail account (available once the account is activated); the terms say it applies when the contract takes effect.","status":"verified","url":"https://www.rapidmail.de/hilfe/dpa","locator":"Data Processing Agreement Sample (English version)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can conclude a data processing contract (as per Art. 28 of the GDPR) in the rapidmail newsletter software in electronic form."},{"key":"subprocessor_list","value":"No public sub-processor list found. The terms' appendix names one AI provider: OpenAI Ireland Ltd. (1 entry).","status":"not_published","url":"https://www.rapidmail.com/general-terms-and-conditions","locator":"Integrated services appendix","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Positive Group Deutschland GmbH, Freiburg im Breisgau, Germany)","status":"verified","url":"https://www.rapidmail.com/legal-notice","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Positive Group Deutschland GmbH Ingeborg-Krummer-Schroth-Straße 18a 79106 Freiburg im Breisgau Germany"},{"key":"data_retention","value":"Not stated for stored content. After termination access is blocked and 'your access shall be completely deleted'; contents can be exported until termination takes effect. No deletion period given.","status":"verified","url":"https://www.rapidmail.com/general-terms-and-conditions","locator":"Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Once termination of the contract takes effect, access to our services shall be blocked for you and your users. You can export the contents processed using our services until the termination takes effect."},{"key":"certifications","value":"1 named: ISO 27001 for the German data centre it uses (not for rapidmail itself).","status":"verified","url":"https://www.rapidmail.com/email-marketing-gdpr-compliant","locator":"ISO 27001 certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our data centre is regularly audited and certified under ISO 27001, confirming full GDPR compliance."},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch the AI subject-line feature off was found.","status":"not_published","url":"https://www.rapidmail.com/general-terms-and-conditions","locator":"Integrated services appendix; GTC","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page is built with JavaScript and shows no prices in the text snapshot; plan name also unreadable.","status":"not_captured","url":"https://www.rapidmail.com/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"read-ai","name":"Read AI","vendor":"Read AI","category":"meetings-and-notes","plans":[{"id":"T64","plan":"Pro","tier":"business","price":{"label":"$15 / user / mo","amount":15,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Meeting data is used to improve the service only if a user opts in to Read's Customer Experience Program","status":"verified","url":"https://trust.read.ai/faq","locator":"FAQ 'Do you train your AI models on customer data?'","url2":"https://www.read.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: the Customer Experience Program is opt-in and can be left or joined in account settings","status":"verified","url":"https://www.read.ai/privacy-policy","locator":"Section 'Customer Experience Program'","url2":"https://trust.read.ai/faq","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"On request only: the sub-processor list marks AWS hosting and OpenAI processing with 'EU/Canada available on request'; no self-service option","status":"verified","url":"https://trust.read.ai/subprocessors","locator":"Rows 'Amazon Web Services' and 'OpenAI'","url2":"https://trust.read.ai/faq","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: all user data is processed and stored in the US","status":"verified","url":"https://trust.read.ai/faq","locator":"FAQ 'Where geographically is user data stored?'","url2":"https://www.read.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. A Data Processing Addendum is listed among Read AI's Trust Center documents (access route not shown on the page)","status":"verified","url":"https://trust.read.ai/","locator":"Documents list ('Data Processing Addendum')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 25 entries, all in the US; AI: Anthropic and OpenAI; hosting on AWS, compute on CoreWeave, data on Databricks","status":"verified","url":"https://trust.read.ai/subprocessors","locator":"Subprocessors list (all pages)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Read AI; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Read AI'","url2":"https://www.read.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Paid accounts keep data as long as the account exists; audio and video are kept no longer than 2 years; deleted users or workspaces are wiped. Automatic retention policies are an Enterprise+ feature","status":"verified","url":"https://trust.read.ai/faq","locator":"FAQ 'How long do you store user data?'","url2":"https://www.read.ai/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type 2; HIPAA (Enterprise+ workspaces) and GDPR listed","status":"verified","url":"https://trust.read.ai/","locator":"Compliance tiles and documents","url2":"https://www.read.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Paid workspaces let admins set report sharing rules, choose which meetings Read joins and manage licences; SSO, domain capture and retention policies are Enterprise+","status":"verified","url":"https://www.read.ai/pricing","locator":"Comparison rows 'Workspace', 'Domain Capture', 'Data Retention Policy'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 15 per user/month billed annually, USD 19.75 monthly","status":"not_published","url":"https://www.read.ai/pricing","locator":"Plan card 'Pro'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"reclaim-ai","name":"Reclaim","vendor":"Reclaim.ai, Inc.","category":"research-forms-and-storage","plans":[{"id":"T634","plan":"Starter","tier":"business","price":{"label":"$10 / user / mo","amount":10,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Reclaim and its providers will not use Personal Data, including calendar data, to train large language or generative AI models unless the user separately consents or opts in.","status":"verified","url":"https://reclaim.ai/privacy","locator":"Privacy Policy > Generative AI Technologies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will not use and will not authorize any of our third-party service providers to use your Personal Data (including your Calendar Data or App Data) to train any large language or other generative AI models"},{"key":"training_opt_out","value":"Nothing to do by default: training needs separate prior consent or an explicit opt-in, so it is off unless someone turns it on.","status":"verified","url":"https://reclaim.ai/privacy","locator":"Privacy Policy > Generative AI Technologies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"unless we have separately and explicitly obtained your prior consent or you have expressly opted into our use of your Personal Data for such purposes through the Services."},{"key":"eu_residency_option","value":"Not stated. The security page says all data is hosted in the USA (AWS us-east-1 and us-east-2); no EU region or setting is described.","status":"not_published","url":"https://reclaim.ai/security","locator":"Security page > Amazon Web Services; privacy policy international transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is hosted in the USA, with redundancy between us-east-1 and us-east-2 regions."},{"key":"default_data_location","value":"United States: all data is hosted on AWS in the USA, with redundancy between the us-east-1 and us-east-2 regions.","status":"verified","url":"https://reclaim.ai/security","locator":"Security page > Amazon Web Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is hosted in the USA, with redundancy between us-east-1 and us-east-2 regions."},{"key":"dpa","value":"Yes. A Data Processing Addendum is incorporated into the Business Terms of Service and is published at reclaim.ai/dpa (last updated December 7, 2023).","status":"verified","url":"https://reclaim.ai/security","locator":"Security page FAQ: Is Reclaim compliant with privacy laws","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Reclaim has self-serve data deletion processes and a Data Processing Addendum that is incorporated into our Business Terms of Service."},{"key":"subprocessor_list","value":"Yes, public: https://reclaim.ai/subprocessors (updated May 21, 2025). 19 entries. AI provider: OpenAI, opt-in only.","status":"verified","url":"https://reclaim.ai/subprocessors","locator":"Reclaim Sub-Processors > AI Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"### AI Sub-Processors (by opt-in - no customer data sent without consent/permission)"},{"key":"dpf_status","value":"Active (Dropbox, Inc., which the search shows for 'Reclaim.ai' as a covered entity; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Reclaim.ai'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as reasonably necessary or required by law; the customer can delete the account in-app and Reclaim wipes calendar data from its systems within one hour.","status":"verified","url":"https://reclaim.ai/security","locator":"Security page > Data deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"our software will automatically kick off a job to wipe all your calendar data from our systems within one hour"},{"key":"certifications","value":"1 named: SOC 2 Type II; the security page also names GDPR, CCPA and Data Privacy Framework compliance.","status":"verified","url":"https://reclaim.ai/security","locator":"Security page FAQ: Is Reclaim SOC2 certified?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Reclaim is SOC2 certified. SOC2 Type II is the highest standard for security certification and compliance"},{"key":"admin_ai_controls","value":"Not stated. AI sub-processing is described as opt-in, but no admin setting to limit AI features organisation-wide was found.","status":"not_published","url":"https://reclaim.ai/subprocessors","locator":"Subprocessors page; privacy policy; pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR. Shown in USD only: Starter is $10 per seat/month on one billing option and $12 on the other (monthly vs annual toggle not readable in text).","status":"not_published","url":"https://reclaim.ai/pricing","locator":"Pricing page, Starter card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"### Starter For small teams. ## $10 per seat/month"}]}]},{"slug":"recraft","name":"Recraft","vendor":"Recraft, Inc.","category":"design-images-and-video","plans":[{"id":"T564","plan":"Teams","tier":"business","price":{"label":"$22 / mo","amount":22,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the Terms of Service allow Recraft to train its AI models on your prompts and images, on by default for accounts, unless you opt out in your profile settings. The Terms make no Teams exception.","status":"verified","url":"https://www.recraft.ai/terms","locator":"Section 7.7 Licenses to Recraft","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"This training use is enabled by default, but you may opt out at any time by adjusting your preferences in your account profile settings."},{"key":"training_opt_out","value":"Switch training off in your account profile settings; the Terms make it on by default for all accounts, with no Teams exception.","status":"verified","url":"https://www.recraft.ai/terms","locator":"Section 7.7 Licenses to Recraft","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"This training use is enabled by default, but you may opt out at any time by adjusting your preferences in your account profile settings."},{"key":"eu_residency_option","value":"Not stated; no EU data residency option found.","status":"not_published","url":"https://www.recraft.ai/privacy","locator":"Privacy policy, terms, DPA, sub-processor page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for customer content; the privacy policy says information is stored in computers outside the user's home country. AWS (United States) is a listed sub-processor.","status":"not_published","url":"https://www.recraft.ai/privacy","locator":"Other Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: a Data Processing Addendum is published at recraft.ai/legal/dpa and forms part of the customer agreement; entering it also signs the EU Standard Contractual Clauses.","status":"verified","url":"https://www.recraft.ai/legal/dpa","locator":"Opening paragraph and international transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By entering into this DPA, the Parties are deemed to be signing the 2021 Standard Contractual Clauses and their applicable Appendices."},{"key":"subprocessor_list","value":"Yes: https://www.recraft.ai/subprocessors lists 35 sub-processors plus 8 external model providers (43 rows). AI providers include Anthropic, OpenAI, Google, Black Forest Labs, Ideogram AI, Fal, OpenRouter and Runware.","status":"verified","url":"https://www.recraft.ai/subprocessors","locator":"Recraft Subprocessors; External model providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Recraft, Inc. engages the following external model providers to enable image generation"},{"key":"dpf_status","value":"No listing found for search term 'Recraft'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Recraft' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for content. Deleting an account permanently erases personal data; images made on a paid plan stay private and yours. API results are deleted within 24 hours. Deleting a Teams workspace removes all its data.","status":"verified","url":"https://www.recraft.ai/docs/trust-and-security/data-protection-and-privacy","locator":"Deletion; FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If a user deletes their account, all personal data is permanently erased."},{"key":"certifications","value":"Two named: SOC 2 Type 2 and AIUC-1 (AI agent safety). PCI DSS is held by its payment processors, not by Recraft. GDPR alignment is stated, not a certificate.","status":"verified","url":"https://www.recraft.ai/docs/trust-and-security/compliance-and-certifications","locator":"SOC 2 certification; AIUC-1 certification; PCI DSS compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Recraft is AIUC-1 certified by the Artificial Intelligence Underwriting Company."},{"key":"admin_ai_controls","value":"Not stated; no admin control to switch off AI features found. The Teams admin page covers seats, roles and billing only.","status":"not_published","url":"https://www.recraft.ai/pricing","locator":"Pricing FAQ, terms, privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Teams, 2,000-credit tier, $22 per month billed monthly or $18 per month billed annually (4,000 credits $44 / $35). Each workspace seat gets the tier's credits; minimum 2 seats.","status":"not_published","url":"https://www.recraft.ai/docs/plans-and-billing/paid-plans","locator":"Paid plans, Teams plan prices","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"For collaborative use, the Teams plan is available at: 2000 credits — $22 per month (monthly) or $18 per month (billed annually)"}]}]},{"slug":"relevance-ai","name":"Relevance AI","vendor":"OnSearch Pty Ltd (Relevance AI)","category":"assistants","plans":[{"id":"T325","plan":"Team","tier":"business","price":{"label":"$234 / mo","amount":234,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Docs say Relevance AI does not use customer data to train its models or improve its services unless there is a specific partnership agreement.","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Data ownership and privacy","url2":"https://relevanceai.com/terms-and-conditions","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train our models or improve our services unless you have a specific partnership agreement with us"},{"key":"training_opt_out","value":"Nothing to do: Relevance AI states it does not train on customer data (and trains no models on it, ever).","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Self-hosted models that are multi-region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We don’t train any models on your data, ever."},{"key":"eu_residency_option","value":"Yes. Pick EU (London) when creating the organisation; it cannot be changed later. Docs do not limit this to a plan.","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Data residency & storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is stored in Australia, the US, or the EU/UK, based on your selection at signup."},{"key":"default_data_location","value":"You choose at sign-up: US (N. Virginia), EU (London) or Australia (Sydney). The region cannot be changed afterwards.","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Data residency & storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is stored in Australia, the US, or the EU/UK, based on your selection at signup."},{"key":"dpa","value":"Not found. Docs say a DPA can be reviewed on the website (about model vendors), but no DPA page was found and the terms do not include one.","status":"not_published","url":"https://relevanceai.com/terms-and-conditions","locator":"Terms and conditions; docs security overview; /dpa returns 404","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Docs say sub-processors are listed at https://trust.relevanceai.com/subprocessors; that page needs a browser, so the count was not captured.","status":"not_captured","url":"https://trust.relevanceai.com/subprocessors","locator":"Trust Center sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Relevance AI', 'OnSearch'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Relevance AI', 'OnSearch' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Run logs and conversations are kept until the customer deletes them (30 days only on the retired free tier); Team shows 90-day task history. Automatic retention rules are Enterprise-only. Account deletion is processed within 60 days.","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Data retention","url2":"https://relevanceai.com/docs/get-started/pricing.md","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For other tiers, the data is stored until you choose to delete it"},{"key":"certifications","value":"1 named: SOC 2 Type II (reports under NDA for Enterprise); GDPR compliance is also claimed.","status":"verified","url":"https://relevanceai.com/docs/admin/security.md","locator":"Security certifications and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Relevance AI is SOC2 Type II compliant, and we operate in a multi-region environment."},{"key":"admin_ai_controls","value":"Not offered on Team: SSO, RBAC and audit logs are Enterprise features; no organisation-wide setting to switch AI features off is documented.","status":"verified","url":"https://relevanceai.com/docs/get-started/pricing.md","locator":"Enterprise plan feature list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise Security (SSO, RBAC, audit logs)"},{"key":"price_eur","value":"Shown in USD only: Team plan from $234 per month (annual billing saves 33% against monthly), with 5 build users and 45 end users.","status":"not_published","url":"https://relevanceai.com/docs/get-started/pricing.md","locator":"Pricing, Team plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"remote","name":"Remote","vendor":"Remote Europe Holding B.V. (Remote)","category":"documents-hr-and-finance","plans":[{"id":"T595","plan":"Contractor Management","tier":"business","price":{"label":"$29 / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Remote says it does not use personal data to train large language models and contractually requires its AI suppliers not to; the statement covers personal data in its AI Services.","status":"verified","url":"https://remote.com/policy/privacy-policy","locator":"AI safeguards (Suppliers of large language model services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use Personal Data to train large language models, and we contractually require our suppliers not to use Personal Data to train their AI models."},{"key":"training_opt_out","value":"Nothing to do: Remote states it does not train on personal data and requires its AI suppliers not to. Many AI services are also optional.","status":"verified","url":"https://remote.com/policy/privacy-policy","locator":"AI safeguards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Many of our AI Services are also optional, and we identify which ones process personal data"},{"key":"eu_residency_option","value":"Not stated; no EU residency option or setting found in the privacy policy, terms or security page.","status":"not_published","url":"https://remote.com/policy/privacy-policy","locator":"Personal data disclosures; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Hosted on Amazon Web Services; country or region not stated in the privacy policy or security page.","status":"not_published","url":"https://remote.com/policy/privacy-policy","locator":"Personal data disclosures","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. A Data Processing Addendum is incorporated into the Terms of Service as one of the 'Additional Terms'.","status":"verified","url":"https://remote.com/policy/terms-of-service","locator":"Additional Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Data Processing Addendum, and Privacy Policy (together, Additional Terms), all of which are incorporated herein by reference"},{"key":"subprocessor_list","value":"No public list. The privacy policy says registered Platform users can find a list of key suppliers (processors and sub-processors) at employ.remote.com/dashboard/processors, which sits behind login; the third-party AI model suppliers appear on it.","status":"not_published","url":"https://remote.com/policy/privacy-policy","locator":"Suppliers (Processors)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our suppliers may change over time but registered Platform users can find a list of key suppliers (processors and sub-processors) here"},{"key":"dpf_status","value":"Not applicable (EU-based contracting entity for customers outside the US: Remote Europe Holding B.V., Amsterdam). The US entities Remote Technology, Inc. and Remote Technology Services, Inc. also state DPF certification.","status":"verified","url":"https://remote.com/policy/terms-of-service","locator":"Contracting entity","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"if Your address is outside the United States, Remote Europe Holding B.V."},{"key":"data_retention","value":"No fixed period published: personal data is kept no longer than needed, with periods depending on national law. AI inputs, outputs and requests are logged, with the 'lowest data retention periods possible'; application logs are kept 30 days. No self-serve delete setting described.","status":"verified","url":"https://remote.com/policy/privacy-policy","locator":"AI Services logging and AI safeguards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you use our AI features, we log inputs, outputs and requests made to the AI Services."},{"key":"certifications","value":"ISO 27001 and SOC 2 (2 named); GDPR compliance also stated.","status":"verified","url":"https://remote.com/why-remote/security-compliance","locator":"ISO27001 Certified & SOC 2 Compliant","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO27001 Certified & SOC 2 Compliant"},{"key":"admin_ai_controls","value":"Not stated; the privacy policy says many AI services are optional, but no organisation-wide admin switch is described.","status":"not_published","url":"https://remote.com/policy/privacy-policy","locator":"AI safeguards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: from $29 per contractor per month (Contractor Management), only for contractors actively worked with that month; no EUR price or VAT shown.","status":"not_published","url":"https://remote.com/pricing","locator":"Work with global contractors: Contractor Management","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"remove-bg","name":"remove.bg","vendor":"Canva Austria GmbH (remove.bg)","category":"design-images-and-video","plans":[{"id":"T572","plan":"monthly subscription","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No by default: images are used to improve remove.bg only if the user chooses 'Yes, contribute image' in the feedback dialog. Customers may not use the service to produce AI training data.","status":"verified","url":"https://www.remove.bg/ipc","locator":"Feedback dialog on the Improvement Program Conditions page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Choose if you want us to use this image for quality improvements."},{"key":"training_opt_out","value":"Nothing to do by default. To keep an image out of improvement use, choose 'No, don't contribute' in the feedback dialog.","status":"verified","url":"https://www.remove.bg/ipc","locator":"Feedback dialog","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Choose if you do NOT want us to use this image for quality improvements."},{"key":"eu_residency_option","value":"No setting described for this plan. The sub-processor list puts main cloud hosting in the Netherlands/EU, with some US processing; the Enterprise page (a different plan) says all images are processed in the EU.","status":"not_published","url":"https://www.remove.bg/enterprise/solutions","locator":"Enterprise solutions page; /subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Cloud hosting in the Netherlands (Google), the EU (Microsoft Azure, Hetzner Germany); some processing in the US (MongoDB, Zendesk, Datadog, Cloudflare). Privacy policy: 'Europe and any other country' where it has facilities.","status":"verified","url":"https://www.remove.bg/subprocessors","locator":"Subprocessors, Third-Party Subprocessors table (data hosting location)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google Australia Pty Ltd Cloud server hosting The Netherlands"},{"key":"dpa","value":"Yes, built into the terms: companies that submit personal data are covered by the service's Data Processing Addendum, which they accept by using the service (remove.bg/dpa).","status":"verified","url":"https://www.remove.bg/gtc","locator":"9 Confidentiality and data privacy, 9.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If the Customer is a company and the Customer submits personal data, the Service’s Data Processing Addendum (available at www.remove.bg/dpa, www.unscreen.com/dpa, www.designify.com/dpa) shall apply."},{"key":"subprocessor_list","value":"Yes, public list at remove.bg/subprocessors (updated 8 Jan 2024): 11 rows, 7 third parties (Google, Microsoft Azure, Hetzner, MongoDB, Zendesk, Datadog, Cloudflare) and 4 Canva group companies. No AI model providers named.","status":"verified","url":"https://www.remove.bg/subprocessors","locator":"Subprocessors page, Third-Party Subprocessors and Canva Group Sub-Processor tables","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Operator engages the following Subprocessors to process certain customer personal data as set out in each Service’s Data Processing Addendum"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Canva Austria GmbH, Vienna, Austria)","status":"verified","url":"https://www.remove.bg/privacy","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are Canva Austria GmbH (\"Operator\", “We”, “Us”). This privacy policy applies to visitors and users of the Operator’s products"},{"key":"data_retention","value":"Files are deleted 'shortly after' the result is provided; no fixed period. Account data is kept while there is a business need. On ending the contract the DPA says personal data is destroyed or returned at the customer's choice.","status":"verified","url":"https://www.remove.bg/privacy","locator":"Before we get into the details; 6. How long we keep your personal data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We upload them securely, process them as you would expect, provide you with the results for download, then delete them shortly after."},{"key":"certifications","value":"Not stated for remove.bg itself; no certification found. The DPA only says its host, Google Cloud, is ISO/IEC 27001 compliant.","status":"not_published","url":"https://www.remove.bg/privacy","locator":"Privacy policy, terms, help page, Enterprise page; DPA annex (hosting)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide AI control described.","status":"not_published","url":"https://www.remove.bg/privacy","locator":"Privacy policy, help page, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page needs a browser to show plans and prices.","status":"not_captured","url":"https://www.remove.bg/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"replit","name":"Replit","vendor":"Replit, Inc.","category":"code-and-app-builders","plans":[{"id":"T89","plan":"Pro","tier":"business","price":{"label":"$90 / mo","amount":90,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless you opt out: Replit's Pro Agreement lets Replit use customer content to develop, train and improve its models and AI features; customers can opt out on the settings page","status":"verified","url":"https://replit.com/pro-agreement","locator":"Section 2(c) 'Customer Content'","url2":"https://replit.com/terms-of-service","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Yes, on the settings page, per the Pro Agreement","status":"verified","url":"https://replit.com/pro-agreement","locator":"Section 2(c) 'Customer Content'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://replit.com/pricing","locator":"Plan features","url2":"https://replit.com/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: Replit's services are primarily hosted in the US","status":"verified","url":"https://replit.com/privacy-policy","locator":"Section 'Cross-Border Data Transfers'","url2":"https://replit.com/subprocessors","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Replit's DPA (updated 1 Apr 2026) forms part of the Replit Commercial Agreement","status":"verified","url":"https://replit.com/dpa","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 49 entries, all in the US except IntouchCX (Canada); AI from Anthropic, OpenAI, Google, OpenRouter, Fireworks, Baseten and Parallel","status":"verified","url":"https://replit.com/subprocessors","locator":"Subprocessor list (last updated August 2026)","url2":"https://replit.com/dpa","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Replit'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Replit' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period during the subscription is stated; the customer may request return or deletion of personal data up to 90 days after the agreement ends","status":"verified","url":"https://replit.com/dpa","locator":"Section 'Termination and return or deletion'","url2":"https://replit.com/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II; Replit cites Google Cloud's ISO 27001 for its infrastructure, not its own","status":"verified","url":"https://trust.replit.com/","locator":"Compliance documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not on Pro: SSO, SCIM, audit logs and 'advanced privacy controls' are Enterprise features","status":"verified","url":"https://replit.com/pricing","locator":"Enterprise feature list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 90 per month billed annually (USD 100 monthly), including USD 100 in credits; higher credit tiers up to USD 2,000 a month","status":"not_published","url":"https://replit.com/pricing","locator":"Plan card 'Pro'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"resemble-ai","name":"Resemble AI Team","vendor":"Resemble AI, Inc.","category":"phone-and-voice","plans":[{"id":"T426","plan":"","tier":"business","price":{"label":"$350 / mo","amount":350,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in a limited form: the Terms let Resemble keep and use non-identifiable \"Aggregated Data\" derived from your content for \"internal learning and training\". Detection media is not used for training unless you opt in in writing.","status":"verified","url":"https://resemble.ai/terms-of-service","locator":"Content section: Aggregated Data; No model training on Detection Media","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Resemble AI shall retain and own all right, title and interest in and to such Aggregated Data, which may be used for troubleshooting, bug fixes, continuous development and improvement of our services and processes, internal learning and training"},{"key":"training_opt_out","value":"No opt-out is offered for Aggregated Data, which the Terms reserve for Resemble's internal learning and training. Detection media needs no opt-out: it is excluded from training unless you opt in in writing.","status":"verified","url":"https://resemble.ai/terms-of-service","locator":"Content section: No model training on Detection Media","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Detection Media is not used to train, fine-tune or otherwise improve Resemble AI’s models except where you have expressly opted in in writing."},{"key":"eu_residency_option","value":"No for self-service plans: regional hosting (e.g. UK) is only for enterprise customers under a negotiated agreement; self-service data is processed on the standard US infrastructure","status":"verified","url":"https://docs.google.com/document/d/1rlgjFE6sN0mB5MCuE_erMgMuXmPu-e_E/export?format=txt","locator":"Section 8.6","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Self-service customers acknowledge and accept that their data will be processed on Resemble AI's standard infrastructure."},{"key":"default_data_location","value":"United States: Google Cloud Platform us-east4 (Virginia), Render (Oregon) and Cerebrium (US)","status":"verified","url":"https://resemble.ai/privacy-policy","locator":"Transfers of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States through Resemble AI and its service providers, principally Google Cloud Platform (us-east4, Virginia), Render (Oregon) and Cerebrium (United States)."},{"key":"dpa","value":"Yes: Resemble AI publishes a Data Processing Agreement (last updated 17 March 2026) for business customers; the Terms incorporate it, and it includes EU SCCs","status":"verified","url":"https://resemble.ai/privacy-policy","locator":"Section 2 Our role when we serve business customers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our Data Processing Agreement, which governs the processing we carry out on behalf of business customers, is available at"},{"key":"subprocessor_list","value":"Yes, public at https://trust.resemble.ai/subprocessors, but the readable text shows 9 entries then a 'View all' link, so the full count was not captured. Visible: Anthropic, Apollo, Calendly, Cerebrium (AI inference), Cloudflare, Figma, Fireflies, GitHub, Gleap","status":"not_captured","url":"https://trust.resemble.ai/subprocessors","locator":"Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Resemble AI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Resemble AI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Text sent for speech synthesis and the generated audio are kept in an archive for retrieval and deleted within 30 days of your deletion request (support@resemble.ai). Voice models and training audio stay archived after the contract ends until you ask for deletion.","status":"verified","url":"https://docs.google.com/document/d/1rlgjFE6sN0mB5MCuE_erMgMuXmPu-e_E/export?format=txt","locator":"Annex 1 B: Text-to-Speech Inference; Section 11 Data Return and Deletion (DPA, last updated 17 March 2026)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Input text and generated audio retained for archival retrieval; deleted within 30 days of Controller's deletion request"},{"key":"certifications","value":"2 named: ISO/IEC 27001:2022 certified, and a SOC 2 Type II examination completed (Security, Availability, Confidentiality; 2026 report). The Trust Center also states GDPR and HIPAA compliance.","status":"verified","url":"https://trust.resemble.ai/","locator":"Compliance; Resources (2026 SOC 2 Type 2 Report, ISO 27001:2022 Certificate)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Resemble AI is ISO/IEC 27001:2022 certified."},{"key":"admin_ai_controls","value":"Not stated: no admin switch for AI features described; SSO is listed only from the Business plan up","status":"not_published","url":"https://resemble.ai/pricing","locator":"Pricing plan comparison","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $350 per month billed monthly, or $280 per month billed annually (Team, 5 seats included)","status":"not_published","url":"https://resemble.ai/pricing","locator":"Pricing cards: TEAM","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"retell-ai","name":"Retell AI","vendor":"Retell AI","category":"phone-and-voice","plans":[{"id":"T68","plan":"Pay as you go","tier":"business","price":{"label":"$0.07 / min","amount":null,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form, unless the customer opts out of recording: the terms let Retell use recorded calls and content, de-identified and aggregated, to develop, train and improve its AI models","status":"verified","url":"https://www.retellai.com/legal/terms-of-service","locator":"Clause on Communications ('If you do not opt-out of recording…'), terms updated 7 Oct 2026","url2":"https://www.retellai.com/legal/privacy-policy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Per agent: Security & fallback settings > Data Storage Settings, choose 'Everything except PII' or 'Basic Attributes Only' to stop storing transcripts and recordings; the terms link training to recordings that are not opted out","status":"verified","url":"https://docs.retellai.com/accounts/privacy-disable.md","locator":"'Data Storage Privacy Settings'","url2":"https://www.retellai.com/legal/terms-of-service","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://www.retellai.com/legal/privacy-policy","locator":"Section 'International Transfer of Data'","url2":"https://www.retellai.com/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: data is primarily stored and processed in the US","status":"verified","url":"https://www.retellai.com/legal/privacy-policy","locator":"Section 'International Transfer of Data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, by signature: a DPA (and a BAA) is obtained through Retell's legal agreements portal (click-agreements.retellai.com)","status":"verified","url":"https://trust.retellai.com/","locator":"Overview note on BAA and DPA","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 34 entries, mostly without a location shown; AI and speech: Azure (OpenAI, speech-to-text), OpenAI, Anthropic, Google Cloud, Cartesia, MiniMax, Fish Audio, ElevenLabs, Deepgram, Soniox, AssemblyAI and Fireworks AI; storage on AWS","status":"verified","url":"https://trust.retellai.com/subprocessors","locator":"Subprocessors list ('1-10 of 34 results', all pages read)","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Retell'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Retell' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept indefinitely by default; a retention period per agent deletes recordings, transcripts and logs automatically and permanently","status":"verified","url":"https://docs.retellai.com/accounts/data-retention.md","locator":"Data Retention Policy page","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2 and ISO 27001:2022; HIPAA, GDPR and CCPA attestation letters","status":"verified","url":"https://trust.retellai.com/","locator":"Compliance section and documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Per agent rather than organisation-wide: data storage mode and retention are set for each agent; custom SSO is an Enterprise feature","status":"verified","url":"https://docs.retellai.com/accounts/privacy-disable.md","locator":"Per-agent privacy settings","url2":"https://www.retellai.com/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 0.07 to 0.31 per minute for voice agents, pay as you go with no contract","status":"not_published","url":"https://www.retellai.com/pricing","locator":"Card 'Pay as you go'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"rev","name":"Rev","vendor":"Rev.com, Inc. (Austin, TX, USA)","category":"meetings-and-notes","plans":[{"id":"T403","plan":"Pro","tier":"business","price":{"label":"$47.99 / user / mo","amount":47.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes for Rev's own speech-recognition and AI models: customer content is analysed by them and can be used for continuous training. Rev says it is not used to train any generative AI model, and the models are not shared with third parties.","status":"verified","url":"https://www.rev.com/legal/terms","locator":"Section 4.2 Use of ASR and AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your Customer Content will be analyzed by our ASR models and other Rev artificial intelligence models and may be used for continuous training of those models."},{"key":"training_opt_out","value":"No opt-out stated: the terms say subscribers' content can be used for continuous training of Rev's own speech models, with no setting or request process described. Generative AI training is excluded by the terms.","status":"not_published","url":"https://www.rev.com/legal/terms","locator":"Section 4.2 Use of ASR and AI; privacy policy; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated for this plan: the DPA says that for certain services a customer may pick a geographic region from those available, but no EU region or plan is named.","status":"not_published","url":"https://www.rev.com/legal/data-processing-addendum","locator":"Geographic Region clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: Rev says it is located in the United States and personal data can be stored in or accessed from multiple countries, including the US. Its security page names Amazon S3 for storage.","status":"not_published","url":"https://www.rev.com/legal/privacy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: the Data Processing Addendum is part of the Terms of Service and applies when Rev processes personal data for the customer; no signing step is described.","status":"verified","url":"https://www.rev.com/legal/terms","locator":"Security; Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Rev processes any personal data of individuals on behalf of Customer, the parties agree to comply with the terms of the Data Processing Addendum, the terms of which are incorporated into this Agreement."},{"key":"subprocessor_list","value":"Yes, within the public DPA (Annex III): 18 entries; 7 apply to Rev.com (AWS, Azure, Google, Recall.ai, CoreWeave, Braintrust, eClerx) and the rest to rev.ai or SmartDepo.law. Mostly US; Speechmatics US/UK, eClerx India. Updated list on request to legal@rev.com.","status":"verified","url":"https://www.rev.com/legal/data-processing-addendum","locator":"Schedule 3 Annex III","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Rev keeps an up-to-date copy of all Subprocessors available upon request to legal@rev.com."},{"key":"dpf_status","value":"No listing found for search term 'Rev.com'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Rev.com' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for files and transcripts is published. Rev destroys personal data at the customer's written request; backups can be kept longer. Rev keeps its own call recordings with you for 12 months (not customer content).","status":"verified","url":"https://www.rev.com/legal/data-processing-addendum","locator":"Return and Destruction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Rev shall destroy all Personal Data at Customer’s written request, except to the extent Applicable Law requires storage of the Personal Data."},{"key":"certifications","value":"SOC 2 Type II, with a SOC 3 report available; PCI compliance as a merchant; GDPR. HIPAA is for the enterprise tier and CJIS for the Unlimited plan, so not Pro. 2 audited reports (SOC 2, SOC 3).","status":"verified","url":"https://www.rev.com/security","locator":"Industry-Leading Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"including CJIS, HIPAA*, SOC 2 Type II compliance, and our SOC 3 report is available for review."},{"key":"admin_ai_controls","value":"Not stated; the security page lists SSO (enterprise plans), multi-factor sign-in, domain claiming and file permissions, but no setting to switch AI features off.","status":"not_published","url":"https://www.rev.com/security","locator":"Account Security; Security FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $47.99 per seat/month billed annually ($575.88 a year) or $59.99 per seat/month billed monthly; Pro covers up to 5 seats.","status":"not_published","url":"https://www.rev.com/pricing","locator":"Pro plan card and Compare Our Plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"ringcentral-ai-receptionist","name":"RingCentral AI Receptionist","vendor":"RingCentral, Inc.","category":"phone-and-voice","plans":[{"id":"T420","plan":"standalone plan","tier":"business","price":{"label":"$49 / mo","amount":49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: RingCentral states it does not use customer personal data to train its models and does not let its third-party AI providers do so (AI Receptionist privacy datasheet)","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Use of Artificial Intelligence","url2":"https://assets.ringcentral.com/us/whitepaper/rc-ai-transparency.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral does not use customer personal data to train its models. RingCentral does not allow third parties to use customer personal data to train their AI models."},{"key":"training_opt_out","value":"Nothing to do: the AI Receptionist privacy datasheet says customer personal data is not used for training by RingCentral or its AI providers (no setting described)","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Use of Artificial Intelligence","url2":"https://assets.ringcentral.com/us/whitepaper/rc-ai-transparency.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral does not use customer personal data to train its models. RingCentral does not allow third parties to use customer personal data to train their AI models."},{"key":"eu_residency_option","value":"Yes, by account location: an account set up in Europe keeps customer-generated content in Germany; service account and usage data are held in the US and Germany. Some AI providers process in the US (e.g. xAI, Cartesia) and OpenAI in the US or Ireland per customer setting","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Location of Data Storage (table)","url2":"https://www.ringcentral.com/legal/dpa-subprocessor-list.html","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral stores personal data as part of the Services located in the following countries."},{"key":"default_data_location","value":"Depends on the account location: US accounts store everything in the US; UK accounts in the UK or Germany (service and usage data also in the US); accounts in Europe store customer-generated content, including call recordings, in Germany, with service account and usage data in the US and Germany","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Location of Data Storage (table)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral stores personal data as part of the Services located in the following countries."},{"key":"dpa","value":"Yes: the AI Receptionist datasheet says processing RingCentral does for customers is governed by the RingCentral Data Processing Addendum, incorporated into the Master Service Agreement; the DPA is published (Aug 2026 version)","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Intro paragraph (processor activities)","url2":"https://assets.ringcentral.com/legal/rc-global-customer-dpa.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"governed by the RingCentral Data Processing Addendum incorporated into the RingCentral Master Service Agreement."},{"key":"subprocessor_list","value":"Yes, public: https://www.ringcentral.com/legal/dpa-subprocessor-list.html (header \"updated 01-23-26\", change log to 8 Oct 2026). 52 rows (38 main list + 14 partner-programme); 13 rows (10 companies) name AI Receptionist: OpenAI, Google (4 rows), Microsoft, AWS, xAI, Deepgram, ElevenLabs, FireworksAI, Cartesia, ClickHouse","status":"verified","url":"https://www.ringcentral.com/legal/dpa-subprocessor-list.html","locator":"Page header and product columns","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral may use RingCentral’s affiliates or one or more of the following entities as subprocessors"},{"key":"dpf_status","value":"Active (RingCentral Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'RingCentral'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After cancellation the account is disabled at the end of the billing cycle and deleted within 30 days. Every AI Receptionist call is recorded and transcribed; how long recordings are kept is not stated. AI vendors get a zero-data-retention setup where available","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Data Deletion and Retention","url2":"https://assets.ringcentral.com/legal/rc-global-customer-dpa.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Once the account is disabled, the account will be deleted within 30 days, unless otherwise agreed with our customer."},{"key":"certifications","value":"Listed for RingEX (AI Receptionist is an add-on to it): ISO 27001, ISO 27017, ISO 27018, ISO 22301, SOC 2, SOC 3 and C5 (BSI) = 7. The page does not say whether AI Receptionist itself is in scope","status":"verified","url":"https://www.ringcentral.com/trust-center/compliance.html","locator":"Existing certifications and documentation","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"RingCentral maintains a comprehensive set of compliance certifications and attestations to protect our customers’ data and communications."},{"key":"admin_ai_controls","value":"Partly: customer system administrators activate AI Receptionist and add or remove the lines it answers; no separate organisation-wide AI policy switch is described","status":"verified","url":"https://assets.ringcentral.com/us/datasheet/rc-ai-receptionist-privacy-datasheet.pdf","locator":"Data Subjects","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer system administrators activate RingCentral AIR and can add or remove lines to which the Service responds."},{"key":"price_eur","value":"Shown in USD only: $49 per month for the standalone plan incl. 100 minutes; $0.50 per extra minute","status":"not_published","url":"https://www.ringcentral.com/pricing/ai-receptionist.html","locator":"FAQ: How much does RingCentral AI Receptionist cost?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"rippling","name":"Rippling Platform","vendor":"Rippling People Center Inc.","category":"documents-hr-and-finance","plans":[{"id":"T593","plan":"core, required","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, according to Rippling's AI marketing FAQ: 'Your usage data will not be used to train AI models.' The binding AI Services Terms could not be read, so this is a vendor statement and it says 'usage data', not explicitly customer content.","status":"vendor_statement","url":"https://www.rippling.com/ai","locator":"FAQs: How does Rippling AI handle data storage and model training?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your usage data will not be used to train AI models."},{"key":"training_opt_out","value":"Nothing to do, according to Rippling's AI FAQ (usage data is not used to train AI models); admins can also disable AI features. Binding AI Services Terms not read.","status":"vendor_statement","url":"https://www.rippling.com/ai","locator":"FAQs: How does Rippling AI handle data storage and model training?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your usage data will not be used to train AI models."},{"key":"eu_residency_option","value":"Not captured: the DPA and terms need a browser, and the public trust pages do not mention data residency.","status":"not_captured","url":"https://app.rippling.com/legal/dpa","locator":"DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not captured: the privacy, DPA and terms documents load only in a browser.","status":"not_captured","url":"https://app.rippling.com/legal/dpa","locator":"DPA / User Privacy Notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Rippling publishes a Data Processing Addendum under the core terms that apply to all Rippling products and services; its clauses could not be read.","status":"verified","url":"https://www.rippling.com/legal","locator":"Core terms: Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Rippling’s Data Processing Addendum outlines how we collect and process users’ personal information on behalf of our customers in Rippling’s capacity as a data processor."},{"key":"subprocessor_list","value":"Not captured: no sub-processor list could be found in the public pages, and the DPA (which may link one) needs a browser.","status":"not_captured","url":"https://app.rippling.com/legal/dpa","locator":"DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Rippling'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Rippling' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not captured: retention and deletion periods sit in the DPA and Customer Terms, which need a browser. The AI FAQ only says AI follows the core platform's storage standards.","status":"not_captured","url":"https://app.rippling.com/legal/dpa","locator":"DPA / Customer Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 1 Type 2, SOC 2 Type 2, SOC 3, CSA STAR Level 2, ISO 27001, ISO 27018 and ISO 42001 (7 named).","status":"verified","url":"https://www.rippling.com/trust/security","locator":"Compliance badges","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Rippling’s ISO 42001 certification demonstrates our commitment to secured and governed AI management."},{"key":"admin_ai_controls","value":"Yes, per Rippling's AI FAQ: admins can enable or disable AI features, manage AI admin permissions and configure data permissions at platform level.","status":"vendor_statement","url":"https://www.rippling.com/ai","locator":"FAQs: What admin controls are available with Rippling AI?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Admins can enable or disable AI features, manage Rippling AI admin permissions, and configure data permissions at the platform level."},{"key":"price_eur","value":"Not published: no amount is shown. Most products are billed per employee per month, some with a monthly base fee; the core Rippling Platform is required.","status":"not_published","url":"https://www.rippling.com/pricing","locator":"FAQs: How does Rippling pricing work?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"riverside","name":"Riverside","vendor":"RiversideFM, Inc.","category":"meetings-and-notes","plans":[{"id":"T386","plan":"Pro","tier":"business","price":{"label":"$24 / mo","amount":24,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: the terms license Riverside to use uploaded content for training and improving its AI and machine-learning models; no opt-out on Pro","status":"verified","url":"https://riverside.fm/terms-conditions","locator":"6.1 License to Riverside","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"training, testing, developing, and improving Riverside's artificial intelligence and machine learning models"},{"key":"training_opt_out","value":"No self-serve switch found; opting out of AI training is available only to Business-plan customers through a written agreement with Riverside","status":"verified","url":"https://riverside.fm/privacy-policy","locator":"11. Data Controller/Processor","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Content Data does not include personal data contained in content of Customers on a business plan who have opted out of AI training pursuant to a written agreement with Riverside."},{"key":"eu_residency_option","value":"Not stated: no EU-only storage option is described in the privacy policy, terms or pricing page","status":"not_published","url":"https://riverside.fm/privacy-policy","locator":"Looked at privacy policy, terms, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"No single default: data is stored and processed in the US, Canada, EU, UK, Israel, Mexico, Argentina, the Philippines and elsewhere; cloud storage is AWS in the USA","status":"verified","url":"https://riverside.fm/privacy-policy","locator":"4. Data Location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"maintain, store and process personal data in jurisdictions including the United States (US), Canada, European Union (EU), United Kingdom (UK), Israel, Mexico, Argentina, the Philippines"},{"key":"dpa","value":"Yes: a Data Processing Addendum or Agreement executed between the customer and Riverside governs personal data; how a Pro account gets it is not stated","status":"verified","url":"https://riverside.fm/terms-conditions","locator":"5.3 Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Riverside will process such Personal Data on your behalf and in accordance with the Data Processing Addendum or the Data Processing Agreement executed between you and us."},{"key":"subprocessor_list","value":"Yes, public list at riverside.com/subprocessors, last revised 22 May 2024: 11 sub-processors plus 4 subsidiaries and support providers (15 entries); AI: OpenAI, ElevenLabs, Hedra, Pika, HeyGen, Fal.ai","status":"verified","url":"https://riverside.com/subprocessors","locator":"Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Below is the list of our sub-processors with which we engage and with whom we may share Personal Data."},{"key":"dpf_status","value":"Active (RiversideFM Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'RiversideFM'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for recordings: the policy says data is kept as long as there is a legitimate need and covers user and prospect data; customers can delete their account","status":"not_published","url":"https://riverside.fm/privacy-policy","locator":"5. Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 and ISO 27001 are mentioned only as a reason to talk to Sales about the Business plan; no certificate statement for Pro on the pages read","status":"vendor_statement","url":"https://riverside.fm/pricing","locator":"FAQ: Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business becomes necessary when you need more than 100 webinar registrants, multiple producers managing a show, SSO, SOC2/ISO27001 compliance"},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide AI switch is described; Business adds production workspaces and custom roles","status":"not_published","url":"https://riverside.fm/pricing","locator":"Business features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $24 per month billed annually ($288 a year), $29 on monthly billing (Pro)","status":"not_published","url":"https://riverside.fm/pricing","locator":"Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"rocket-chat","name":"Rocket.Chat","vendor":"Rocket.Chat Technologies Corp.","category":"workspace-and-projects","plans":[{"id":"T474","plan":"Commercial","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. No training clause found in the Customer Terms of Service, privacy policy, subprocessors, DPA, AI docs or pricing page. Rocket.Chat AI is an add-on that needs the customer's own LLM; Rocket.Chat provides no hosted LLM.","status":"not_published","url":"https://docs.rocket.chat/docs/rocket-chat-ai-faq","locator":"Rocket.Chat AI FAQ; Customer Terms of Service; privacy policy; Rocket.Chat AI docs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes, users must bring their own LLM deployment. Rocket.Chat does not provide any hosted options."},{"key":"training_opt_out","value":"Not stated. No training clause found, so no opt-out step is documented.","status":"not_published","url":"https://docs.rocket.chat/docs/customer-terms-of-service","locator":"Customer Terms of Service; privacy policy; Rocket.Chat AI docs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes. Self-managed deployments keep data wherever the customer hosts them, and for Rocket.Chat-hosted workspaces the customer determines the location at onboarding; specific EU regions are not named.","status":"verified","url":"https://docs.rocket.chat/docs/subprocessors","locator":"Subprocessors, Infrastructure subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The customer determines the location where an instance of our hosted offering is deployed during onboarding."},{"key":"default_data_location","value":"The customer's own infrastructure (on-premises, private cloud or isolated) for Commercial; for Rocket.Chat-hosted workspaces the customer picks the location at onboarding (providers listed: OVH, AWS).","status":"verified","url":"https://docs.rocket.chat/docs/subprocessors","locator":"Subprocessors, Infrastructure subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The customer determines the location where an instance of our hosted offering is deployed during onboarding."},{"key":"dpa","value":"Yes. A pre-signed Data Processing Agreement with EU Standard Contractual Clauses is available; the customer completes and signs it online (request via email code, sign through Zoho Sign). It covers the hosted offering and push/marketplace services.","status":"verified","url":"https://docs.rocket.chat/docs/data-processing-agreement-gdpr","locator":"Data Processing Agreement (GDPR)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"It is pre-signed and only needs to be signed from your end for your compliance purposes."},{"key":"subprocessor_list","value":"Yes, public: https://docs.rocket.chat/docs/subprocessors (effective 6 March 2025). 12 third-party rows (3 infrastructure, 7 service-specific, 2 innovation) plus 2 affiliates. No AI model providers listed.","status":"verified","url":"https://docs.rocket.chat/docs/subprocessors","locator":"Subprocessors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The list below identifies subcontractors (subprocessors) that Rocket.Chat may be used to process personal data while provisioning our services."},{"key":"dpf_status","value":"No listing found for search term 'Rocket.Chat'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Rocket.Chat' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"The customer can export all data and request deletion of accounts. After the agreement ends the customer must retrieve data within 30 business days, after which Rocket.Chat may delete it irrecoverably. Commercial adds granular retention policies.","status":"verified","url":"https://docs.rocket.chat/docs/customer-terms-of-service","locator":"Customer Terms of Service, Appendix 2 (Cloud Hosting), data retrieval after termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer will retrieve its Data or copies of its Data from Rocket.Chat within thirty (30) business days of the termination or expiration of this Agreement Terms."},{"key":"certifications","value":"Not captured: the trust centre listing certifications returned 403. The security programme page says Rocket.Chat 'adopted the ISO 27001 framework' with internal audits; no certificate is stated there.","status":"not_captured","url":"https://trust.rocket.chat/","locator":"Rocket.Chat Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Admins manage Rocket.Chat AI from Manage > Workspace > AI Center. AI is a paid add-on that needs the customer's own LLM connected, so it runs only if the customer sets it up.","status":"verified","url":"https://docs.rocket.chat/docs/rocket-chat-ai","locator":"Rocket.Chat AI overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Administrators can manage Rocket.Chat AI from Manage > Workspace > AI Center."},{"key":"price_eur","value":"No public price. The Commercial plan shows 'Get pricing' (sales quote); user count is 'Custom'. A free Starter plan (up to 50 users) exists for small businesses.","status":"not_published","url":"https://www.rocket.chat/pricing","locator":"Pricing page, Commercial plan and Starter line","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For technical evaluation, small businesses, and non-profits: Try Starter."}]}]},{"slug":"runway","name":"Runway","vendor":"Runway AI, Inc.","category":"design-images-and-video","plans":[{"id":"T551","plan":"Team","tier":"business","price":{"label":"$69 / user / mo","amount":69,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. The Terms of Use let Runway use prompts and generated outputs to train and improve its AI models and describe no opt-out. The 'no training on your data' line is listed only under the Enterprise plan.","status":"verified","url":"https://runwayml.com/terms-of-use","locator":"4.4 User Inputs and Outputs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You acknowledge that Inputs and Outputs may be used by the Company to train and improve its AI models, algorithms and related technology, products and services"},{"key":"training_opt_out","value":"No opt-out found for the Team plan. Terms 4.4 describe none, and 'no training on your data' is listed only for Enterprise (sales).","status":"not_published","url":"https://runwayml.com/terms-of-use","locator":"Looked in: Terms of Use 4.3-4.4, Privacy Policy, Team plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data-storage option is described on any public page.","status":"not_published","url":"https://runwayml.com/data-security","locator":"Looked in: Data Security page, Privacy Policy, Team plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated. The privacy policy says Runway is headquartered in the United States and transfers data to the United States; no hosting region is named.","status":"not_published","url":"https://runwayml.com/privacy-policy","locator":"Looked in: Privacy Policy (Data retention / transfers), Data Security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for the Team plan; no data processing agreement is mentioned in the Terms of Use, privacy policy, security page or Team page.","status":"not_published","url":"https://runwayml.com/terms-of-use","locator":"Looked in: Terms of Use, Privacy Policy, Data Security page, Team plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not readable: the Data Security page says a list for enterprise customer data is at runway.com/subprocessors, but that address returned 404 on 2026-10-19. No count possible.","status":"not_published","url":"https://runwayml.com/data-security","locator":"Third-Party Risk Management > Service Provider Directory","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Runway AI'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Runway AI' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for prompts or content: information is kept only as long as necessary. Face scans and voiceprints are kept up to three years after last interaction. No customer-set period is described.","status":"verified","url":"https://runwayml.com/privacy-policy","locator":"Data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will retain your information for only as long as necessary to provide the Service and for the other legitimate business purposes set out in this Policy such as safety, security, compliance, and dispute resolution."},{"key":"certifications","value":"2: SOC 2 Type II and ISO/IEC 27001. Reports and certificate are available to Enterprise customers via the Trust Center.","status":"verified","url":"https://runwayml.com/data-security","locator":"Compliance & Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Runway maintains SOC 2 Type II certification, validating our security controls through rigorous independent auditing."},{"key":"admin_ai_controls","value":"Not offered on Team: the Team page lists roles, sharing policies and control over which third-party models a team can use as Enterprise features.","status":"verified","url":"https://runway.com/team-plan","locator":"FAQ: When should we consider Enterprise instead?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise is the next step once you outgrow nine seats or one workspace, or need security and admin controls like SSO, roles and permissions, sharing policies and control over which third-party models your team can use."},{"key":"price_eur","value":"Shown in USD only: $69 per seat per month, or $55 per seat per month billed yearly (20% off); 6,900 credits per seat per month, pooled. For 2 to 9 people.","status":"not_published","url":"https://runway.com/team-plan","locator":"Team plan page, Team card and FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"rytr","name":"Rytr","vendor":"Rytr LLC","category":"writing-and-email","plans":[{"id":"T341","plan":"Pro","tier":"personal","price":{"label":"$49 / mo","amount":49,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no clause on training AI models found in the privacy policy, terms of use or security and trust page.","status":"not_published","url":"https://rytr.me/trust/privacy-policy","locator":"Looked at privacy policy, terms of use, security and trust, pricing, teams page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated: no setting or email to stop training is described.","status":"not_published","url":"https://rytr.me/trust/privacy-policy","locator":"Looked at privacy policy, terms, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: no EU data-location option found.","status":"not_published","url":"https://rytr.me/trust/privacy-policy","locator":"Looked at privacy policy, terms, security and trust, Teams page, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: servers and central databases are located there.","status":"verified","url":"https://rytr.me/trust/privacy-policy","locator":"What happens when you use our Services from outside your region?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"please be mindful that such information may be transferred, stored or processed in the United States where our servers or central databases are located."},{"key":"dpa","value":"Not stated: no data processing agreement mentioned on the privacy policy, terms, security page or Teams page.","status":"not_published","url":"https://rytr.me/solutions/teams-and-enterprise","locator":"Looked at privacy policy, terms, security and trust, Teams and Enterprise page, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not stated: no public sub-processor list found (0 entries); the privacy policy names only SendGrid (email) and Stripe (payments) as example providers, no AI model providers.","status":"not_published","url":"https://rytr.me/trust/privacy-policy","locator":"Looked at privacy policy (With whom we share your information), terms, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Rytr'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Rytr' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: kept as long as necessary for the policy's purposes and legal duties; you can request deletion in account settings. Teams page mentions 'retention choices' without detail.","status":"verified","url":"https://rytr.me/trust/privacy-policy","locator":"Retention of Your Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy."},{"key":"certifications","value":"Not stated: the security and trust page names no certification (0 named).","status":"not_published","url":"https://rytr.me/trust/security-and-trust","locator":"Security and trust page headings; privacy policy; Teams page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for Pro. The Teams and Enterprise page mentions identity and rollout controls, not switches for AI features.","status":"not_published","url":"https://rytr.me/solutions/teams-and-enterprise","locator":"What Rytr offers your team","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $49 per month (Pro); yearly billing saves 20%.","status":"not_published","url":"https://rytr.me/pricing","locator":"Pricing cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"salesflare","name":"Salesflare","vendor":"Salesflare BVBA (Antwerp, Belgium)","category":"sales-marketing-and-support","plans":[{"id":"T507","plan":"Growth","tier":"business","price":{"label":"€29 / user / mo","amount":29,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI or model-training clause found in the terms or privacy policy, although the product advertises 'AI suggestions'.","status":"not_published","url":"https://salesflare.com/terms","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://salesflare.com/terms","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU storage option found.","status":"not_published","url":"https://salesflare.com/terms","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for customer data. The privacy policy lists Google Cloud Storage as a hosting service, with place of processing given as US, but does not say where Salesflare stores customer content.","status":"not_published","url":"https://salesflare.com/privacy","locator":"Privacy policy (iubenda), Google Cloud Storage entry","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, on request: the terms say a Data Processing Agreement is available to the customer on request through a form link.","status":"verified","url":"https://salesflare.com/terms","locator":"11. Data Protection, 11.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Further agreements regarding the processing of Personal Data are arranged in a Data Processing Agreement (DPA), which can be requested by the Customer"},{"key":"subprocessor_list","value":"No dedicated sub-processor list found; the privacy policy lists third-party services (for example Google Cloud Storage) as its tools.","status":"not_published","url":"https://salesflare.com/privacy","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page; no /subprocessors page (404)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Salesflare BVBA, Antwerp, Belgium)","status":"verified","url":"https://salesflare.com/terms","locator":"Definitions, Provider","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Provider means Salesflare BVBA, a company incorporated in Belgium having its registered office at Rijnkaai 37 box 4, 2000 Antwerp, Belgium"},{"key":"data_retention","value":"A daily backup copy of customer data is made; no retention period or deletion period after cancellation is stated.","status":"verified","url":"https://salesflare.com/terms","locator":"6. Customer Data, 6.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Provider shall create a daily backup copy of the Customer Data."},{"key":"certifications","value":"Not stated; no security certification named and no security or trust page found (/security returns 404).","status":"not_published","url":"https://salesflare.com/terms","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features (AI suggestions) found.","status":"not_published","url":"https://salesflare.com/pricing","locator":"Looked in terms, privacy policy (iubenda-hosted), pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€29 per user per month billed annually (€39 per user per month billed monthly) for Growth; VAT treatment not stated.","status":"verified","url":"https://salesflare.com/pricing","locator":"Plans & Pricing, Growth","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Growth ## €39 /month ## €29 /month (save €10) per user"}]}]},{"slug":"salesforce-sales-cloud","name":"Salesforce Sales Cloud","vendor":"Salesforce, Inc. (f/k/a salesforce.com, inc.)","category":"sales-marketing-and-support","plans":[{"id":"T490","plan":"Pro Suite","tier":"business","price":{"label":"€100 / user / mo","amount":100,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Salesforce's own models. Salesforce says prompts and answers sent through its Trust Layer are never stored or used to train the third-party large language models it connects to.","status":"vendor_statement","url":"https://www.salesforce.com/artificial-intelligence/trusted-ai/","locator":"Zero Data Retention and Data Masking section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"prompts and generated responses are never stored or used to train the underlying third-party large language models"},{"key":"training_opt_out","value":"Not captured: Salesforce lists an 'Einstein Global Model Opt Out' help article, but help.salesforce.com needs a browser so the steps were not read.","status":"not_captured","url":"https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/salesforce-trusted-ai-resources.pdf","locator":"Relevant Salesforce Help articles list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes. A Germany/France region is listed for the Salesforce Services; choose it at set-up or ask your account executive to move data later (subject to availability). AI add-ons may run on separate infrastructure.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf","locator":"Sub-processors Storing Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You may also request to have your Customer Data for a Covered Service or feature hosted in a different region, which may be accommodated, subject to availability."},{"key":"default_data_location","value":"No single default stated. Salesforce lists regions per service; for the Salesforce Services (incl. Sales Cloud) Germany and France appear as a region. The customer picks the region at set-up or via an account executive.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf","locator":"Sub-processors Storing Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Customer may be able to choose their region during the setup process or by working with an Account Executive"},{"key":"dpa","value":"Yes. The Data Processing Addendum is part of the Main Services Agreement by reference; EU/UK/Swiss transfers rely on Salesforce's Binding Corporate Rules and/or Standard Contractual Clauses, treated as signed on accepting the agreement.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/salesforce_MSA.pdf","locator":"Section 2.2 Protection of Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"posted as of the Effective Date are hereby incorporated by reference"},{"key":"subprocessor_list","value":"Yes. Public 'Infrastructure and Sub-processors' document (published 2 Oct 2026) at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf lists sub-processors and countries per service, with a sign-up for change notices. Entries not counted (320,000-character multi-service document). OpenAI, L.L.C. appears as a generative AI provider.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf","locator":"Scope and Sub-processor Notifications sections","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This documentation describes the infrastructure environment, sub-processors and certain other entities material to the services"},{"key":"dpf_status","value":"Active (Salesforce; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'salesforce.com, inc'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After all subscriptions end: data kept inactive for 120 days, then deleted from production within 90 days and from backups within 180 days. Customer can ask for a copy within 30 days of termination. Retention of AI prompts not stated here.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf","locator":"Return of Customer Data / Deletion of Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"for 120 days, after which it is securely overwritten or deleted from production within 90 days, and from"},{"key":"certifications","value":"12 audits/certifications listed for the covered services: ISO 27001/27017/27018, SOC 1/2/3, C5, HITRUST, PCI, ISMAP, ENS High, HDS, Japan CS Gold, plus privacy ones (APEC PRP, EU/UK BCR, DPF). Each applies to one or more services.","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf","locator":"Audits and Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"achieved ISO 27001/27017/27018 certification for its ISMS from an independent third party. The"},{"key":"admin_ai_controls","value":"Partly stated: customers can disable Sales Cloud's Account Intelligence features. A whole-organisation AI switch is not described in the documents read.","status":"not_published","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-security-privacy-and-architecture.pdf","locator":"Third-Party Functionality (Account Intelligence)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers can disable the Account Intelligence features."},{"key":"price_eur","value":"€100 per user/month, billed annually (Pro Suite). VAT treatment not shown on the page.","status":"verified","url":"https://www.salesforce.com/eu/sales/pricing/","locator":"Sales Pricing page, Pro Suite card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro Suite The flexible CRM suite with more automation and customisation across sales, service, marketing, and commerce. 100 € EUR/User/Month (Billed annually)"}]}]},{"slug":"salesloft","name":"Salesloft","vendor":"Salesloft, Inc. (Sunnyvale, California; Clari/Salesloft)","category":"writing-and-email","plans":[{"id":"T373","plan":"Cadence, quote-based","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The MSA lets Salesloft use customer data in aggregated, anonymized form to provide, maintain and improve the Services; no AI-model training statement found. The privacy policy's no-training line explicitly excludes products.","status":"not_published","url":"https://www.salesloft.com/legal/msa-2026-02-10","locator":"3.2 Customer License","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"and in an aggregated and anonymized form in order to provide, maintain and improve the Services."},{"key":"training_opt_out","value":"Not stated; no AI-training clause or opt-out found in the MSA, DPA, security page or privacy policy.","status":"not_published","url":"https://www.salesloft.com/legal/msa-2026-02-10","locator":"3.2 Customer License","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated. Pages say hosting is in the US and the EU but describe no customer setting or plan for keeping data in the EU.","status":"not_published","url":"https://www.salesloft.com/security-compliance","locator":"Data Centers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"The Salesloft platform is hosted on AWS and Google Cloud in the US and the EU; the Drift product runs on AWS in the US. Which region a given customer gets is not stated.","status":"verified","url":"https://www.salesloft.com/security-compliance","locator":"Data Centers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Salesloft platform is hosted at Amazon and Google data centers, running on Amazon Web Service (AWS) and Google Cloud Platform (GCP) technology, in the US and the EU."},{"key":"dpa","value":"Yes. The MSA says each party agrees to comply with the DPA, which is incorporated into the agreement; the DPA includes Standard Contractual Clauses.","status":"verified","url":"https://www.salesloft.com/legal/msa-2026-02-10","locator":"1.4 Security and Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Each party agrees to comply with the DPA, which is incorporated into this Agreement."},{"key":"subprocessor_list","value":"Partly public: Clari's list at https://www.salesloft.com/legal/clari-subprocessors has 22 entries incl. AWS, Google Cloud, Microsoft Azure (AI analysis), 1Mind and Ada (AI). The Salesloft/Drift list is only in the trust portal (needs browser).","status":"verified","url":"https://www.salesloft.com/legal/clari-subprocessors","locator":"Clari List of Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Azure USA Service provider Artificial Intelligence analysis and insights"},{"key":"dpf_status","value":"Active (Salesloft; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Salesloft'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On request within 90 days after the subscription ends, Salesloft returns or deletes personal data; after 90 days it has no obligation to keep it. No in-product retention setting described.","status":"verified","url":"https://www.salesloft.com/legal/data-processing-addendum","locator":"4 f) Deletion or Return of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon request made by Customer within ninety (90) days following the expiration or termination of the Subscription Term, Salesloft will return or delete the Personal Data"},{"key":"certifications","value":"3 named on the security page: SOC 2 Type 2, ISO 27001, ISO 27701. The trust centre also shows a CSA badge plus GDPR, CCPA and DPF badges.","status":"verified","url":"https://www.salesloft.com/security-compliance","locator":"SOC 2 Type 2 / ISO 27001","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Salesloft and Drift platform services undergo SOC 2 Type 2 examinations"},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features found on the security, MSA, DPA or AI-agents pages.","status":"not_published","url":"https://www.salesloft.com/security-compliance","locator":"Security and compliance page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published. The pricing link leads to a 'book time with us' sales page; no plan names or prices are shown.","status":"not_published","url":"https://www.salesloft.com/pricing","locator":"Pricing page (redirects to see-it-live)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"scite","name":"Scite","vendor":"Scite, LLC (a Research Solutions company)","category":"research-forms-and-storage","plans":[{"id":"T622","plan":"Pro, team seats","tier":"business","price":{"label":"$40 / user / mo","amount":40,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Scite's Terms of Service (section 7.3) say its licence to user content does not include any right to use Customer Data for training, fine-tuning or improving large language models or other machine-learning systems; the privacy policy repeats this.","status":"verified","url":"https://scite.ai/terms","locator":"7.3 Media licence (Terms of Service)","url2":"https://scite.ai/policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"this license does not include any right to use Customer Data (including Media) for the training, fine-tuning, retraining, or improvement of large language models or other machine learning systems"},{"key":"training_opt_out","value":"Nothing to do: Scite's Terms of Service and privacy policy state it does not use Customer Data to train, fine-tune or improve AI models.","status":"verified","url":"https://scite.ai/terms","locator":"7.3 Media licence (Terms of Service)","url2":"https://scite.ai/policy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"this license does not include any right to use Customer Data (including Media) for the training, fine-tuning, retraining, or improvement of large language models or other machine learning systems"},{"key":"eu_residency_option","value":"Not stated. No EU hosting option is described for Pro; the policy only describes standard contractual clauses for transfers to the US.","status":"not_published","url":"https://scite.ai/policy","locator":"Additional Disclosures for Residents of the EU and UK","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Scite says most operations are conducted in the United States and personal information is processed there. No hosting provider named.","status":"verified","url":"https://scite.ai/policy","locator":"Additional Disclosures for Residents of the EU and UK","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"most of our operations are conducted in the United States and in order to provide the Service, personal information will be processed in the United States"},{"key":"dpa","value":"Not stated. No data processing agreement is published; the privacy policy mentions EU Standard Contractual Clauses for transfers from the EEA.","status":"not_published","url":"https://scite.ai/policy","locator":"Additional Disclosures for Residents of the EU and UK","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found in the privacy policy, terms or pricing page.","status":"not_published","url":"https://scite.ai/policy","locator":"Privacy policy, terms, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Scite', 'Research Solutions'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Scite', 'Research Solutions' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data is kept while the account exists plus 10 years after that to meet contract obligations; Scite will securely delete it on request. Marketing data is kept up to 10 years from last contact.","status":"verified","url":"https://scite.ai/policy","locator":"Retention of Your Personal Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"related to your account for as long as you have an account with us in order to meet our contractual obligations to you and for 10 years after that"},{"key":"certifications","value":"Not stated. No SOC 2, ISO 27001 or similar certification is named in the privacy policy, terms or pricing page.","status":"not_published","url":"https://scite.ai/pricing/","locator":"Pricing page, privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not offered or not stated on Pro. Admin-style access controls (SSO, IP, domain) are listed only for Enterprise.","status":"not_published","url":"https://scite.ai/pricing/","locator":"Pricing page, Enterprise card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Access via SSO, IP, domain, or email"},{"key":"price_eur","value":"Shown in USD only: Pro $40 per month per seat, billed yearly; teams add seats and get Pro on one bill. No EUR price; VAT not shown.","status":"not_published","url":"https://scite.ai/pricing/","locator":"Pricing page, team-seat line","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Pro at $40 per seat now, Enterprise later."}]}]},{"slug":"se-ranking","name":"SE Ranking","vendor":"SER Acquisition Inc. (Delaware, US) / Seranking Ltd (London, UK), joint controllers","category":"sales-marketing-and-support","plans":[{"id":"T526","plan":"Core","tier":"business","price":{"label":"€87.20 / mo","amount":87.2,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for generalized AI/ML models: the Privacy Statement says personal data it covers (including AI prompts and files) is not used to train them. Terms still give SE Ranking a perpetual licence to content within its aggregated statistics.","status":"verified","url":"https://seranking.com/legal/privacy-statement.html","locator":"Data Processing, Storage and Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SE Ranking does not use any of the personal data processed in accordance with current Privacy Statement for the purposes of developing, improving, or training generalized Artificial Intelligence (AI) and/or Machine Learning (ML) models."},{"key":"training_opt_out","value":"Nothing to do for generalized AI/ML model training: the Privacy Statement says covered personal data is not used for it. No setting exists or is needed.","status":"verified","url":"https://seranking.com/legal/privacy-statement.html","locator":"Data Processing, Storage and Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SE Ranking does not use any of the personal data processed in accordance with current Privacy Statement for the purposes of developing, improving, or training generalized Artificial Intelligence (AI) and/or Machine Learning (ML) models."},{"key":"eu_residency_option","value":"Not stated; no setting to choose an EU data location found.","status":"not_published","url":"https://seranking.com/legal/privacy-statement.html","locator":"Special Provisions for EEA residents; Terms of Service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated which country holds customer data by default; the processor list names hosting providers Hetzner (Germany), Amazon Web Services EMEA (Luxembourg) and Google (United States).","status":"not_published","url":"https://seranking.com/legal/processors.html","locator":"The list of current processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for customers; the processors page says SE Ranking signs data processing agreements with its own processors, and no customer DPA is published.","status":"not_published","url":"https://seranking.com/legal/processors.html","locator":"Processors page; Terms of Service; Privacy Statement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Yes, public at seranking.com/legal/processors.html: 39 entries; AI-related: Anthropic PBC (AI model and generative AI services), Cloudflare (AI agents infrastructure); terms also name OpenRouter for SE Visible.","status":"verified","url":"https://seranking.com/legal/processors.html","locator":"The list of current processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic PBC AI model and generative AI services United States of America"},{"key":"dpf_status","value":"Active (SE Ranking (Wilmington, DE); EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'SE Ranking'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Account data is kept while you have active services; support enquiries 5 calendar years, contract-performance data up to 10 years. Projects can be deleted after 60 days of non-use or 60 days after an overdue payment.","status":"verified","url":"https://seranking.com/legal/terms-of-service.html","locator":"Account and Projects","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Provider reserves the right to delete Projects unilaterally, created by the Customer if the Customer’s account is not used for 60 days."},{"key":"certifications","value":"Not stated; no ISO 27001 or SOC 2 named on the legal pages or site pages checked.","status":"not_published","url":"https://seranking.com/legal.html","locator":"Legal index; security and trust-centre URLs returned 404","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features documented in the terms or pricing page.","status":"not_published","url":"https://seranking.com/legal/terms-of-service.html","locator":"Terms of Service; Specific Terms (AI Search, BVA)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€87.20 per month billed annually (€109.00 per month on monthly billing); VAT not shown.","status":"verified","url":"https://seranking.com/pricing.html","locator":"Core plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SEO + GEO for marketing teams with repeatable delivery €87.20 €109.00 /mo"}]}]},{"slug":"seamless-ai","name":"Seamless.AI","vendor":"Seamless Contacts Inc. dba Seamless.AI (USA)","category":"sales-marketing-and-support","plans":[{"id":"T505","plan":"paid plan","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training clause found in the terms of use, privacy policy or GDPR notice.","status":"not_published","url":"https://seamless.ai/policies/terms-of-use","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://seamless.ai/policies/terms-of-use","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU storage option found.","status":"not_published","url":"https://seamless.ai/policies/privacy-policy","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States or any other country where Seamless.AI or its service providers operate; no specific region is named.","status":"verified","url":"https://seamless.ai/policies/privacy-policy","locator":"Section 11 International Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Seamless.AI may store, access, or use your personal data in the United States or in any other country"},{"key":"dpa","value":"Not stated; no data processing agreement is published. The privacy policy only says standard contractual clauses are used where customers require it.","status":"not_published","url":"https://seamless.ai/policies/privacy-policy","locator":"Privacy policy section 11 International Transfers; terms; GDPR notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public list found.","status":"not_published","url":"https://seamless.ai/policies/privacy-policy","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice; no /policies/subprocessors page (404)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Seamless'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Seamless' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: personal data is kept as long as reasonably required for legal obligations and business purposes, including providing services to customers.","status":"verified","url":"https://seamless.ai/policies/privacy-policy","locator":"Data retention section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Seamless.AI retains personal data for as long as reasonably required to comply with our legal obligations"},{"key":"certifications","value":"Not stated; no security certification named in the terms, privacy policy or GDPR notice, and no trust page found (/security, /trust return 404).","status":"not_published","url":"https://seamless.ai/policies/privacy-policy","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features found.","status":"not_published","url":"https://seamless.ai/policies/terms-of-use","locator":"Looked in terms of use, privacy policy, GDPR Article 14 notice","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page is empty without JavaScript.","status":"not_captured","url":"https://seamless.ai/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"sembly","name":"Sembly","vendor":"Sembly AI, Inc.","category":"meetings-and-notes","plans":[{"id":"T382","plan":"Pro","tier":"business","price":{"label":"$20 / user / mo","amount":20,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless the workspace opts out: Enterprise content is never used for training, other plans have an opt-out; content used is PII-redacted and anonymized. The terms of service also license Sembly to use recordings and transcripts for AI development and training","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"Information We Collect","url2":"https://www.sembly.ai/terms-of-service","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We DO NOT use audio, video, or text data from Enterprise Plan customers for model training. Other plans can manage this with opt-out setting."},{"key":"training_opt_out","value":"Use the opt-out for model training (non-Enterprise plans); the policy says to 'let us know' and does not give a menu path","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"Your Rights and Choices","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You have the right to opt out from Sembly AI including any content from your workspace for AI model training."},{"key":"eu_residency_option","value":"Yes: Sembly offers local data storage in EU-based data centres for EU users, with personal data stored inside the EEA; the plan it applies to is not stated","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"EU data storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sembly AI now offers a local data storage option in our EU-based data centers."},{"key":"default_data_location","value":"United States by default (where Sembly's AI processing runs); EEA for customers who choose the EU storage option","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"Artificial Intelligence (AI) Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"in the United States by default and in the EEA for customers who choose EU data storage"},{"key":"dpa","value":"Not stated: the privacy policy says Sembly acts as processor on a customer's instructions but names no data processing agreement, and none was found on the site","status":"not_published","url":"https://www.sembly.ai/privacy-policy","locator":"Looked at privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A list exists at go.sembly.ai/subprocessors, a Google Drive document that could not be read, so entries are not counted","status":"not_captured","url":"https://go.sembly.ai/subprocessors","locator":"Section 7 of privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Sembly AI; EU-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Sembly'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept per the customer's selected retention settings (Pro has retention settings and 2 years of history); users can delete content; deleted content is removed from production and can remain in backups up to 14 days","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Retained according to the user’s or customer’s selected retention settings."},{"key":"certifications","value":"1 named: SOC 2 audits (type not stated in the privacy policy)","status":"verified","url":"https://www.sembly.ai/privacy-policy","locator":"Sharing and Transparency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We maintain comprehensive compliance measures including SOC 2 audits."},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide switch for turning AI features off is described on the pricing page or privacy policy","status":"not_published","url":"https://www.sembly.ai/pricing","locator":"Looked at pricing comparison","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $20 per user per month, billed annually (Pro, 3 to 40 users)","status":"not_published","url":"https://www.sembly.ai/pricing","locator":"Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$20 per user / month, billed annually"}]}]},{"slug":"semrush","name":"Semrush One","vendor":"Semrush Inc. (Delaware corporation, Boston, MA)","category":"sales-marketing-and-support","plans":[{"id":"T523","plan":"Starter, SEO + AI Search","tier":"business","price":{"label":"€158.40 / mo","amount":158.4,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: Semrush says it does not train its models, and does not let its third-party AI providers train, on what you enter into its generative AI features.","status":"verified","url":"https://www.semrush.com/company/legal/semrush-artificial-intelligence-services-terms/","locator":"AI Generative Services Specifics and Principles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Semrush does not train or develop its models, and does not allow its third-party providers to train or develop its models on User Input."},{"key":"training_opt_out","value":"Nothing to do: the AI Terms state Semrush and its AI providers do not train on what you enter into generative AI features.","status":"verified","url":"https://www.semrush.com/company/legal/semrush-artificial-intelligence-services-terms/","locator":"AI Generative Services Specifics and Principles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Semrush does not train or develop its models, and does not allow its third-party providers to train or develop its models on User Input."},{"key":"eu_residency_option","value":"Not stated; the security page says service data is stored in the United States and no EU option is described.","status":"not_published","url":"https://www.semrush.com/company/security/","locator":"Security of data centers; sub-processor list; DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (data centres run on Amazon Web Services, Google Cloud Platform and Digital Realty).","status":"verified","url":"https://www.semrush.com/company/security/","locator":"Security of data centers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Semrush stores its service data at physically secure data centers in the United States."},{"key":"dpa","value":"Yes: the Data Processing Addendum is incorporated into the agreement without further signatures.","status":"verified","url":"https://www.semrush.com/company/legal/data-processing-agreement/","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"this DPA will form an integral part of the Agreement without the need for any additional signatures"},{"key":"subprocessor_list","value":"Yes, public at semrush.com/company/legal/sub-processors/: 9 entries (AWS counted once, listed with locations USA and Ireland); no AI model provider appears in the list.","status":"verified","url":"https://www.semrush.com/company/legal/sub-processors/","locator":"Approved Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services Cloud Storage USA Ireland"},{"key":"dpf_status","value":"No listing found for search term 'Semrush'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Semrush' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After cancellation or account deletion Semrush may erase your data after a reasonable period of at least 30 days, and may keep copies for legal, archival or backup reasons; no fixed period while the account is active.","status":"verified","url":"https://www.semrush.com/company/legal/terms-of-service/","locator":"Effect of Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Semrush may erase all Customer data and information stored on Semrush servers within reasonable period of time (not less than thirty (30) days)"},{"key":"certifications","value":"1 named: PCI DSS Level 1; no ISO 27001 or SOC 2 named on the security page (data-centre providers hold their own certificates).","status":"verified","url":"https://www.semrush.com/company/security/","locator":"PCI DSS compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we have achieved a PCI DSS Level 1 certificate"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features found in the terms, AI Terms or plan page.","status":"not_published","url":"https://www.semrush.com/company/legal/semrush-artificial-intelligence-services-terms/","locator":"AI Terms; Terms of Service; Starter plan page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€158.40 per month, billed annually (listed against €190 on monthly billing); VAT not shown.","status":"verified","url":"https://www.semrush.com/prices/","locator":"SEO + AI Search: Starter","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"€158.40 monthly €158.40/mo billed annually"}]}]},{"slug":"sevdesk","name":"sevdesk","vendor":"sevDesk GmbH","category":"documents-hr-and-finance","plans":[{"id":"T114","plan":"Buchhaltung","tier":"business","price":{"label":"€25.90 / mo","amount":25.9,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated: sevdesk advertises AI-assisted receipt capture and booking suggestions, but its terms, AVV and privacy notices say nothing about training","status":"not_published","url":"https://sevdesk.de/agb/","locator":"Whole AGB (Stand Januar 2025)","url2":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/667a7326dc5766d222b14ad1_23916f0b297e9447ccea5b7bda3e42bd_auftragsverarbeitungsvertrag_sevdesk.pdf","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not published: no setting or statement about AI training was found","status":"not_published","url":"https://sevdesk.de/agb/","locator":"Whole AGB","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, for all customers: hosting is in Germany","status":"verified","url":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/66670f39f1199a8fdc431d29_liste_der_subunternehmer.pdf","locator":"Row 'Amazon Web Services EMEA SARL'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Germany: data is hosted only in Germany (AWS Germany branch); support access from third countries is possible","status":"verified","url":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/66670f39f1199a8fdc431d29_liste_der_subunternehmer.pdf","locator":"Row 'Amazon Web Services EMEA SARL' (Stand 10 Apr 2024)","url2":"https://sevdesk.de/datenschutz/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. sevdesk publishes its Auftragsverarbeitungsvertrag (Art. 28 GDPR) as a PDF on its privacy page","status":"verified","url":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/667a7326dc5766d222b14ad1_23916f0b297e9447ccea5b7bda3e42bd_auftragsverarbeitungsvertrag_sevdesk.pdf","locator":"Preamble","url2":"https://sevdesk.de/datenschutz/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public but dated 10 Apr 2024: 4 entries (AWS hosting in Germany, EMAILBRIEF postal invoices, Termitel phone support, Twilio SendGrid email); no AI provider is listed","status":"verified","url":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/66670f39f1199a8fdc431d29_liste_der_subunternehmer.pdf","locator":"Table 'Liste genehmigter Subunternehmer'","url2":"https://sevdesk.de/datenschutz/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, sevDesk GmbH, Offenburg)","status":"verified","url":"https://sevdesk.de/agb/","locator":"Opening paragraph naming sevDesk GmbH","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"After the contract ends, personal data is kept for three months so the customer can export it, then deleted; immediate deletion on request","status":"verified","url":"https://cdn.prod.website-files.com/65c9eb8b18a74904c71e4d3c/667a7326dc5766d222b14ad1_23916f0b297e9447ccea5b7bda3e42bd_auftragsverarbeitungsvertrag_sevdesk.pdf","locator":"§ 10 Löschung und Rückgabe von personenbezogenen Daten","url2":"https://sevdesk.de/agb/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Not published: sevdesk's security and privacy pages name no certification","status":"not_published","url":"https://sevdesk.de/sicherheit/","locator":"Whole page","url2":"https://sevdesk.de/datenschutz/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not published: no setting to turn the AI-assisted features off was found on the pages read","status":"not_published","url":"https://sevdesk.de/belege-erfassen/","locator":"Whole page","url2":"https://sevdesk.de/agb/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 25.90 per month excl. VAT on a 24-month term (60% off for the first 12 months: EUR 10.36)","status":"verified","url":"https://sevdesk.de/preise/","locator":"Plan card 'Buchhaltung' with '24 Monate' selected","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"shopify-magic","name":"Shopify Magic / Sidekick","vendor":"Shopify International Limited (Shopify Inc. for US and Canada)","category":"code-and-app-builders","plans":[{"id":"T546","plan":"Grow plan","tier":"business","price":{"label":"€79 / mo","amount":79,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; the terms, privacy policy, DPA and help pages on Sidekick contain no statement about training AI models on merchant content.","status":"not_published","url":"https://www.shopify.com/legal/privacy","locator":"Our use of Machine Learning; terms, DPA and Sidekick help also searched","url2":"https://help.shopify.com/en/manual/ai-powered-tools/sidekick/memory","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"One of the ways in which we are able to help merchants using Shopify is by using techniques like \"machine learning\" (some laws, including"},{"key":"training_opt_out","value":"Not stated; no training clause or opt-out is described. Users can turn memory off per Sidekick conversation, which is not a training opt-out.","status":"not_published","url":"https://help.shopify.com/en/manual/ai-powered-tools/sidekick/memory","locator":"Turn off memory for a Sidekick conversation","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no setting to keep store data only in the EU is described. Data is first received in Ireland but transferred onward under Binding Corporate Rules.","status":"not_published","url":"https://www.shopify.com/legal/privacy","locator":"International transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated as a store setting: EEA merchant data is received by Shopify International Ltd. (Ireland) and then sent to other Shopify locations including Canada and the US; hosting providers include AWS and Google Cloud Canada.","status":"not_published","url":"https://www.shopify.com/legal/privacy","locator":"International transfers","url2":"https://help.shopify.com/en/manual/your-account/privacy/subprocessors","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are located in the EEA, the UK, or Switzerland, your Personal Data is received by our Irish affiliate, Shopify International Ltd. Your information is then sent to other"},{"key":"dpa","value":"Yes: the Shopify DPA supplements and is incorporated by reference into the Terms of Service, with an EEA/UK/Swiss appendix.","status":"verified","url":"https://www.shopify.com/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Shopify Data Processing Addendum (\"DPA\") supplements and is incorporated by reference into the Shopify Terms of Service, together with any terms applicable to"},{"key":"subprocessor_list","value":"Yes: https://help.shopify.com/en/manual/your-account/privacy/subprocessors, 34 rows (20 Shopify entities, 14 third parties). AI providers: Anthropic, Applied Compute, Fireworks.ai, Groq, Microsoft, OpenAI.","status":"verified","url":"https://help.shopify.com/en/manual/your-account/privacy/subprocessors","locator":"Third-party subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Subprocessors used by Shopify for the performance of the Services under the Terms are listed below. To receive notifications"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Shopify International Limited, Dublin) for merchants outside the US, Canada and Asia-Pacific","status":"verified","url":"https://www.shopify.com/legal/terms","locator":"Shopify contracting parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Shopify International Limited, a private company limited by shares incorporated in Ireland under registration"},{"key":"data_retention","value":"Store information is kept two years after closure or non-payment before deletion starts. Users can delete a Sidekick conversation and turn memory off per conversation; Sidekick recalls recent admin activity from about the last 12 hours.","status":"verified","url":"https://www.shopify.com/legal/privacy","locator":"How long we keep your information","url2":"https://help.shopify.com/en/manual/ai-powered-tools/sidekick/memory","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we retain store information for two years before we begin the deletion process. When"},{"key":"certifications","value":"3 named: PCI DSS Level 1, SOC 2 Type II and SOC 3.","status":"verified","url":"https://www.shopify.com/security","locator":"SOC and PCI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Shopify has been issued SOC 2 Type II and SOC 3 reports"},{"key":"admin_ai_controls","value":"Not stated; Sidekick follows each staff member's admin permissions, but no organisation-wide switch to turn it off is described.","status":"not_published","url":"https://www.shopify.com/magic","locator":"Sidekick FAQ: user permissions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€79 per month for the Grow plan (shown with the 'Pay yearly' option; for small teams, up to 5 staff accounts). VAT is not stated.","status":"verified","url":"https://www.shopify.com/pricing","locator":"Grow plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Grow €79/mo For small teams Start for free"}]}]},{"slug":"shortwave","name":"Shortwave","vendor":"Shortwave Communications, Inc.","category":"writing-and-email","plans":[{"id":"T360","plan":"Business","tier":"business","price":{"label":"$30 / user / mo","amount":30,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Shortwave itself; it says your data will never be used to train third-party LLMs","status":"verified","url":"https://shortwave.com/docs/guides/security/","locator":"Security & Privacy > No third-party LLM training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data will never be used to train third-party LLMs."},{"key":"training_opt_out","value":"Not stated; no setting described. Vendor says data is never used to train third-party LLMs","status":"not_published","url":"https://shortwave.com/docs/guides/security/","locator":"Looked at: security page, privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data region offered in the pages read","status":"not_published","url":"https://shortwave.com/docs/guides/security/","locator":"Looked at: security page, privacy policy, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Shortwave stores all data in Google Cloud and transfers it to servers in the US","status":"verified","url":"https://shortwave.com/policies/privacy-policy/","locator":"Privacy Policy > transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your Personal Data will be transferred from your location to our facilities and servers in the United States."},{"key":"dpa","value":"Not stated; no DPA found. Security page says customers needing GDPR compliance should contact support","status":"not_published","url":"https://shortwave.com/docs/guides/security/","locator":"Looked at: security page, privacy policy, terms of service","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No separate list; the security page names 4 providers: Google Cloud, OpenAI, Anthropic, Pinecone","status":"verified","url":"https://shortwave.com/docs/guides/security/","locator":"Security & Privacy > Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Currently, besides Google Cloud, we only use OpenAI, Anthropic, and Pinecone."},{"key":"dpf_status","value":"No listing found for search term 'Shortwave'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Shortwave' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: personal data is kept as long as reasonably necessary; you can delete your account and all associated data","status":"verified","url":"https://shortwave.com/policies/privacy-policy/","locator":"Privacy Policy > 4. Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We keep Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy"},{"key":"certifications","value":"CASA Tier 2 (annual third-party security audit). For SOC 2 Type II or GDPR compliance the security page only says to contact support; no report or certificate is published","status":"verified","url":"https://shortwave.com/docs/guides/security/","locator":"Security & Privacy > CASA Tier 2 compliance & annual audit","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To maintain this verification, Shortwave undergoes an annual security audit."},{"key":"admin_ai_controls","value":"Not stated; no admin switch to turn AI off found","status":"not_published","url":"https://shortwave.com/pricing","locator":"Looked at: pricing, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $30 per seat/month (Business plan; billing basis and VAT not shown)","status":"not_published","url":"https://shortwave.com/pricing","locator":"Pricing > Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"sipgate-sona","name":"sipgate sona AI Agents","vendor":"sipgate GmbH","category":"phone-and-voice","plans":[{"id":"T421","plan":"Starter","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for sipgate itself. Its security page says that for its ChatGPT use, data is processed only in Europe and use by OpenAI for machine learning is excluded by contract; nothing about sipgate training sona","status":"not_published","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"AI Security: Umgang mit erhobenen Daten; also /ai-agents FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated: no training setting or statement found for sona","status":"not_published","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"AI Security; also /ai-agents, /preise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Always in Germany by default; no setting needed (conversation data stays on sipgate's German infrastructure)","status":"verified","url":"https://www.sipgate.de/ai-agents","locator":"FAQ: Ist sona DSGVO-konform und wo liegen meine Daten?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die Sprachmodelle hinter sona betreibt sipgate selbst, auf eigener Infrastruktur in deutschen Rechenzentren. Ihre Gesprächsdaten verlassen diese Infrastruktur nicht."},{"key":"default_data_location","value":"Germany: sipgate hosts its product infrastructure in German data centres; for sona it runs its own language models there and says conversation data does not leave that infrastructure","status":"verified","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"Intro paragraph","url2":"https://www.sipgate.de/ai-agents","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die sipgate Produktinfrastruktur wird in Rechenzentren in Deutschland gehostet."},{"key":"dpa","value":"Yes: sipgate concludes a data processing contract (Auftragsverarbeitungsvertrag) with the customer for sona","status":"verified","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"Legal: Auftragsverarbeitungsvereinbarung","url2":"https://www.sipgate.de/ai-agents","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Vertrag zur Verarbeitung von Daten im Auftrag legt fest, wie sipgate personenbezogene Daten im Auftrag der Kund:innen"},{"key":"subprocessor_list","value":"Page not readable by server fetch: the Auftragsverarbeitungsvereinbarung (which per sipgate lists the subcontractors) is at https://www.sipgate.de/av","status":"not_captured","url":"https://www.sipgate.de/av","locator":"Auftragsverarbeitungsvereinbarung page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (German-based vendor, sipgate GmbH, Düsseldorf)","status":"verified","url":"https://www.sipgate.de/impressum","locator":"Impressum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"sipgate GmbH Gladbacher Straße 74 40219 Düsseldorf"},{"key":"data_retention","value":"Not stated for sona recordings or transcripts. Security page: customers can request deletion of their data at any time, and data is deleted once no longer needed for its purpose; phone-system voicemail, SMS and fax are kept max. 30 days, statistics max. 365 days","status":"not_published","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"Datenlöschung; Leistungsbeschreibung 2.5-2.7","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"1 named: ISO 27001 (all data centres hosting sipgate's product infrastructure in Germany); the pricing page also says 'EU AI Act-ready'","status":"verified","url":"https://www.sipgate.de/sicherheit-datenschutz","locator":"Intro paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Die sipgate Produktinfrastruktur wird in Rechenzentren in Deutschland gehostet. Dabei sind alle Rechenzentren erfolgreich nach ISO 27001 zertifiziert"},{"key":"admin_ai_controls","value":"Not stated for sona. (For the separate AI Assist feature, an admin picks the AI provider for the account and AI can be switched off.)","status":"not_published","url":"https://www.sipgate.de/ai-agents","locator":"sona pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"69.95 EUR per month excl. VAT (Starter: 1,000 included minutes, 2 parallel calls); a Free plan with 500 minutes exists","status":"verified","url":"https://www.sipgate.de/preise","locator":"sipgate sona: Individuelle Pakete, Starter","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Starter 69 95 Euro pro Monat zzgl. MwSt."}]}]},{"slug":"sistrix","name":"SISTRIX","vendor":"SISTRIX GmbH","category":"sales-marketing-and-support","plans":[{"id":"T527","plan":"Plus","tier":"business","price":{"label":"€239 / mo","amount":239,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the privacy notice, imprint or pricing page.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Datenschutzerklärung (whole page)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause or opt-out found.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Datenschutzerklärung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no data-location option described.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Datenschutzerklärung","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the privacy notice does not say where customer data is stored.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Datenschutzerklärung; imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated; no data processing agreement is published on the pages found.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Datenschutzerklärung; imprint","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not stated; no public sub-processor list found. The privacy notice only says safeguards are taken where sub-contractors are used.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Weitergabe von Daten an Dritte und Drittanbieter","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, SISTRIX GmbH, Bonn, Germany)","status":"verified","url":"https://www.sistrix.com/sistrix/impressum","locator":"Impressum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SISTRIX GmbH Thomas-Mann-Straße 37 53111 Bonn Deutschland"},{"key":"data_retention","value":"After you cancel, your account data is deleted (except what tax and commercial law require you to keep); SISTRIX may irrevocably delete everything stored during the contract, so back up your data before the contract ends.","status":"verified","url":"https://www.sistrix.com/data-privacy/","locator":"Nutzung Softwareangebote SISTRIX","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Wir sind berechtigt, sämtliche während der Vertragsdauer gespeicherten Daten des Nutzers unwiederbringlich zu löschen."},{"key":"certifications","value":"Not stated; no security certification named on the pages found.","status":"not_published","url":"https://www.sistrix.com/data-privacy/","locator":"Sicherheitsmaßnahmen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; the pricing page mentions roles and rights management (Premium) but no switch for AI features.","status":"not_published","url":"https://www.sistrix.com/pricing/","locator":"Premium package features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€239 per month plus taxes, cancelable monthly (3 users included).","status":"verified","url":"https://www.sistrix.com/pricing/","locator":"Plus package","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For small businesses with ambitions of growth €239/ month plus taxes"}]}]},{"slug":"skribble","name":"Skribble","vendor":"Skribble AG, Zurich, Switzerland (and Skribble Deutschland GmbH, Karlsruhe)","category":"documents-hr-and-finance","plans":[{"id":"T582","plan":"Team","tier":"business","price":{"label":"€23 / user / mo","amount":23,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the privacy policy, DPA, terms of use or security page.","status":"not_published","url":"https://www.skribble.com/en-eu/privacy/","locator":"Privacy policy, DPA, terms of use, security page, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://www.skribble.com/en-eu/privacy/","locator":"Privacy policy, DPA, terms of use, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: at initial setup the customer selects the German (DE) data centre instead of the Swiss (CH) one. The choice is fixed for the whole contract and cannot be changed or migrated later.","status":"verified","url":"https://www.skribble.com/en-eu/gtc/","locator":"4.12 Data Center selection","url2":"https://www.skribble.com/en-eu/dpa/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Customer Account is assigned to the selected data center and remains there for the entire duration of the Customer Contract."},{"key":"default_data_location","value":"Your choice of two data centres at setup: Switzerland (CH) or Germany (DE). The security page describes the Swiss hosting on two Tier IV sites; hosting providers are cloudscale.ch and VSHN (Swiss entity) and IONOS (German entity).","status":"verified","url":"https://www.skribble.com/en-eu/gtc/","locator":"4.12 Data Center selection","url2":"https://www.skribble.com/en-eu/security/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Skribble operates two independent data centers (CH and DE). Upon initial setup, the Customer must select one data center for the use of the Skribble Services, including API access."},{"key":"dpa","value":"Yes. A Data Processing Agreement under Swiss FADP and EU GDPR supplements the Customer Contract and applies to either contracting entity.","status":"verified","url":"https://www.skribble.com/en-eu/dpa/","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"With the Customer Contract, the Parties entered into a data processing relationship pursuant to the Swiss Federal Act on Data Protection"},{"key":"subprocessor_list","value":"Yes, in Annex 2 of the DPA (https://www.skribble.com/en-eu/dpa/, version 31.10.2025): 13 sub-processors for the Swiss entity and 12 for the German entity. No AI or model provider listed (Featurebase offers a support chatbot).","status":"verified","url":"https://www.skribble.com/en-eu/dpa/","locator":"Annex 2 - Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Annex 2 to the Data Processing Agreement under FADP and EU-GDPR lists the Sub-Processors used by Skribble."},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, Skribble AG, Zurich)","status":"verified","url":"https://www.skribble.com/en-eu/privacy/","locator":"1. Responsible party","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We, Skribble AG, Talacker 21, 8001 Zurich, Switzerland"},{"key":"data_retention","value":"Audit logs are kept 10 years. Team has no company-wide document deletion period (setting listed for Pro and Scale only). On termination Skribble deletes the account and its documents; for EU/EEA customers exportable data stays available 30 days, then is erased (GTC 15.1, 16.6). Legal-retention data excepted.","status":"verified","url":"https://www.skribble.com/en-eu/security/","locator":"Audit trails","url2":"https://www.skribble.com/en-eu/gtc/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Skribble retains audit logs for 10 years for evidence purposes."},{"key":"certifications","value":"ISO 27001 and ISO 9001 (2 certifications), plus GDPR and Swiss data protection compliance claimed.","status":"verified","url":"https://www.skribble.com/en-eu/security/","locator":"GDPR compliant & ISO 27001 certified","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have been certified according to ISO 9001 and 27001."},{"key":"admin_ai_controls","value":"Not stated; no AI features found. Team includes centralised member administration and company settings but no AI controls.","status":"not_published","url":"https://www.skribble.com/en-eu/pricing/","locator":"Compare plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 23 per user/month excluding VAT, billed yearly (EUR 276 per user per year); EUR 348 per year is shown as the monthly-billing figure.","status":"verified","url":"https://www.skribble.com/en-eu/pricing/","locator":"Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enable your team with all e-signature standards (SES, AES, QES) for enhanced security. € 23 per user/month excl. VAT"}]}]},{"slug":"slack","name":"Slack","vendor":"Slack (Salesforce)","category":"workspace-and-projects","plans":[{"id":"T13","plan":"Business+","tier":"business","price":{"label":"€18 / user / mo","amount":18,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Partly. Generative AI: no, unless the customer opts in. Non-generative 'global' models (such as recommendations) learn from customer messages, content and files by default; opt out by emailing feedback@slack.com","status":"verified","url":"https://slack.com/trust/data-management/privacy-principles","locator":"Privacy principles (undated)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"For Slack's non-generative 'global' models, an owner must email feedback@slack.com with the workspace URL and the subject 'Slack global model opt-out request'. Generative AI models are not developed with customer data, so there is nothing to switch off there","status":"verified","url":"https://slack.com/trust/data-management/privacy-principles","locator":"Section 'Contact us to opt out'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes on Business+ and Enterprise: Frankfurt, Paris, Stockholm or Zurich; member profiles, membership and analytics data stay outside the region; Slack AI coverage not stated","status":"verified","url":"https://slack.com/help/articles/360035633934-Data-residency-for-Slack","locator":"Plans, regions and covered data","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States, unless data residency is enabled","status":"verified","url":"https://slack.com/help/articles/360035633934-Data-residency-for-Slack","locator":"Help article","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, by signature: an authorised person executes the DPA linked on Slack's page","status":"verified","url":"https://slack.com/terms-of-service/data-processing","locator":"DPA page","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public in Salesforce's combined list (published 2 Oct 2026): AWS (hosting, many regions), Google (email notifications, generative AI), Microsoft Azure (generative AI, US), Zendesk (support), You.com (web search for Slackbot, if enabled)","status":"verified","url":"https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf","locator":"Slack section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Search 'Slack Technologies' returns Salesforce: active (EU-US, Swiss-US, UK Extension), 12 covered entities","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Slack Technologies'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"On paid plans everything is kept for the life of the workspace by default; owners can set messages, files, canvases and lists to be deleted after a chosen period, and can let members set channel retention","status":"verified","url":"https://slack.com/help/articles/203457187-Customize-data-retention-in-Slack","locator":"Opening paragraphs and message/file retention options","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO/IEC 27001, 27017, 27018, 27701 and 42001; SOC 2 and SOC 3; CSA STAR; TISAX assessment; HIPAA- and FINRA-configurable. FedRAMP Moderate needs Enterprise or Enterprise+","status":"verified","url":"https://slack.com/trust/compliance","locator":"Certification list and industry regulations section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Yes. On Pro, Business+ and Enterprise+, owners and admins can restrict AI features or turn certain features off entirely; feedback to Slack on AI answers is blocked by default in some workspaces","status":"verified","url":"https://slack.com/help/articles/28244420881555-Manage-access-to-AI-features-in-Slack","locator":"Introduction and plan availability box","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 18 per user/month billed monthly, excl. VAT","status":"verified","url":"https://slack.com/intl/de-de/pricing","locator":"Business+ card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"smallpdf","name":"Smallpdf","vendor":"Smallpdf AG","category":"documents-hr-and-finance","plans":[{"id":"T580","plan":"Team","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Smallpdf says it does not use customer data to train the machine learning models behind its AI products.","status":"verified","url":"https://smallpdf.com/ai-products-supplementary-terms","locator":"Improving Smallpdf AI Products","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Smallpdf does not use your Customer Data or permit others to use your Customer Data to train the machine learning models used to provide the Smallpdf AI Products."},{"key":"training_opt_out","value":"Nothing to do: Smallpdf states it does not train on customer data.","status":"verified","url":"https://smallpdf.com/ai-products-supplementary-terms","locator":"Improving Smallpdf AI Products","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your use of the Smallpdf AI Products does not grant Smallpdf any right or license to your Customer Data to train our machine learning models."},{"key":"eu_residency_option","value":"Not stated; no setting or plan to choose a data region found. Processing of uploaded files runs on EU servers by default.","status":"not_published","url":"https://smallpdf.com/privacy","locator":"Privacy Notice sections 4 and 7; DPA; Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Uploaded files are processed on Hetzner servers in the EU (temporary storage only). Where saved files are kept is not stated.","status":"verified","url":"https://smallpdf.com/privacy","locator":"Section 4.1.9 Hetzner","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This information may be temporarily stored on Hetzner managed servers located in the European Union. It does not involve permanent storage."},{"key":"dpa","value":"Yes. A standard Data Processing Agreement covers the Team and Business plans under the Terms of Service.","status":"verified","url":"https://smallpdf.com/terms","locator":"Section 16, Data Processing Agreement","url2":"https://smallpdf.com/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Processing Agreement DPA reflects our mutual agreement with respect to the Processing of Personal Data by us on behalf of you in connection with the Smallpdf Team Plan and Smallpdf Business Plan"},{"key":"subprocessor_list","value":"No public list found. The DPA says a list is provided on request; the privacy notice names some providers (Hetzner, AWS Bedrock, Google Looker/Gemini for internal analytics, Cloudflare). AI feature provider named: OpenAI.","status":"verified","url":"https://smallpdf.com/dpa","locator":"Section 7 Sub-Processor","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon request, Processor shall provide a list of sub-Processor involved in data processing under this DPA."},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, Smallpdf AG, Zürich)","status":"verified","url":"https://smallpdf.com/privacy","locator":"Privacy Notice, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are Smallpdf AG, a company incorporated under the laws of Switzerland, with its registered offices at Steinstrasse 21, 8003 Zürich, Switzerland"},{"key":"data_retention","value":"Files are deleted within 1 hour for account users unless saved; saved files are deleted generally within 14 days after you delete them. AI usage data is kept 90 days.","status":"verified","url":"https://smallpdf.com/privacy","locator":"Section 6 retention","url2":"https://smallpdf.com/ai-products-supplementary-terms","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you access our services via a User Account, we delete User Files within one hour unless you save them to your file storage."},{"key":"certifications","value":"ISO/IEC 27001 (1 certification). The trust centre also states compliance with GDPR, CCPA, nFADP and eIDAS, which are not certifications.","status":"verified","url":"https://smallpdf.com/trust-center","locator":"Trust center header","url2":"https://smallpdf.com/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Smallpdf is ISO/IEC 27001 certified, and complies with GDPR, CCPA, and nFADP."},{"key":"admin_ai_controls","value":"Not stated; Team plan lists member access management and centralized billing, but no admin switch to turn AI tools off.","status":"not_published","url":"https://smallpdf.com/pricing","locator":"Team plan feature list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the Team plan (2-19 seats) shows its per-seat price only after JavaScript loads.","status":"not_captured","url":"https://smallpdf.com/pricing","locator":"Team plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"smartcat","name":"Smartcat","vendor":"Smartcat Platform Inc. / Smartcat Europe B.V.","category":"writing-and-email","plans":[{"id":"T350","plan":"Adapt","tier":"business","price":{"label":"$1,200 / yr","amount":1200,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Marketing claim only: the pricing-page FAQ says content is never used to train public AI models. The terms, DPA and privacy policy say nothing on training; Smartcat's own models are not addressed.","status":"vendor_statement","url":"https://www.smartcat.com/pricing/","locator":"Pricing page, FAQ \"What security and compliance standards does Smartcat meet?\"","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your content is never used to train public AI models."},{"key":"training_opt_out","value":"Not stated; no setting or request to stop training is described. Pricing FAQ only claims content is never used to train public AI models.","status":"not_published","url":"https://www.smartcat.com/legal/terms/","locator":"VI. User Content; DPA; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by customer location: content from customers residing in Europe (incl. EEA), Australia and Africa is stored in the EU data centre; it is not a setting you choose.","status":"verified","url":"https://www.smartcat.com/legal/dpa/","locator":"9.2 Subprocessors table, Amazon hosting row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EU data center – Personal Data of all Smartcat Users provided to Smartcat upon registration on the Platform and Content uploaded by Customers residing in Europe (including EEA), Australia and Africa."},{"key":"default_data_location","value":"Europe-based customers: AWS EU data centre (also stores registration data of all users). Americas customers: USA data centre; Asia-Pacific customers: China data centre.","status":"verified","url":"https://www.smartcat.com/legal/dpa/","locator":"9.2 Subprocessors table, Amazon hosting row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EU data center – Personal Data of all Smartcat Users provided to Smartcat upon registration on the Platform and Content uploaded by Customers residing in Europe (including EEA), Australia and Africa."},{"key":"dpa","value":"Yes: the Smartcat Data Processing Agreement is part of the Terms of Service by reference; no separate signing described.","status":"verified","url":"https://www.smartcat.com/legal/terms/","locator":"VII. Data Protection, C","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Parties of this Agreement shall be bound to Smartcat Data Processing Agreement"},{"key":"subprocessor_list","value":"Yes: listed in the DPA (https://www.smartcat.com/legal/dpa/), 13 rows, 11 companies plus marketplace subcontractors. AI/model providers: Google, Amazon, OpenAI, Microsoft, DeepL, ModernMT, Anthropic Claude, ElevenLabs, HeyGen.","status":"verified","url":"https://www.smartcat.com/legal/dpa/","locator":"9.2 Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You hereby authorize Smartcat to engage with the following Subprocessors"},{"key":"dpf_status","value":"No listing found for search term 'Smartcat'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Smartcat' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"You can delete content yourself during the term. After termination, Smartcat destroys or returns your data within 30 days of a written request; backups are deleted in due course. No default period without a request.","status":"verified","url":"https://www.smartcat.com/legal/dpa/","locator":"14. Data return or deletion, 14.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon your written request Smartcat shall securely destroy or return such Personal Data or Content, provided to Smartcat, to you within a maximum period of 30 days."},{"key":"certifications","value":"SOC 2 Type II and ISO/IEC 27001 (2 certifications). Hosting data centres are SOC 1/2/3 compliant.","status":"verified","url":"https://www.smartcat.com/legal/dpa/","locator":"7.1 Smartcat Security Measures","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Smartcat is SOC 2 Type II certified; Smartcat is ISO/IEC 27001 certified;"},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide setting to switch AI features off found in the pages read.","status":"not_published","url":"https://www.smartcat.com/pricing/","locator":"Plan cards and FAQ; DPA; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Adapt plan from $1,200 per year, billed annually (unlimited users). 15-day free trial.","status":"not_published","url":"https://www.smartcat.com/pricing/","locator":"Plan cards: Adapt","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"smartlead","name":"Smartlead","vendor":"521 Products Pty Ltd (Smartlead, Australia)","category":"writing-and-email","plans":[{"id":"T370","plan":"Pro","tier":"business","price":{"label":"$94 / mo","amount":94,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-model training clause found in the terms, DPA or privacy policy. Terms let Smartlead use user data to supply the service, train its staff and develop other services.","status":"not_published","url":"https://smartlead.ai/new-terms-and-conditions","locator":"12. User Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"train our staff; and develop other services."},{"key":"training_opt_out","value":"Not stated; no AI-training clause or opt-out found in the terms, DPA or privacy policy.","status":"not_published","url":"https://smartlead.ai/new-terms-and-conditions","locator":"12. User Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated. The DPA says EU and UK data is stored in data centres inside and outside the EU and UK; no EU-only setting is described.","status":"not_published","url":"https://smartlead.ai/dpa","locator":"6. International Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Smartlead stores and processes EU and UK Data (defined below) in data centres located inside and outside the European Union and the UK."},{"key":"default_data_location","value":"Amazon Web Services, Sydney region (Australia). Other User Data may also be processed in Singapore, India, Japan, US, Canada, Germany, Ireland and Sweden.","status":"verified","url":"https://smartlead.ai/dpa","locator":"Exhibit B","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"securely storing data in a certified data repository, specifically one located in the Sydney Region of Amazon Web Services;"},{"key":"dpa","value":"Yes. The DPA is part of the Terms and is accepted automatically when the user buys a subscription; no signature needed.","status":"verified","url":"https://smartlead.ai/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"THIS DPA IS ACCEPTED BY THE USER BY VIRTUE OF THE USER ACCEPTING THE TERMS UPON BUYING A SUBCRIPTION FROM SMARTLEAD. THIS DPA CONSTITUTES PART OF THE TERMS."},{"key":"subprocessor_list","value":"No public list. DPA Annex III names one sub-processor (AWS for hosting) and says the remainder is available on request. 1 entry listed; no AI or model providers named.","status":"verified","url":"https://smartlead.ai/dpa","locator":"Annex III","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS for hosting Remainder available on request"},{"key":"dpf_status","value":"No listing found for search term 'Smartlead', '521 Products'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Smartlead', '521 Products' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After deactivation, personal data is deleted within 90 days once invoices are paid (backups excepted). The terms allow removal of user data one month after termination. No customer-set retention period found.","status":"verified","url":"https://smartlead.ai/dpa","locator":"7. Return or Deletion of Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon deactivation of the Service, all Personal Data shall be deleted within 90 days subject to full User payment of any outstanding invoices"},{"key":"certifications","value":"None named. DPA says certification copies are provided on written request; Exhibit B only says data sits in a certified AWS repository and providers have certifications.","status":"not_published","url":"https://smartlead.ai/dpa","locator":"4. Security / Exhibit B","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch to turn AI features off for the organisation found in the terms, DPA or pricing page.","status":"not_published","url":"https://smartlead.ai/pricing","locator":"Plan features table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Pro $94 per month on the first price set, $78 per month on the second set (17% off yearly toggle). No VAT or EUR shown.","status":"not_published","url":"https://smartlead.ai/pricing","locator":"Choose your growth plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"smartsheet","name":"Smartsheet","vendor":"Smartsheet Inc.","category":"workspace-and-projects","plans":[{"id":"T451","plan":"Business","tier":"business","price":{"label":"€22 / user / mo","amount":22,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Smartsheet itself. It says customer data is not used to train third-party foundation models and that its AI-provider contracts prohibit training on customer data.","status":"not_published","url":"https://www.smartsheet.com/smartsheet-ai-data-security-whitepaper","locator":"AI Data Security whitepaper, Data storage, residency, and retention for Smartsheet AI tools","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"our enterprise contracts with AI providers include explicit prohibitions on using customer data for model training purposes."},{"key":"training_opt_out","value":"Nothing to do for third-party training: Smartsheet says customer data is not used to train third-party foundation models. No setting or opt-out is described.","status":"verified","url":"https://www.smartsheet.com/trust/responsible-ai","locator":"Responsible AI, FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No, your data never leaves your control, never mixes with other customers, and never trains third-party foundation models."},{"key":"eu_residency_option","value":"Yes: Smartsheet Regions lets customers host in the US, EU or Australia (the EU environment runs on AWS in Germany and Ireland); the pricing FAQ says to contact sales, and no official page names which plans include it.","status":"verified","url":"https://www.smartsheet.com/trust","locator":"Data Residency","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Smartsheet Regions lets you choose — US, EU, or Australia — so you can meet regional compliance requirements"},{"key":"default_data_location","value":"AWS in the United States (Virginia/Ohio) for the Commercial environment, which is the default.","status":"verified","url":"https://www.smartsheet.com/trust","locator":"Trust Center, Enterprise Security FAQ, 'Where does Smartsheet data reside?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, customers are hosted in AWS East, with regional options available via Smartsheet Regions."},{"key":"dpa","value":"Yes. Smartsheet has a standard Data Processing Addendum that includes the EU Standard Contractual Clauses; it is linked from the legal pages.","status":"verified","url":"https://www.smartsheet.com/legal/privacy","locator":"Privacy Notice, data transfers section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the SCCs are incorporated as part of Smartsheet’s standard DPA as detailed below."},{"key":"subprocessor_list","value":"A public list exists at https://www.smartsheet.com/legal/subprocessors but could not be read, so entries and AI providers there are uncounted. The AI whitepaper names Azure OpenAI and Amazon Bedrock as AI model providers.","status":"not_captured","url":"https://www.smartsheet.com/legal/privacy","locator":"Privacy Notice footer link 'Subprocessors'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Smartsheet Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Smartsheet'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"AI prompts and outputs are stored with the sheet data and deleted within 180 days after the contract ends; Smartsheet can keep them for support and abuse monitoring. AI providers do not store them beyond generating a response.","status":"verified","url":"https://www.smartsheet.com/smartsheet-ai-data-security-whitepaper","locator":"AI Data Security whitepaper, Data storage, residency, and retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Input prompts and generated outputs are deleted by"},{"key":"certifications","value":"4 named: SOC 2, ISO 27001, ISO 27701 and FedRAMP; ISO 42001 (AI management) is stated as being pursued, not held. HIPAA use needs a BAA on Enterprise.","status":"verified","url":"https://www.smartsheet.com/trust","locator":"Trust Center, Enterprise Security FAQ, compliance frameworks","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Smartsheet adheres to leading security and compliance frameworks, including SOC 2, ISO 27001, ISO 27701, and FedRAMP."},{"key":"admin_ai_controls","value":"Yes. System administrators choose which AI capabilities are activated for end users using AI activation controls in the admin center.","status":"verified","url":"https://www.smartsheet.com/smartsheet-ai-data-security-whitepaper","locator":"AI Data Security whitepaper, AI features overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"system administrators can choose which AI capabilities are activated for end users using AI activation controls in the admin center."},{"key":"price_eur","value":"Business: EUR 22 per member/month billed monthly, or EUR 17 billed yearly (page prints '2217€'); 3+ members; VAT not stated.","status":"verified","url":"https://www.smartsheet.com/pricing","locator":"Pricing, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"2217€ per Member/month £1915 per Member/month ¥3,2002,500 per Member/month"}]}]},{"slug":"softr","name":"Softr","vendor":"Softr Platforms GmbH","category":"code-and-app-builders","plans":[{"id":"T540","plan":"Business","tier":"business","price":{"label":"$329 / mo","amount":329,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; the AI-tools clause says data is processed by AI tools only when you choose to use them, and mentions no training on customer content.","status":"not_published","url":"https://www.softr.io/terms","locator":"2.10 AI-Tools; privacy policy and DPA also searched (no training clause)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data is processed by AI-Tools only when you choose to use them. If you do not make use of AI-Tools, no data is processed by them. AI-Tools may include technology"},{"key":"training_opt_out","value":"Not stated; no training clause was found, so no opt-out setting is described.","status":"not_published","url":"https://www.softr.io/terms","locator":"Terms 2.10; privacy policy and DPA searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: the security page lists 'EU or US data residency' and says you can host your data in the EU (Germany). Which plans include it and how to select it is not stated.","status":"verified","url":"https://www.softr.io/security","locator":"Data hosting & protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Host your data in the EU (Germany) or US. #### Encryption in transit & at rest Protect data both in transit with"},{"key":"default_data_location","value":"Not stated which is the default; the security page says data can be hosted in the EU (Germany) or the US.","status":"not_published","url":"https://www.softr.io/security","locator":"Data hosting & protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Host your data in the EU (Germany) or US. #### Encryption in transit & at rest Protect data both in transit with"},{"key":"dpa","value":"Yes: a DPA with Softr Platforms GmbH is published as Appendix 1 to the terms and takes precedence over the Agreement.","status":"verified","url":"https://www.softr.io/dpa","locator":"Appendix 1 - Data Processing Agreement, section 1","url2":"https://www.softr.io/terms","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Agreement (\"DPA\") specifies the data protection obligations and rights of the parties in connection with the processing of personal data processed by Softr Platforms GmbH, Rosenthaler Str."},{"key":"subprocessor_list","value":"Listed as Annex 3 of the DPA ('Softr Sub-processors'); the entries could not be read without a browser, so no count or AI providers are captured.","status":"not_captured","url":"https://www.softr.io/dpa","locator":"Annex 3 - Softr Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Softr Platforms GmbH, Berlin)","status":"verified","url":"https://www.softr.io/dpa","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Softr Platforms GmbH, Rosenthaler Str. 13, 10119 Berlin, Germany,"},{"key":"data_retention","value":"After termination Softr keeps data for an 8-week grace period (you can request it), then deletes it; DPA 8.2 allows backup copies for 30 days after termination. Retention of AI inputs while active is not stated.","status":"verified","url":"https://www.softr.io/terms","locator":"9.8 termination and grace period","url2":"https://www.softr.io/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Softr will delete the Customer Content including Customer Products and Customer's personal data in accordance with the arrangements in Appendix 1 after eight (8) weeks after the effectiveness of the termination (“Grace Period”) during"},{"key":"certifications","value":"SOC 2 Type II (report available on request through the Trust Center); GDPR compliance is also claimed. No ISO 27001 certificate is named on the security page.","status":"verified","url":"https://www.softr.io/security","locator":"Security as a default","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Access to our Trust Center containing our SOC 2 Type II report, Security Policies and Penetration Testing results are available on request. ### SOC"},{"key":"admin_ai_controls","value":"Not stated; the docs describe AI credits that pause AI features when used up, but no organisation-wide switch to turn AI off.","status":"not_published","url":"https://docs.softr.io/workspace-and-billing/ai-credits.md","locator":"AI Credits article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $329 per month billed annually ($395 per month billed monthly), Business plan. Softr's own pricing page did not load without a browser; figures are from its help docs.","status":"not_published","url":"https://docs.softr.io/workspace-and-billing/pricing-and-plans.md","locator":"Pricing plans table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"sonix","name":"Sonix","vendor":"Sonix, Inc. (San Francisco, CA, USA)","category":"meetings-and-notes","plans":[{"id":"T404","plan":"Advanced","tier":"business","price":{"label":"$50 / mo","amount":50,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No: Sonix says it does not use customer content to train its machine learning or generative AI models.","status":"verified","url":"https://sonix.ai/privacy","locator":"Content and Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sonix does not use your content or Customer Data to train our machine learning or generative AI models."},{"key":"training_opt_out","value":"Nothing to do: Sonix states it does not train on customer content.","status":"verified","url":"https://sonix.ai/privacy","locator":"Content and Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sonix does not use your content or Customer Data to train our machine learning or generative AI models."},{"key":"eu_residency_option","value":"No on Advanced: all data is stored at AWS in the USA; data residency options are offered to Enterprise customers only, and no region is named.","status":"verified","url":"https://sonix.ai/features/security","locator":"FAQ: Where is my data stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We offer data residency options for Enterprise customers who need to keep data in specific geographic regions."},{"key":"default_data_location","value":"United States, on Amazon Web Services.","status":"verified","url":"https://sonix.ai/security","locator":"Your Data is Yours","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All data is stored at AWS in the USA."},{"key":"dpa","value":"Not included on Advanced as listed: Sonix lists a data processing agreement as an Enterprise plan feature only.","status":"vendor_statement","url":"https://sonix.ai/pricing","locator":"Enterprise plan feature list","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Pay by wire or check Data processing agreement (DPA) Business Associate Agreement (BAA)"},{"key":"subprocessor_list","value":"Not stated; no sub-processor list found on the privacy, security, terms, legal or features/security pages. Only AWS is named, for hosting.","status":"not_published","url":"https://sonix.ai/privacy","locator":"Privacy policy; security; terms; legal; features/security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Sonix'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Sonix' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"You can view, export and delete files at any time. Deleting the account destroys media, transcripts and translations; copies stay in backups up to 90 days. Automatic deletion rules are an Enterprise feature.","status":"verified","url":"https://sonix.ai/privacy","locator":"Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you delete your Sonix account, we permanently destroy the media files, transcripts, translations, and other content stored in it."},{"key":"certifications","value":"1 audited: SOC 2 Type II (audited annually, monitored with Drata). HIPAA via Medical Sonix with a BAA on Enterprise; GDPR protocols followed.","status":"verified","url":"https://sonix.ai/security","locator":"SOC 2 Type II Certified","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 Type II certified with continuous security control monitoring. Our controls are independently audited annually to ensure we meet the highest standards for security, availability, and confidentiality."},{"key":"admin_ai_controls","value":"Not stated; Advanced lists user permissions, a billing administrator role and per-user quotas, but no setting to switch AI features off.","status":"not_published","url":"https://sonix.ai/pricing","locator":"Team & admin features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $50 per month or $550 per year; 20 transcription hours a month, 1 user included, extra seats $25/month each.","status":"not_published","url":"https://sonix.ai/pricing","locator":"Advanced plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"spark-mail","name":"Spark Mail","vendor":"Spark Mail Limited","category":"writing-and-email","plans":[{"id":"T361","plan":"Pro","tier":"business","price":{"label":"€22 / user / mo","amount":22,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Spark states it does not use your data to train any AI model","status":"verified","url":"https://sparkmailapp.com/legal/privacy-app","locator":"Privacy Policy for App > AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train any AI model."},{"key":"training_opt_out","value":"Nothing to do: Spark states it does not train any AI model on your data","status":"verified","url":"https://sparkmailapp.com/legal/privacy-app","locator":"Privacy Policy for App > AI features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train any AI model."},{"key":"eu_residency_option","value":"Not stated; no setting or plan to keep data in the EU only was found","status":"not_published","url":"https://sparkmailapp.com/legal/privacy-app","locator":"Looked at: pricing, privacy policy for app, DPA, privacy explained blog","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States and EEA: data is stored on US servers (Google Cloud) and on EEA servers","status":"verified","url":"https://sparkmailapp.com/legal/privacy-app","locator":"Privacy Policy for App > Data Sharing Outside the European Economic Area","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The personal data we collect is stored on the US servers, which participate in the Data Privacy Framework"},{"key":"dpa","value":"Yes: the DPA is published and supplements the Terms of Service, concluded with Spark Mail Limited (Dublin) as processor","status":"verified","url":"https://sparkmailapp.com/legal/data-processing-agreement","locator":"Data Processing Addendum, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"constitutes a binding agreement between the Controller and the Processor."},{"key":"subprocessor_list","value":"No public list; the full list is given on request (DPA Schedule 3). Privacy policy names AI providers Azure OpenAI, OpenAI, Anthropic and Google Vertex AI","status":"verified","url":"https://sparkmailapp.com/legal/data-processing-agreement","locator":"Schedule 3. Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Parties agree that the full list of Sub-processors is not made publicly available."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Spark Mail Limited, Dublin, Ireland)","status":"verified","url":"https://sparkmailapp.com/legal/data-processing-agreement","locator":"Data Processing Addendum, parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"with offices at Glandore Business Centres, 26-27 Fitzwilliam Place, Fitzwilliam Hall, Dublin 2, D02T292, Ireland, as the Processor."},{"key":"data_retention","value":"AI providers keep inputs up to 30 days; Spark keeps meeting notes, AI history and writing-style data until you delete them or the account; recent-email notification data 4 hours; backups about 1 week","status":"verified","url":"https://sparkmailapp.com/legal/privacy-app","locator":"Privacy Policy for App > AI features; Data Retention table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AI providers may only retain your inputs for up to thirty (30) days as part of their abuse and misuse monitoring."},{"key":"certifications","value":"No certification named for the product; pricing page only mentions 'SOCII compliance' measures under Enterprise","status":"vendor_statement","url":"https://sparkmailapp.com/pricing","locator":"Pricing table > Extra Security & Controls","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enhance account security with measures like SOCII compliance."},{"key":"admin_ai_controls","value":"No organisation-wide switch found. Pricing FAQ: Spark +AI is off by default and each person manages it in their own app settings > Spark +AI","status":"not_published","url":"https://sparkmailapp.com/pricing","locator":"Pricing FAQ 'Is Spark +AI enabled by default?'; looked at: pricing table, app privacy policy, DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€22 per user/month billed monthly; €19.08 per user/month (€229 per year) billed yearly. VAT not shown","status":"verified","url":"https://sparkmailapp.com/pricing","locator":"Pricing > Pro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For professionals and client-facing teams who want to drive growth"}]}]},{"slug":"speechify","name":"Speechify Premium","vendor":"Speechify, Inc.","category":"phone-and-voice","plans":[{"id":"T424","plan":"","tier":"personal","price":{"label":"$29 / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated: no clause says content is or is not used to train models. The privacy policy says staff may view User Content 'to improve our algorithms', and Terms 7.8 give Speechify a perpetual licence to use User Material in any manner. Google Drive data is stated not to be used to train generalized AI/ML models","status":"not_published","url":"https://speechify.com/privacy/","locator":"Does Speechify review User Content?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"or to improve our algorithms as described in the User Content section of our Terms of Service"},{"key":"training_opt_out","value":"Not stated: no training opt-out or setting described","status":"not_published","url":"https://speechify.com/privacy/","locator":"Privacy policy and terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No: privacy policy says information is processed and stored in the United States and users agree to US hosting; no EU option described","status":"verified","url":"https://speechify.com/privacy/","locator":"Where is my Information stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Information submitted to Speechify will be transferred to, processed, and stored in the United States."},{"key":"default_data_location","value":"United States: information submitted is transferred to, processed and stored in the US","status":"verified","url":"https://speechify.com/privacy/","locator":"Where is my Information stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Information submitted to Speechify will be transferred to, processed, and stored in the United States."},{"key":"dpa","value":"Not stated: no data processing agreement found for the Premium plan","status":"not_published","url":"https://speechify.com/tts-for-business/","locator":"Terms, privacy policy and business page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not published: no sub-processor list found","status":"not_published","url":"https://speechify.com/privacy/","locator":"Privacy policy, terms, business page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Speechify'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Speechify' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: users can delete their account in Settings (paid subscribers cancel first); Speechify may keep some personal data as long as reasonably necessary for legitimate interests and legal obligations","status":"verified","url":"https://speechify.com/privacy/","locator":"How long is Personal Data retained?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"However, we may keep some of your Personal Data for as long as reasonably necessary for our legitimate business interests"},{"key":"certifications","value":"SOC 2 (type not stated), a marketing claim on the business page; no ISO certification named","status":"vendor_statement","url":"https://speechify.com/tts-for-business/","locator":"Enterprise-grade Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Speechify is SOC 2 compliant and rigorous about data security"},{"key":"admin_ai_controls","value":"Not offered or not stated for the Premium plan: no admin console described","status":"not_published","url":"https://speechify.com/tts-for-business/","locator":"Pricing page, business page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $29 per month, billed monthly (Premium; a yearly toggle exists but its price was not in the page text)","status":"not_published","url":"https://speechify.com/pricing/","locator":"Pricing: Premium card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"spendesk","name":"Spendesk","vendor":"Spendesk SAS","category":"documents-hr-and-finance","plans":[{"id":"T601","plan":"Foundations","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The customer terms state that Customer Data is not made available to train or improve AI models, whether Spendesk's own or its providers'.","status":"verified","url":"https://www.spendesk.com/en/legals/terms/customers/","locator":"Customers T&Cs, 6.3 'Use of Customer Data by artificial intelligence systems'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Spendesk does not make Customer Data available for the purpose of training or improving artificial intelligence models, whether its own models or those of its third-party providers."},{"key":"training_opt_out","value":"Nothing to do: Spendesk states it does not train on Customer Data, and says its AI providers have training disabled by default.","status":"verified","url":"https://www.spendesk.com/en/legals/terms/customers/","locator":"Customers T&Cs, 6.3 and 6.4 'Third-party artificial intelligence providers'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Spendesk contractually ensures that such providers disable by default the use of processed data for training their artificial intelligence models."},{"key":"eu_residency_option","value":"No separate option is published. Data is already hosted in the EU, and no region selector is described.","status":"not_published","url":"https://www.spendesk.com/legals/privacy/","locator":"Section F; pricing and security pages checked for a region setting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"EU. Personal data is hosted on secure servers in the European Union; the security page names AWS as the host. Transfers outside the EU use adequacy or SCCs.","status":"verified","url":"https://www.spendesk.com/legals/privacy/","locator":"Privacy policy, F 'Hosting and transfer of Personal Data'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"The Personal Data processed by Spendesk is hosted on secure servers within the European Union."},{"key":"dpa","value":"Yes. Annex 3 to the Customers T&Cs is the data processing agreement and covers all platform and payment processing; it comes with the contract, not a separate signature.","status":"verified","url":"https://www.spendesk.com/en/legals/terms/customers/","locator":"Customers T&Cs, section 15 and Annex 3 'Data Processing Agreement'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Spendesk acts as a data processor in accordance with the terms of Annex 3 (Data Processing Agreement)"},{"key":"subprocessor_list","value":"Yes. 25 entries: 21 third-party companies plus 4 Spendesk group entities. AI providers on the list: Anthropic Ireland (Claude Enterprise), Google Cloud France (cloud hosting and AI) and Dust. The Terms (6.4) also name Google LLC (Gemini, OCR).","status":"verified","url":"https://www.spendesk.com/en/legals/subprocessors","locator":"'Third-party sub-processors' table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic Ireland, Limited (Claude Enterprise)"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Spendesk SAS, Paris)","status":"verified","url":"https://www.spendesk.com/legals/privacy/","locator":"Privacy policy, section G (DPO postal address)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Spendesk SAS - Data Protection Officer (DPO) - 51 rue de Londres, 75008 Paris, France"},{"key":"data_retention","value":"Export window of 30 days after termination, then data is kept under Spendesk's internal retention policy and legal rules. The DPA deletes or returns data on written request.","status":"verified","url":"https://www.spendesk.com/en/legals/terms/customers/","locator":"Customers T&Cs, 18.8 'Post-termination data access' and Annex 3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Upon expiry of the thirty (30) day Recovery Period defined above, Spendesk shall deactivate the Customer's access to its data hosted on the Platform."},{"key":"certifications","value":"ISO/IEC 27001:2022 certified, with the certificate in the trust centre. The page also lists GDPR, PCI-DSS through partners, DORA and the SCA.","status":"verified","url":"https://www.spendesk.com/spendesk-security/","locator":"Security page, 'ISO 27001:2022' section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Spendesk also holds the ISO 27001:2022 certification"},{"key":"admin_ai_controls","value":"Not published. Spendesk documents AI features and their data use, but no administrator switch to disable AI for the organisation.","status":"not_published","url":"https://www.spendesk.com/en/legals/terms/customers/","locator":"Customers T&Cs section 6; pricing, security and AI pages (no AI on/off control found)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"price_eur","value":"No price published. Spendesk charges a fixed monthly platform fee plus per-transaction fees and asks buyers to request a free quote; the pricing page shows no amounts.","status":"not_published","url":"https://www.spendesk.com/pricing/","locator":"Pricing page, 'How are prices calculated?' FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""}]}]},{"slug":"sprout-social","name":"Sprout Social","vendor":"Sprout Social, Inc.","category":"sales-marketing-and-support","plans":[{"id":"T522","plan":"Standard","tier":"business","price":{"label":"$199 / user / mo","amount":199,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Default not stated. Sprout says customers have the option to exclude their data from model training, and that data sent to OpenAI is covered by no-training agreements.","status":"verified","url":"https://media.sproutsocial.com/uploads/Sprout-Socials-Commitment-to-Responsible-AI.pdf","locator":"Principles: User Control and Feedback","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We give customers the option to exclude their data from model training."},{"key":"training_opt_out","value":"Sprout says customers can exclude their data from model training and opt out of the OpenAI integration (not possible for Influencer Marketing); the steps are not published in the documents read. OpenAI features can be disabled in platform Settings.","status":"verified","url":"https://media.sproutsocial.com/uploads/Sprout-Socials-Commitment-to-Responsible-AI.pdf","locator":"Principles: User Control and Feedback","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers can also opt-out of our third-party integration with OpenAI"},{"key":"eu_residency_option","value":"Not stated; no customer-selectable EU data location found. Privacy policy only says servers are in the United States and the EEA.","status":"not_published","url":"https://sproutsocial.com/subprocessors/","locator":"Subprocessors; privacy policy section 13; security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (AWS is the hosting provider); the privacy policy also says Sprout has servers in the EEA.","status":"verified","url":"https://sproutsocial.com/subprocessors/","locator":"Sprout Social platform list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS (Amazon Web Services), Inc. Hosting provider United States"},{"key":"dpa","value":"Yes: the Data Processing Addendum forms part of the Terms and must be entered into if personal data is processed; a downloadable PDF is published.","status":"verified","url":"https://sproutsocial.com/legal/terms/","locator":"12.2 Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The DPA forms part of these Terms and applies to the processing of personal data."},{"key":"subprocessor_list","value":"Yes, public at sproutsocial.com/subprocessors: 19 entries for the Sprout Social platform (13 for Employee Advocacy, 9 for Influencer Marketing); AI providers: OpenAI (all three), Google Gemini (Influencer Marketing).","status":"verified","url":"https://sproutsocial.com/subprocessors/","locator":"Sprout Social Subprocessors, platform list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OpenAI, L.L.C.* AI model provider United States"},{"key":"dpf_status","value":"Active (Sprout Social; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Sprout Social'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"After cancellation Sprout may delete account and content within 30 days under the Terms; the DPA lets it keep personal data up to 13 months for reactivation unless the customer asks for deletion or return.","status":"verified","url":"https://media.sproutsocial.com/uploads/Downloadable-Customer-DPA.pdf","locator":"8.1 Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"may retain Subscriber Personal Data for up to thirteen (13) months after termination of the Agreement for the purposes of future account reactivation"},{"key":"certifications","value":"5 named: SOC 2 Type 2, ISO 27001, ISO 27701, PCI DSS attestations, CSA STAR Level 1 assessment (a self-assessment).","status":"verified","url":"https://sproutsocial.com/trust-center/","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sprout Social maintains the following certifications, attestations, and reports to verify its compliance with industry frameworks and applicable laws and regulations."},{"key":"admin_ai_controls","value":"Yes for OpenAI-powered features: they can be disabled within the platform through Settings; this does not apply to Influencer Marketing, where they cannot be disabled.","status":"verified","url":"https://sproutsocial.com/subprocessors/","locator":"Footnote under platform list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These features can be disabled within the platform through your Settings."},{"key":"price_eur","value":"Shown in USD only: $199 per seat per month, billed annually (Professional is $299, Advanced $399).","status":"not_published","url":"https://sproutsocial.com/pricing","locator":"Plans: Standard","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"squarespace","name":"Squarespace Core","vendor":"Squarespace Ireland Limited (Squarespace, Inc. for US customers)","category":"code-and-app-builders","plans":[{"id":"T545","plan":"website plan","tier":"business","price":{"label":"€24 / mo","amount":24,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Squarespace itself. The AI Terms send your AI input to third-party AI providers 'to use in accordance with its terms and policies'; no training statement appears in the AI Terms, terms, privacy policy or DPA.","status":"not_published","url":"https://www.squarespace.com/aiterms","locator":"6. AI Software Service Providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"transmit Input to the applicable AI Software Service Provider for such AI Software Service Provider to use in accordance with its terms and policies; and (b) enable the applicable AI"},{"key":"training_opt_out","value":"Not stated; no training clause or opt-out setting is described.","status":"not_published","url":"https://www.squarespace.com/aiterms","locator":"AI Terms; privacy policy and DPA also searched","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU hosting option is described in the privacy policy, DPA or security page.","status":"not_published","url":"https://www.squarespace.com/security","locator":"Security page; privacy policy and DPA also checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States servers: the privacy policy gives 'our servers in the US' as the example of where information is transferred. No hosting provider is named.","status":"verified","url":"https://www.squarespace.com/privacy","locator":"9. Data transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"such as, for example, to our servers in the US. We also"},{"key":"dpa","value":"Yes: the Data Processing Addendum is part of the Agreement you accept by using the services (no signing needed).","status":"verified","url":"https://www.squarespace.com/terms-of-service","locator":"Preamble","url2":"https://www.squarespace.com/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By using or accessing the Services, you're agreeing to these Terms, our Product Specific Terms, our Acceptable Use Policy and our Data Processing Addendum (collectively, this “Agreement”). If you're using"},{"key":"subprocessor_list","value":"No public list: a list of current Sub-Processors is available on request by emailing privacy@squarespace.com. Its AI help article names OpenAI, Anthropic and Google as the AI software providers.","status":"verified","url":"https://www.squarespace.com/dpa","locator":"5.7 Sub-Processors","url2":"https://support.squarespace.com/hc/articles/16282290976013-Using-Squarespace-AI","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A list of our current Sub-Processors is available upon request by sending an email to privacy@squarespace.com. Provided that your objection"},{"key":"dpf_status","value":"Active (Squarespace, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Squarespace'","url2":"https://www.squarespace.com/dpa","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: information is kept while the account is active and 'a reasonable period' after cancellation or trial expiry; you can delete your account yourself or by emailing privacy@squarespace.com.","status":"verified","url":"https://www.squarespace.com/privacy","locator":"8. How we retain your information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we may not immediately delete your information when your trial expires or you cancel all your paid Services. Instead, we keep your information for a reasonable period of time, so"},{"key":"certifications","value":"No ISO or SOC audit certification named; the security page states PCI-DSS compliance of its built-in payment integrations only.","status":"not_published","url":"https://www.squarespace.com/security","locator":"PCI Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features is described in the AI Terms or on the security page.","status":"not_published","url":"https://www.squarespace.com/aiterms","locator":"AI Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€24 per month and €18 per month are both shown for Core (the monthly and annual billing toggle); VAT treatment is not stated.","status":"verified","url":"https://www.squarespace.com/pricing","locator":"Core plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unlock our full array of business features as you grow your business. €24/mo €18/mo Get started→"}]}]},{"slug":"stackfield","name":"Stackfield","vendor":"Stackfield GmbH","category":"workspace-and-projects","plans":[{"id":"T475","plan":"Business","tier":"business","price":{"label":"€14 / user / mo","amount":14,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Stackfield says customer data is not used to train AI models; each AI request is processed statelessly and deleted immediately after processing.","status":"verified","url":"https://www.stackfield.com/stackfield-ai","locator":"Stackfield AI FAQ, 'Are our data used to train AI models?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No, your data are not used to train AI models."},{"key":"training_opt_out","value":"Nothing to do: Stackfield states it does not train AI models on customer data.","status":"verified","url":"https://www.stackfield.com/stackfield-ai","locator":"Stackfield AI FAQ, 'Are our data used to train AI models?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No, your data are not used to train AI models."},{"key":"eu_residency_option","value":"Yes, by default for every customer: all data processing, including telemetry, happens on servers in the EU. Nothing to switch on.","status":"verified","url":"https://www.stackfield.com/en/security","locator":"Security page, Data processing only on servers in the EU","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"occurs exclusively on servers in the EU"},{"key":"default_data_location","value":"Germany. Data storage takes place in German data centers; infrastructure provider named for the AI models and the rest of Stackfield is IONOS SE.","status":"verified","url":"https://www.stackfield.com/en/security","locator":"Security page, Data processing only on servers in the EU","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data storage takes place in German data centers."},{"key":"dpa","value":"Yes. A GDPR data processing agreement can be concluded online with a few clicks (click-through); no extra agreement is needed to use Stackfield AI.","status":"verified","url":"https://www.stackfield.com/en/security","locator":"Security page, Data Processing Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can conclude the agreement required due to the GDPR with a few clicks."},{"key":"subprocessor_list","value":"No public list found. The AI page says the subcontractor IONOS SE is on a subcontractor list that is part of the data processing agreement; the security page says all subcontractors are EU-based.","status":"not_published","url":"https://www.stackfield.com/stackfield-ai","locator":"Stackfield AI FAQ; security page; privacy policy (no subprocessor page found: /en/subprocessors returns 404)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The subcontractor IONOS SE, which provides the infrastructure for the AI models, is already listed in the subcontractor list"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Stackfield GmbH, Munich, Germany)","status":"verified","url":"https://www.stackfield.com/en/terms","locator":"Terms and conditions, parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"These terms and conditions apply to all business relations between Stackfield GmbH, Maximiliansplatz 17, 80333 München"},{"key":"data_retention","value":"Content retention period is not stated. Automated deletion rules are available only from the Premium plan, so not on Business; accounts that never log in after the 14-day trial are deleted after 3 months.","status":"not_published","url":"https://www.stackfield.com/en/security","locator":"Security page, Automated deletion rules","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"deletion rules are available from the Premium package onwards to ensure that all deletion deadlines are met without administrative effort."},{"key":"certifications","value":"4 named: ISO 27001, ISO 27017, ISO 27018 and the BSI C5 attestation.","status":"verified","url":"https://www.stackfield.com/en/security","locator":"Security page, certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Stackfield holds the BSI C5 attestation and is certified to multiple ISO standards."},{"key":"admin_ai_controls","value":"Not stated. Stackfield AI is a paid add-on that has to be booked; no admin switch for AI features is described.","status":"not_published","url":"https://www.stackfield.com/stackfield-ai","locator":"Stackfield AI page, 'In which plan is Stackfield AI available?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Stackfield AI can be booked as an additional add-on in all plans."},{"key":"price_eur","value":"€14 per user/month, €70.00/month in total for 5 users on the Business plan, shown for yearly payment (toggle 'Yearly (SAVE 17 %)'; the page label is garbled). Prices exclude VAT per the terms; Business has unlimited users.","status":"verified","url":"https://www.stackfield.com/en/pricing","locator":"Pricing page, BUSINESS card (5 users)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"70,00€ / Month (when paid yearlymonthly)"}]}]},{"slug":"superhuman-mail","name":"Superhuman Mail","vendor":"Superhuman Platform Inc.","category":"writing-and-email","plans":[{"id":"T115","plan":"Business","tier":"business","price":{"label":"$33 / user / mo","amount":33,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless switched off: the Terms (7.2) license your content to operate and improve the services, including training (their example: the suggestion engine), and the plans page lists model training as 'Opt out' for Business.","status":"verified","url":"https://superhuman.com/legal/terms","locator":"Terms 7.2 License to User Content, (i)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"your acceptance or rejection of our grammatical suggestions may help train our suggestion engine"},{"key":"training_opt_out","value":"Switch model training off in your settings: the plans page lists model training as 'Opt out' for Business (it is off by default only on Enterprise). No menu path is published.","status":"vendor_statement","url":"https://superhuman.com/plans","locator":"Plan comparison, Privacy row 'Model training'","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Privacy Model training Opt out Opt out Opt out Off by default"},{"key":"eu_residency_option","value":"None documented","status":"not_published","url":"https://superhuman.com/legal/dpa","locator":"Whole DPA","url2":"https://superhuman.com/mail/pricing","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Superhuman Mail is hosted on Google Cloud Platform, and the platform's infrastructure is located in the US","status":"verified","url":"https://superhuman.com/legal/dpa","locator":"Exhibit B, Section 1 (hosting) and the Superhuman Mail service-specific measures","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The Superhuman Data Privacy Addendum (effective 8 Jul 2026) is incorporated into the agreements between the customer and Superhuman Platform Inc.","status":"verified","url":"https://superhuman.com/legal/dpa","locator":"Opening paragraph","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public, one list for the whole Superhuman Platform: 20 third parties, all in the US (AI: Anthropic, Azure, OpenAI, Baseten; transcription: Deepgram, Soniox), plus 8 group companies; undated","status":"verified","url":"https://superhuman.com/legal/subprocessors","locator":"Section 'Third-party Sub-processors'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Superhuman Platform Inc., formerly Grammarly, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Superhuman'","url2":"https://superhuman.com/legal/dpa","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No period stated: users can ask hello@superhuman.com to delete their data; after the agreement ends, Superhuman returns or destroys customer personal data on written request","status":"not_published","url":"https://help.superhuman.com/hc/en-us/articles/46005588676237-Superhuman-AI-Overview","locator":"FAQ 'Can I request to have my data deleted?'","url2":"https://superhuman.com/legal/dpa","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 27701:2019 (Superhuman Platform)","status":"verified","url":"https://www.grammarly.com/security","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not published for Business: admin security and controls are listed as an Enterprise feature; no Business setting to turn AI off was found","status":"not_published","url":"https://superhuman.com/mail/pricing","locator":"Plan card 'Enterprise' ('Admin security and controls')","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 33 per member/month billed annually (15% off for teams of 5 or more)","status":"not_published","url":"https://superhuman.com/mail/pricing","locator":"Plan card 'Business' with 'Annual' selected","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"supernormal","name":"Supernormal","vendor":"Supernormal Technologies, Inc.","category":"meetings-and-notes","plans":[{"id":"T392","plan":"Business","tier":"business","price":{"label":"Free","amount":0,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No for the web platform on Pro and Business: the Terms say Supernormal will not train any AI model on your content. The desktop/mobile App is excluded; its content falls under the Privacy Notice, which has no training clause.","status":"verified","url":"https://www.supernormal.com/terms","locator":"5.3 AI Models; Training","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Supernormal will not use or share any Customer Materials (including Output) provided or generated from Customer’s use of the Supernormal Platform to train any AI or machine learning models (including Supernormal’s)."},{"key":"training_opt_out","value":"Nothing to do for the web platform on the Business tier (terms exclude training). For content from the desktop/mobile App no opt-out is described; the terms carve it out of the no-training promise.","status":"verified","url":"https://www.supernormal.com/terms","locator":"5.3 AI Models; Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Supernormal will not use or share any Customer Materials (including Output) provided or generated from Customer’s use of the Supernormal Platform to train any AI or machine learning models (including Supernormal’s)."},{"key":"eu_residency_option","value":"Not stated: no EU hosting option found in the terms, security page or sub-processor list.","status":"not_published","url":"https://www.supernormal.com/security","locator":"Security page; terms Attachment 1; sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the sub-processors for data management (AWS, Google Cloud, Azure) are listed in the USA, and the DPA authorises transfers from the EEA to the US.","status":"verified","url":"https://www.supernormal.com/terms","locator":"Attachment 1, Cross-Border Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer authorizes Supernormal and its Subprocessors to transfer Customer Personal Data across international borders, including from the European Economic Area, Switzerland, and/or the United Kingdom to the United States."},{"key":"dpa","value":"Yes. A Data Processing Addendum is attached to the terms (Attachment 1) and applies to company customers automatically; the security page says a DPA is available for every customer.","status":"verified","url":"https://www.supernormal.com/terms","locator":"Attachment 1 Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and is subject to the terms and conditions of the End User Terms (the “User Terms”) by and between Customer and Supernormal."},{"key":"subprocessor_list","value":"Yes, public list at https://www.supernormal.com/subprocessors (updated 29 May 2026): 19 sub-processors, all in the USA. AI providers: Anthropic, OpenAI, Microsoft Azure; also AssemblyAI (transcription).","status":"verified","url":"https://www.supernormal.com/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Supernormal engages the third-party providers in the table below to perform limited activities in connection with the services provided."},{"key":"dpf_status","value":"No listing found for search term 'Supernormal'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Supernormal' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"The Business plan lists a 'Data retention' setting (period not published). At the end of the terms Supernormal deletes customer personal data; backups are deleted on its own retention schedule (no period given).","status":"verified","url":"https://www.supernormal.com/terms","locator":"Attachment 1, Customer Personal Data Deletion","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"At the expiry or termination of the User Terms, Supernormal will delete all Customer Personal Data (excluding any back-up or archival copies which shall be deleted in accordance with Supernormal’s data retention schedule)"},{"key":"certifications","value":"SOC 2 (1 named; audited annually, report under NDA). It also claims HIPAA support (BAA) and GDPR compliance, which are not certifications.","status":"verified","url":"https://www.supernormal.com/security","locator":"Certifications and frameworks","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Audited annually by an independent third party against the security, availability, and confidentiality criteria. Report available under NDA."},{"key":"admin_ai_controls","value":"Not stated: the Business plan lists 'Member visibility and admin controls' but no organisation-wide switch for AI features.","status":"not_published","url":"https://www.supernormal.com/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page is credit-based and its text shows only a $0 placeholder for Team and Business; real prices need a browser.","status":"not_captured","url":"https://www.supernormal.com/pricing","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"surfer-seo","name":"Surfer","vendor":"Surfer sp. z o.o. (Positive group)","category":"sales-marketing-and-support","plans":[{"id":"T524","plan":"Standard","tier":"business","price":{"label":"€99 / mo","amount":99,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training clause found in the Regulations (terms), customer privacy policy, general privacy policy or the AI Instructions page.","status":"not_published","url":"https://surferseo.com/legal/regulations/","locator":"Regulations; customer and general privacy policies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause and no opt-out found.","status":"not_published","url":"https://surferseo.com/legal/regulations/","locator":"Regulations; privacy policies","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no setting to pin data to the EU found. The policy says transfers outside the EU happen in justified cases.","status":"not_published","url":"https://surferseo.com/legal/privacy-policy-customers/","locator":"§2 point 7; §5 Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU or United States: the hosting provider is Google Cloud Platform, with processing location listed as EU / United States.","status":"verified","url":"https://surferseo.com/legal/privacy-policy-customers/","locator":"§5 List of Subprocessors: Cloud Infrastructure & Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Google Cloud Platform Description: Cloud infrastructure provider for hosting, data processing, storage, and backups Processing Location: EU / United States"},{"key":"dpa","value":"Yes: customers who enter employee or associate data enter into a data processing agreement by accepting the customer privacy clause; no separate signing.","status":"verified","url":"https://surferseo.com/legal/privacy-policy-customers/","locator":"§3 Determination of the purpose, nature and duration of entrustment of processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"by accepting the Clause, you enter into a Data processing agreement"},{"key":"subprocessor_list","value":"Yes, listed in the customer privacy policy (§5): 24 entries; AI-related ones are Fireflies (AI meeting assistant), bards.ai (AI/ML consultancy) and Grammarly; no large-language-model provider named.","status":"verified","url":"https://surferseo.com/legal/privacy-policy-customers/","locator":"§5 List of Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"List of Subprocessors: I. Cloud Infrastructure & Hosting Google Cloud Platform"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Surfer Sp. z o.o., Wrocław, Poland)","status":"verified","url":"https://surferseo.com/legal/regulations/","locator":"§1 General conditions, Administrator","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Surfer Sp. z o.o. in Wrocław with registered office at the following address: Pl. Solny 14/3, 50-062 Wrocław, Poland"},{"key":"data_retention","value":"Account data is deleted or returned within 30 days of contract end or on written deletion request; query results stay accessible for the last three months.","status":"verified","url":"https://surferseo.com/legal/privacy-policy-customers/","locator":"§3 point 5","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Within 30 (thirty) days from the date of termination of the Contract or receipt of a written request for deletion of the Entrusted Data, at your option, we will delete or return the Entrusted Data to you"},{"key":"certifications","value":"Not stated for Surfer itself; the Positive group trust centre names ISO 27001 only for Positive Signitic, a different product.","status":"not_published","url":"https://positivegroup.com/trust-center","locator":"Advanced Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide AI feature switch documented in the terms or pricing page.","status":"not_published","url":"https://surferseo.com/pricing","locator":"Standard plan features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"€99 per month, billed yearly (saves €240 a year against monthly); VAT not shown.","status":"verified","url":"https://surferseo.com/pricing","locator":"Plans: Standard","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Standard 99 EUR per month Billed yearly"}]}]},{"slug":"surveymonkey","name":"SurveyMonkey","vendor":"SurveyMonkey Inc. (US); SurveyMonkey Europe UC (Dublin, Ireland) for EEA/UK customers","category":"research-forms-and-storage","plans":[{"id":"T625","plan":"Team Advantage","tier":"business","price":{"label":"€30 / user / mo","amount":30,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. SurveyMonkey uses de-identified customer data, or synthetic data, to train its own AI models. It says personal data is excluded and the AI providers it uses (such as OpenAI) do not train on the data shared with them.","status":"verified","url":"https://www.surveymonkey.com/learn/trust-center/","locator":"FAQs: Is my data used to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we use de-identified customer data or synthetically-generated data to train and build our proprietary AI models"},{"key":"training_opt_out","value":"Not stated. No setting, admin control or email is described for stopping de-identified survey data being used to train SurveyMonkey's models.","status":"not_published","url":"https://www.surveymonkey.com/product/features/ai-principles/","locator":"Is my data used to train AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Enterprise plan only: Enterprise users can choose where some of their data is stored (Ireland, Canada or US). Not described for Team Advantage.","status":"verified","url":"https://www.surveymonkey.com/learn/trust-center/","locator":"FAQs: data centres","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Enterprise users can select the physical location for the storage of some of their data."},{"key":"default_data_location","value":"United States by default: if no regional data centre is shown in Account Details, data is on US servers. Depending on plan and region a regional centre (Canada or Ireland) is offered on some plans and regions.","status":"verified","url":"https://help.surveymonkey.com/en/policy/surveymonkey-data/","locator":"Where Your Data Is Stored","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you don't see anything listed, your data is stored on servers located in the United States."},{"key":"dpa","value":"Yes. An online DPA applies to self-serve customers and contains the EU transfer mechanisms automatically; EEA/UK customers contract with SurveyMonkey Europe UC (Ireland), US customers with SurveyMonkey Inc.","status":"verified","url":"https://www.surveymonkey.com/mp/legal/subprocessor-list/","locator":"Part I, contracting entities","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are a self-serve Customer, our online DPA contains these transfer mechanisms automatically."},{"key":"subprocessor_list","value":"Yes, public at https://www.surveymonkey.com/mp/legal/subprocessor-list/: 21 rows (13 apply to the main SurveyMonkey product). AI providers: OpenAI, Amazon Web Services (Bedrock) and Abacus.ai for SurveyMonkey; Anthropic (professional services) and Google (GetFeedback) for other services.","status":"verified","url":"https://www.surveymonkey.com/mp/legal/subprocessor-list/","locator":"Part II: Onward Transfers to Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cloud hosting and data storage; generative AI technology for SurveyMonkey's AI features (AWS Bedrock)"},{"key":"dpf_status","value":"Active (SurveyMonkey Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'SurveyMonkey'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Data is kept while the account is active and the customer controls deletion. Deleted surveys and data are permanently removed from SurveyMonkey's systems after 1 year; deleted accounts likewise after 1 year.","status":"verified","url":"https://help.surveymonkey.com/en/policy/surveymonkey-data/","locator":"Data Retention and Restoration of Deleted Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Once deleted from your account, the survey or data won’t be accessible and you may not be able to restore it. The deleted data is permanently removed from our system in 1 year."},{"key":"certifications","value":"3 named: SOC 2 Type II, ISO 27001 (certified since 2019) and PCI DSS. SurveyMonkey also reports Data Privacy Framework self-certification and a HIPAA add-on for Enterprise only.","status":"verified","url":"https://www.surveymonkey.com/learn/trust-center/","locator":"Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SurveyMonkey has been ISO 27001-certified since 2019, and SOC 2-certified since 2021."},{"key":"admin_ai_controls","value":"Not stated. Team plans have user roles and account permissions, but no admin setting to switch AI features off is described.","status":"not_published","url":"https://www.surveymonkey.com/pricing/","locator":"Team Advantage features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"User roles and account permissions"},{"key":"price_eur","value":"EUR 30 per user per month, starting at 3 users, billed annually. VAT treatment is not shown.","status":"verified","url":"https://www.surveymonkey.com/pricing/","locator":"Team plans, Team Advantage card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Starting at 3 users, billed annually"}]}]},{"slug":"synthesia","name":"Synthesia","vendor":"Synthesia Limited","category":"design-images-and-video","plans":[{"id":"T550","plan":"Pro","tier":"business","price":{"label":"$89 / mo","amount":89,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. Synthesia states it does not use customer inputs or outputs to pre-train its AI; fine-tuning on customer data happens only on the customer's written instruction.","status":"verified","url":"https://www.synthesia.io/legal/ai-governance-practices","locator":"Training, Data and Provenance > No Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Synthesia does not use Customer Data, including inputs or outputs, to pre-train its AI Components."},{"key":"training_opt_out","value":"Nothing to do: Synthesia states it does not use customer inputs or outputs to pre-train its AI.","status":"verified","url":"https://www.synthesia.io/legal/ai-governance-practices","locator":"Training, Data and Provenance > No Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Synthesia does not use Customer Data, including inputs or outputs, to pre-train its AI Components."},{"key":"eu_residency_option","value":"EU storage (Ireland) is the default; the security page describes no separate setting to choose. It also says some data transfers to the USA run under Standard Contractual Clauses.","status":"verified","url":"https://www.synthesia.io/legal/security-practices","locator":"Data location / storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Data is currently stored within the European Union (EU), in data centers based in Ireland."},{"key":"default_data_location","value":"European Union: Customer Data is stored in AWS data centres in Ireland; operational backups in Ireland, secondary backups in AWS Frankfurt.","status":"verified","url":"https://www.synthesia.io/legal/security-practices","locator":"Data location / storage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer Data is currently stored within the European Union (EU), in data centers based in Ireland."},{"key":"dpa","value":"Yes. A Data Processing Addendum is published, and the Customer Terms of Service incorporate it by reference; a signed copy can be executed through a link on the DPA page.","status":"verified","url":"https://www.synthesia.io/legal/data-processing-agreement","locator":"Data Processing Agreement page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Synthesia offers a Data Processing Addendum that supplements the Customer Terms of Service or any main online subscription agreement."},{"key":"subprocessor_list","value":"Yes, public at https://www.synthesia.io/legal/subprocessors: 33 entries (4 affiliates, 6 infrastructure, 12 script processing, 9 asset processing, 2 other). AI providers named include OpenAI, Anthropic, Google Cloud, Microsoft, ElevenLabs, DeepL, Runway, BFL, BytePlus.","status":"verified","url":"https://www.synthesia.io/legal/subprocessors","locator":"Sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers"},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Synthesia Limited, London)","status":"verified","url":"https://www.synthesia.io/legal/privacy-policy","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are Synthesia Limited, a company located at 20 Triton St, London NW1 3BF, United Kingdom"},{"key":"data_retention","value":"Customer content is kept under the customer's instructions and retention settings. On a deletion request or account termination it is deleted within up to 90 days (automatically if no request); backups may linger briefly.","status":"verified","url":"https://www.synthesia.io/legal/security-practices","locator":"Deletion of Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If no deletion request is made after account termination, Customer Data will be automatically deleted within 90 days."},{"key":"certifications","value":"3: ISO 42001, ISO 27001 and SOC 2 Type II (periodic audits).","status":"verified","url":"https://www.synthesia.io/legal/security-practices","locator":"Auditing / compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Synthesia undergoes a periodic ISO 42001, ISO 27001, and SOC2 Type II audit."},{"key":"admin_ai_controls","value":"Yes in general: Synthesia states customers can enable or disable AI-assisted generation of content. The page names no plan restriction and no admin role for the setting.","status":"verified","url":"https://www.synthesia.io/legal/security-practices","locator":"Shared responsibility: Content generation","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Content generation: Customers can enable or disable the use of AI-assisted generation of content."},{"key":"price_eur","value":"Shown in USD only: $89 per month for Pro, billed monthly (6,000 credits a month).","status":"not_published","url":"https://www.synthesia.io/pricing","locator":"Pricing page, Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"synthflow","name":"Synthflow","vendor":"Synthflow (AgentFlow AI GmbH)","category":"phone-and-voice","plans":[{"id":"T69","plan":"Enterprise","tier":"enterprise","price":{"label":"$30,000 / yr","amount":null,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"No. Synthflow does not use customer input or output to train its own or third-party models","status":"verified","url":"https://docs.synthflow.ai/docs/terms-conditions","locator":"Clause on Input and Output ('Synthflow does not use Customer Input or Output to train…')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: no training on customer content","status":"verified","url":"https://docs.synthflow.ai/docs/terms-conditions","locator":"Clause on Input and Output","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes: workspaces can be in the EU region","status":"verified","url":"https://docs.synthflow.ai/ip-allow-lists","locator":"Region addresses ('EU')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Set per workspace: each workspace has a region, Global, US or EU (Settings > Workspace Settings > Preferences)","status":"verified","url":"https://docs.synthflow.ai/ip-allow-lists","locator":"Section on finding your region","url2":"https://security.synthflow.ai/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, on request: Synthflow provides a data processing agreement on request, to be signed between the parties","status":"verified","url":"https://docs.synthflow.ai/docs/terms-conditions","locator":"Clause on personal data in Input","url2":"https://security.synthflow.ai/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 20 entries, 18 listed for the US and EU, 2 US only (Hex, Cerebrium); AI: OpenAI, Anthropic, Deepgram, ElevenLabs, Soniox; hosting on AWS, Google Cloud and Azure","status":"verified","url":"https://security.synthflow.ai/","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, AgentFlow AI GmbH, Berlin). Search 'Synthflow' returned no results","status":"verified","url":"https://docs.synthflow.ai/docs/privacy-policy","locator":"Section 'Data Controller'","url2":"https://www.dataprivacyframework.gov/list","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Per agent: recordings can be switched off, and 'Limit Data Retention to 30 days' deletes transcripts, recordings and caller IDs after 30 days; PII redaction is available. Without the toggle no limit is stated","status":"verified","url":"https://docs.synthflow.ai/security-and-compliance","locator":"Sections 'Save Recordings' and 'Limit Data Retention to 30 days'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 42001:2023 and PCI DSS v4.0.1; HIPAA, GDPR and EU AI Act listed","status":"verified","url":"https://security.synthflow.ai/","locator":"Compliance section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Per agent: recording, retention and PII redaction are set in each agent's Security & Compliance section; workspace controls are scoped in enterprise contracts","status":"verified","url":"https://docs.synthflow.ai/security-and-compliance","locator":"Agent editor, Security & Compliance","url2":"https://synthflow.ai/pricing","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: enterprise contracts from USD 30,000 per year; no self-serve price shown","status":"not_published","url":"https://synthflow.ai/pricing","locator":"Enterprise pricing section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"tabnine","name":"Tabnine Enterprise","vendor":"Tabnine (legal entity not stated in the pages read)","category":"code-and-app-builders","plans":[{"id":"T532","plan":"SaaS","tier":"enterprise","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Tabnine says it does not train on customer code, except on a private custom model the team asks for. Caveat: optional third-party chat models can have different privacy terms.","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/tabnine-subscription-plans/enterprise-saas.md","locator":"About Tabnine Enterprise (SaaS), Code privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tabnine doesn't train on your code (unless you specifically opt for a private custom model for your team)."},{"key":"training_opt_out","value":"Nothing to do: the docs state Tabnine does not train on customer code (a private custom model is trained on your code only if you ask for it).","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/privacy.md","locator":"Code Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tabnine does not train its models on your code"},{"key":"eu_residency_option","value":"No EU region is named for the SaaS version (hosted on AWS and Google Cloud in the US). Enterprise customers can instead run Tabnine in their own VPC or on-premises, which is a separate deployment.","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/tabnine-subscription-plans/enterprise-saas.md","locator":"About Tabnine Enterprise","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"developers have the flexibility to run the model on-premises or in a VPC, ensuring full control over their data and infrastructure"},{"key":"default_data_location","value":"United States. Tabnine's SaaS runs on AWS (North Virginia) and Google Cloud (Council Bluffs, Iowa).","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/security.md","locator":"Tabnine SaaS datacenters","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AWS’s main datacenter is located in North Virginia on the East Coast, GCP’s main datacenter is located in Council Bluffs, Iowa, North America"},{"key":"dpa","value":"Not captured: Tabnine's contracts page (tabnine.com/legal-information/contracts) returned HTTP 502, and the docs do not mention a DPA.","status":"not_captured","url":"https://www.tabnine.com/legal-information/contracts","locator":"Contracts page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Not stated in the docs. Tabnine points to its Trust Center (trust.tabnine.com), which loads only in a browser; no list was readable.","status":"not_captured","url":"https://trust.tabnine.com/","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not listed under its own name (Tabnine); its parent Tricentis is active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Tricentis'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Code sent for a suggestion or chat answer is not stored: the context is deleted immediately after the answer is returned. The one-week retention in the docs covers operational metrics and logs of self-hosted clusters only. No account-deletion period found.","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/privacy.md","locator":"Code Privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"after the server returns the answer to the client."},{"key":"certifications","value":"SOC 2 (report type, I or II, not stated): 1 certification named. The docs also say 'GDPR compliant', which is a claim, not a certification. No ISO certification is named in the docs read.","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/tabnine-subscription-plans/enterprise-saas.md","locator":"Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"* [SOC2 compliant](https://trust.tabnine.com/) * [GDPR compliant](https://trust.tabnine.com/)"},{"key":"admin_ai_controls","value":"Yes, partly. Enterprise administrators control and specify which AI models are available to their organisation.","status":"verified","url":"https://docs.tabnine.com/main/welcome/readme/ai-models.md","locator":"AI Models","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tabnine Enterprise administrators control and specify the models that are available to their organization."},{"key":"price_eur","value":"Not published. Enterprise (SaaS) accounts are set up together with Tabnine's sales team; the pricing page now redirects to a Tricentis contact form.","status":"not_published","url":"https://docs.tabnine.com/main/welcome/readme/tabnine-subscription-plans/enterprise-saas.md","locator":"Getting started with Tabnine Enterprise (SaaS)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tabnine Enterprise (SaaS) accounts can only be set up together with the Tabnine team."}]}]},{"slug":"tactiq","name":"Tactiq","vendor":"Tactiq HQ Pty Ltd","category":"meetings-and-notes","plans":[{"id":"T383","plan":"Team","tier":"business","price":{"label":"€13.33 / user / mo","amount":13.33,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for the vendor; the help centre says its AI provider (Microsoft Azure OpenAI) does not use submitted data to train or improve its models","status":"not_published","url":"https://help.tactiq.io/en/articles/7907775-large-language-models-gpt-openai-privacy-and-tactiq","locator":"Is my data used for LLM training?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated: no setting for opting out of training is described; the help article says the AI provider does not train on submitted data","status":"not_published","url":"https://help.tactiq.io/en/articles/7907775-large-language-models-gpt-openai-privacy-and-tactiq","locator":"Looked at help article, privacy policy, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: no EU storage setting is described in the pricing page, privacy policy or help article read","status":"not_published","url":"https://tactiq.io/pricing","locator":"Looked at pricing, privacy, terms, help article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the privacy policy says the user consents to disclosure of personal information to third parties outside Australia (and outside the EU for EU residents) and refers to transfers to the United States","status":"not_published","url":"https://tactiq.io/privacy","locator":"Disclosure to third parties","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Not stated for Team: the plan table lists a 'Curated Data Processing Agreement' only under Enterprise","status":"not_published","url":"https://tactiq.io/pricing","locator":"Plan comparison, Security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A list is said to be in the Trust Center at trust.tactiq.io, which needs JavaScript and could not be read","status":"not_captured","url":"https://trust.tactiq.io/","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Tactiq'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Tactiq' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"A meeting can be archived and is then deleted automatically after 30 days, or purged by hand; the terms say content is deleted immediately when the account is cancelled; Business adds advanced data retention","status":"verified","url":"https://help.tactiq.io/en/articles/7907775-large-language-models-gpt-openai-privacy-and-tactiq","locator":"Can I delete the source and generated data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"You can archive a meeting in Tactiq and either wait for it to be deleted automatically in 30 days or purge it from the archive manually."},{"key":"certifications","value":"2 named: SOC 2 Type II and ISO 27001; the plan table also lists GDPR and HIPAA compliance","status":"verified","url":"https://tactiq.io/pricing","locator":"FAQ on security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tactiq has SOC-2 Type II compliance to ensure your meeting data is protected"},{"key":"admin_ai_controls","value":"Not stated: the plan table lists team management and retention features but no switch to turn AI features off","status":"not_published","url":"https://tactiq.io/pricing","locator":"Plan comparison","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 13.33 per user per month, billed annually (Team plan, 1 to 20 users); VAT treatment not shown","status":"verified","url":"https://tactiq.io/pricing","locator":"Team","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"EUR €13.33 user/mo billed annually"}]}]},{"slug":"talkdesk","name":"Talkdesk CX Cloud / CXA","vendor":"Talkdesk, Inc.","category":"phone-and-voice","plans":[{"id":"T416","plan":"enterprise, Master Subscription Agreement","tier":"enterprise","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated: the terms let Talkdesk use customer data to operate and improve the services, but no clause mentions training AI models.","status":"not_published","url":"https://www.talkdesk.com/terms-of-service/","locator":"3.7 License by Customer to Talkdesk","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Talkdesk may use Customer Data to provide and ensure proper operation, improvement, and maintenance of the Services and associated systems and for benchmarking"},{"key":"training_opt_out","value":"Not published: no training opt-out is described, and no training statement was found.","status":"not_published","url":"https://www.talkdesk.com/terms-of-service/","locator":"3.7 License by Customer to Talkdesk","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: the security page mentions 'regional & sovereignty standards' without naming an EU storage option.","status":"not_published","url":"https://www.talkdesk.com/contact-center-platform/security-compliance/","locator":"Committed to security regional & sovereignty standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated: no default storage country or hosting provider found on the terms, DPA or security pages.","status":"not_published","url":"https://www.talkdesk.com/contact-center-platform/security-compliance/","locator":"Looked at terms of service, DPA page, privacy notice, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: a Data Processing Agreement pre-signed by Talkdesk is published; the customer countersigns it through DocuSign. The terms also say personal data is processed under it.","status":"verified","url":"https://www.talkdesk.com/legal/dpa/","locator":"Execute","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The document has been pre-signed by Talkdesk Inc. on behalf of its respective affiliates."},{"key":"subprocessor_list","value":"Yes: the DPA says Talkdesk keeps a list of authorised sub-processors in its support centre, but that page blocks automated reading, so the count and AI providers were not read.","status":"not_captured","url":"https://infra-cloudfront-talkdeskcom.svc.talkdeskapp.com/talkdesk_com/26MAR_Talkdesk-DPA-Customers-Resellers_online-DPA-Addendum.docx-3.pdf","locator":"6.1 List of Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A list of Talkdesk current Authorized Sub-Processors (the “List of Sub-processors”) is available at"},{"key":"dpf_status","value":"Active (Talkdesk; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Talkdesk'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Set by the customer, who can delete its data at any time. The customer can export data during the term and for 30 days afterwards; after termination Talkdesk deletes personal data as set out in the agreement or on request. No period for recordings or transcripts is stated.","status":"verified","url":"https://www.talkdesk.com/terms-of-service/","locator":"3.5 Customer Data","url2":"https://infra-cloudfront-talkdeskcom.svc.talkdeskapp.com/talkdesk_com/26MAR_Talkdesk-DPA-Customers-Resellers_online-DPA-Addendum.docx-3.pdf","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"During the Service Term and for thirty (30) days thereafter, Customer may export its Customer Data from the Talkdesk Service"},{"key":"certifications","value":"More than 30 claimed. Named on the security page: BSI C5, SOC 2 and 3, ISO 27001, PCI DSS Level 1, HIPAA, GDPR, ISO 22301, ISO/IEC 42001 (AI governance).","status":"vendor_statement","url":"https://www.talkdesk.com/contact-center-platform/security-compliance/","locator":"Security & Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Talkdesk provides a better way to trust with more than 30 security certifications (including BSI C5, SOC 2 and 3, ISO 27001, PCI DSS Level 1, HIPAA, GDPR, and the industry’s only ISO 22301 Business Continuity certification, and ISO/IEC 42001 for AI governance)."},{"key":"admin_ai_controls","value":"Not stated: no admin switch to turn AI features off was found.","status":"not_published","url":"https://www.talkdesk.com/contact-center-platform/security-compliance/","locator":"Looked at pricing, security page, terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published. The pricing page lists products (Copilot, Autopilot, Navigator, analytics) without amounts.","status":"not_published","url":"https://www.talkdesk.com/pricing-cxa/","locator":"Talkdesk Pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"AI-powered assistant that listens, guides, and supports agents in real time, surfacing the right insights to reduce effort and deliver faster resolutions."}]}]},{"slug":"tally","name":"Tally","vendor":"Tally BV (Ghent, Belgium)","category":"research-forms-and-storage","plans":[{"id":"T624","plan":"Pro","tier":"business","price":{"label":"€20 / mo","amount":20,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI-training clause found in the terms, privacy notice, GDPR page, DPA or pricing page. Tally has an AI assistant that uses Google AI Studio.","status":"not_published","url":"https://tally.so/help/gdpr","locator":"Subprocessors table, Google AI Studio row","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Abuse detection & AI assistant (opt-in)"},{"key":"training_opt_out","value":"Not stated. No training setting is described; the sub-processor table marks the AI assistant as opt-in.","status":"not_published","url":"https://tally.so/help/gdpr","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not needed: data is stored in the EU for every plan by default, with no setting to change.","status":"verified","url":"https://tally.so/privacy","locator":"Privacy notice, security paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your data is stored on high-security servers within the European Union."},{"key":"default_data_location","value":"EU: all form data is stored in Europe; the sub-processor table lists Google Cloud (Belgium) for hosting and storage.","status":"verified","url":"https://tally.so/help/gdpr","locator":"Is Tally GDPR Compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All Tally form data is encrypted both in transit and at rest, and stored in Europe."},{"key":"dpa","value":"Yes. A DPA with EU Standard Contractual Clauses is part of the terms: creating an account binds professional users to it on behalf of their company, and no signature is needed.","status":"verified","url":"https://tally.so/help/gdpr","locator":"Do you have a Data Processing Agreement?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"professional users also agree, on behalf of their company, to the content of our Data Processing Agreement and accept to be bound by it. It is not necessary to sign this document."},{"key":"subprocessor_list","value":"Yes, public on the GDPR help page: 15 rows, 12 companies (Cloudflare 3 rows, Google 2 rows). AI-related: Google AI Studio (abuse detection and AI assistant, opt-in), plus turbopuffer for search.","status":"verified","url":"https://tally.so/help/gdpr","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Abuse detection & AI assistant (opt-in)"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Tally BV, Ghent, Belgium)","status":"verified","url":"https://tally.so/privacy","locator":"Controller identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"with registered office at Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium and registered with the Crossroads Bank for Enterprises"},{"key":"data_retention","value":"Form data stays while the account is active and the customer controls it. Deleted submissions are permanently removed from backups within 90 days. Account profile data is kept 90 days after account deletion (some categories 2 or 7 years). Auto-delete after a set period is Business-only.","status":"verified","url":"https://tally.so/help/gdpr","locator":"What happens with form data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"all form data which has been deleted by you is permanently deleted from our back-ups within 90 days, unless you empty the Trash manually before that."},{"key":"certifications","value":"Not stated. No ISO 27001, SOC 2 or similar certification is named in the pricing, GDPR, privacy or DPA pages.","status":"not_published","url":"https://tally.so/help/gdpr","locator":"GDPR page and DPA security schedule","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated. Pro has shared workspaces and team access, but no organisation-wide setting to switch the AI assistant off is described.","status":"not_published","url":"https://tally.so/pricing","locator":"Pricing page, Pro card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 20 per month as shown on the page; yearly billing is offered with 2 months off. Includes unlimited team members. VAT treatment is not shown.","status":"verified","url":"https://tally.so/pricing","locator":"Do more with Tally, Pro card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Invite unlimited team members to shared workspaces."}]}]},{"slug":"taskade","name":"Taskade","vendor":"Taskcade Inc. (Taskade)","category":"workspace-and-projects","plans":[{"id":"T470","plan":"Business","tier":"business","price":{"label":"$25 / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Taskade does not use workspace content to train generalized AI models, and its contracts bar its AI providers from training on it.","status":"verified","url":"https://www.taskade.com/terms","locator":"Terms of Service, AI Features and Processing, No Training on Customer Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Taskade does not use your workspace content to train generalized AI models, and our agreements with third-party AI providers prohibit them from using your content to train their general models."},{"key":"training_opt_out","value":"Nothing to do: Taskade states it does not train on workspace content, so there is no setting to switch.","status":"verified","url":"https://www.taskade.com/terms","locator":"Terms of Service, AI Features and Processing, No Training on Customer Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Taskade does not use your workspace content to train generalized AI models"},{"key":"eu_residency_option","value":"Not stated as an option. The security page describes a single AWS US East region and no EU hosting choice.","status":"not_published","url":"https://www.taskade.com/security","locator":"Security page (Business continuity, Compliance); privacy policy; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Amazon AWS, US East (single region). AI requests can also be processed by providers outside the US, EU and UK depending on the model chosen.","status":"verified","url":"https://www.taskade.com/security","locator":"Security page, Business continuity","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Single AWS region (US East)"},{"key":"dpa","value":"No. The security page says Taskade does not currently offer a signed Data Processing Agreement or Standard Contractual Clauses to customers.","status":"verified","url":"https://www.taskade.com/security","locator":"Security page, Compliance and auditing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not currently offer a signed Data Processing Agreement or Standard Contractual Clauses to customers."},{"key":"subprocessor_list","value":"No public list. Taskade sends an AI sub-processor list on request by email; the privacy policy names OpenAI, Anthropic, Google, AWS and open-weight model makers as examples, not a complete list.","status":"verified","url":"https://www.taskade.com/privacy","locator":"Privacy Policy, AI Service Providers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We keep a current list of the AI providers your account can be routed to, and we will send it to you on request."},{"key":"dpf_status","value":"No listing found for search term 'Taskade'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Taskade' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Workspace content is kept until you delete it or close the account; Taskade aims to remove account data within 30 days of deletion; AI interaction logs are kept normally no more than 30 days. Targets, not contractual periods.","status":"verified","url":"https://www.taskade.com/privacy","locator":"Privacy Policy, Data Retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Workspace content: projects, documents, and messages are kept until you delete them or close your account."},{"key":"certifications","value":"None held. SOC 2 Type II and ISO 27001 are listed as in progress with no report; Google CASA assessment completed for Google API scopes (not a general certification).","status":"verified","url":"https://www.taskade.com/security","locator":"Security page, Compliance & Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have no SOC 2 report to hand you yet, and we are not on a fixed external audit cadence."},{"key":"admin_ai_controls","value":"Not stated. Business includes admin controls and an admin dashboard for permissions and usage, but no switch to turn AI features off is described.","status":"not_published","url":"https://www.taskade.com/pricing","locator":"Pricing page, Admin controls and Admin dashboard; terms and security pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $25/mo for Business with unlimited users included (annual saving figure is garbled on the page)","status":"not_published","url":"https://www.taskade.com/pricing","locator":"Pricing page, Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Unlimited users included Invite unlimited members to design tools, train agents, and automate workflows."}]}]},{"slug":"teamtailor","name":"Teamtailor","vendor":"Teamtailor AB","category":"documents-hr-and-finance","plans":[{"id":"T614","plan":"subscription by quote","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. Teamtailor says it will not use or share customer data processed in an AI system for its own or third-party purposes such as training; beta tests and feedback you submit are the only exceptions, and even then no model is trained. OpenAI (Co-pilot provider) is also committed not to train on it.","status":"verified","url":"https://support.teamtailor.com/en/articles/10450488-teamtailor-responsible-ai-principles","locator":"4. No Use For Own Purposes","url2":"https://support.teamtailor.com/en/articles/8611616-co-pilot-privacy-and-security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teamtailor will not use or share customer data processed in an AI System for our or third-party purposes, such as training or development."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not use customer data processed by AI for training. Co-pilot is an opt-in add-on that only a Company Admin can switch on.","status":"verified","url":"https://support.teamtailor.com/en/articles/10450488-teamtailor-responsible-ai-principles","locator":"4. No Use For Own Purposes","url2":"https://support.teamtailor.com/en/articles/8611616-co-pilot-privacy-and-security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teamtailor will not use or share customer data processed in an AI System for our or third-party purposes, such as training or development."},{"key":"eu_residency_option","value":"Yes. Choose the Europe (Ireland) region: data is mainly stored with AWS Ireland and processed mainly inside the EU/EEA. Some optional sub-processors process elsewhere (for example Twilio SMS in the USA).","status":"verified","url":"https://support.teamtailor.com/en/articles/8031426-different-regions-for-data-processing","locator":"Europe (Ireland)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the personal data will mainly be stored with AWS Ireland and processed mainly inside the EU/EEA."},{"key":"default_data_location","value":"Customer chooses the region in Settings > Company > General > Data processing: Europe (Ireland, AWS), North America (Oregon, AWS) or Asia-Pacific (Australia, AWS). No default is stated.","status":"verified","url":"https://support.teamtailor.com/en/articles/8031426-different-regions-for-data-processing","locator":"Different regions for data processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"It's always up to you, as our customer, to choose in which region you want to have the personal data processed and stored."},{"key":"dpa","value":"Yes. The DPA is part of the customer agreement, applies automatically and prevails on personal-data questions; Teamtailor is processor.","status":"verified","url":"https://www.teamtailor.com/en/terms-and-conditions/","locator":"Data Processing Agreement: About and summary","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA is part of and subject to the terms of the Agreement."},{"key":"subprocessor_list","value":"Yes, a public list per region; EU region at https://support.teamtailor.com/en/articles/4723968: 17 rows (16 companies; AWS appears twice). AI-related: OpenAI Ireland Ltd (Co-pilot), AssemblyAI (meeting transcription), Hyperdoc/Recall (recording). NA and APAC lists are separate.","status":"verified","url":"https://support.teamtailor.com/en/articles/4723968-list-of-subprocessors-for-customers-using-teamtailor-s-europe-eu-region","locator":"List of subprocessors for customers using Teamtailor’s Europe (EU) Region","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Below is a list of the sub-processors engaged by the Teamtailor group for processing personal data on behalf of Teamtailor’s customers using our EU Region."},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Teamtailor AB, Stockholm)","status":"verified","url":"https://www.teamtailor.com/en/privacy-policy/","locator":"1. Who is Teamtailor","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we are referring to Teamtailor AB, Östgötagatan 16, 11621 Stockholm, Sweden"},{"key":"data_retention","value":"The customer sets retention: automatic deletion rules (Settings > Data & Privacy), for example inactive for 90 days, then removed after a one-week grace period. Deleted data stays in backups about 10 days. After contract end, all data is deleted within 60 days.","status":"verified","url":"https://www.teamtailor.com/en/terms-and-conditions/","locator":"Appendix: data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Customer Personal Data is deleted in the application, it is immediately deleted from your account and only maintained in our backups. Our backups are generally retained for ten (10) days."},{"key":"certifications","value":"3 named: ISO 27001, ISO 27701, SOC 2 Type 2 (audited annually).","status":"verified","url":"https://support.teamtailor.com/en/articles/2840927-security-overview","locator":"Security overview","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teamtailor is ISO 27001 and 27701 certified, and we are also audited to the SOC 2 Type 2 standard annually."},{"key":"admin_ai_controls","value":"Yes. Co-pilot is an opt-in add-on that only Company Admins can activate; admins choose which tasks it supports and can disable it at any time.","status":"verified","url":"https://support.teamtailor.com/en/articles/8611616-co-pilot-privacy-and-security","locator":"Intro and Optional feature","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"only Company Admins can activate it. This is in order to facilitate an active decision-making process when beginning to use the feature, and to ensure that you can disable it at any time."},{"key":"price_eur","value":"Not published: Teamtailor prices by quote only and lists no amounts. Unlimited users and job postings are included, and Teamtailor AI is listed as included with unlimited usage.","status":"not_published","url":"https://www.teamtailor.com/en/pricing/","locator":"Get a quote; Everything is included","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Tell us a little about your company and we'll get back to you with a price."}]}]},{"slug":"teamwork-com","name":"Teamwork.com","vendor":"Teamwork Crew Limited (t/a Teamwork.com)","category":"workspace-and-projects","plans":[{"id":"T461","plan":"Basics","tier":"business","price":{"label":"$9.99 / user / mo","amount":9.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Teamwork.com does not train its own AI models on customer data, and its third-party AI providers may not train general-purpose models on it.","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-ai-policy/","locator":"AI policy, AI processing section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teamwork.com does not use Customer Data to train its own AI models."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train on customer data.","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-ai-policy/","locator":"AI policy, AI processing section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Teamwork.com does not use Customer Data to train its own AI models."},{"key":"eu_residency_option","value":"Yes. US or EU data hosting is included in every plan, including Basics. AI processing is not yet region-bound: regional controls for AI are still planned.","status":"verified","url":"https://www.teamwork.com/pricing/","locator":"Pricing, Basics plan features and 'Included in every plan'","url2":"https://www.teamwork.com/legal/teamwork-com-ai-policy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"US & EU data hosting"},{"key":"default_data_location","value":"Amazon Web Services servers in the US and the EU. The pages do not say which region is the default or how it is chosen. AI features can be processed outside the chosen region.","status":"verified","url":"https://www.teamwork.com/security/","locator":"Security page FAQ: Where are your servers located","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our servers are with Amazon Web Services AWS and are hosted within the US and the EU."},{"key":"dpa","value":"Yes. A Data Processing Agreement is incorporated into all customer agreements; it is published online and needs no separate signature.","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-data-processing-agreement/","locator":"DPA, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Agreement (\"DPA\") is incorporated into all agreements and contracts pursuant to which Teamwork Crew Limited"},{"key":"subprocessor_list","value":"Yes: DPA Schedule 2 lists 10 service sub-processors (AWS, Mailgun, SendGrid, Datadog, DigitalOcean, Zapier, Clicktel, Sentry, LaunchDarkly, Pendo), plus a separate AI list: 5 rows (AWS, OpenAI, Anthropic, Google/Gemini, 'other approved providers').","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-ai-sub-processors/","locator":"AI Sub-processors table","url2":"https://www.teamwork.com/legal/teamwork-com-data-processing-agreement/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Large language model services Generation of A.I. responses based on user input"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Teamwork Crew Limited, Cork, Ireland)","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-data-processing-agreement/","locator":"Entity line","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"a company incorporated under the laws of Ireland, with registered number 313652"},{"key":"data_retention","value":"Data is kept for the term of the agreement and deleted as soon as reasonably practicable after termination (customer can request the latest backup within 10 days). AI inputs not saved by the user are not retained beyond the request, apart from security logs.","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-data-processing-agreement/","locator":"DPA, Termination or expiry (9.1)","url2":"https://www.teamwork.com/legal/teamwork-com-ai-policy/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"delete (or otherwise dispose of) the Personal Data of the Customer as soon as reasonably practicable unless Teamwork.com receives, no later than ten (10) days after the effective date"},{"key":"certifications","value":"2 named: ISO/IEC 27001:2022 and SOC 2 Type 2.","status":"verified","url":"https://www.teamwork.com/security/","locator":"Security page, Our security certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ISO/IEC 27001:2022SOC 2 Type 2 certified"},{"key":"admin_ai_controls","value":"Partly. The AI policy says AI features only run through deliberate user actions, and a customer may switch off Desk AI features at any time; no organisation-wide switch for other AI features is described.","status":"verified","url":"https://www.teamwork.com/legal/teamwork-com-ai-policy/","locator":"AI policy, AI Functionality: Transparency","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Customer may disable the applicable Desk AI functionality at any time through the available product controls."},{"key":"price_eur","value":"Shown in USD only: $9.99 per user/month, billed yearly (Basics plan).","status":"not_published","url":"https://www.teamwork.com/pricing/","locator":"Pricing, Basics plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"For small teams needing to deliver projects and track time more reliably"}]}]},{"slug":"recruitee","name":"Tellent Recruitee","vendor":"Recruitee B.V. (Tellent)","category":"documents-hr-and-finance","plans":[{"id":"T615","plan":"Advance","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Tellent says it does not use customer data to train AI models or for other purposes beyond providing the Services, unless the Terms say otherwise. The DPA lets it use anonymised personal data to improve the Services.","status":"verified","url":"https://recruitee.com/ai-statement","locator":"5.1 Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train AI models or for any secondary purposes beyond providing the Services, unless explicitly stated in our Tellent Terms & Conditions."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train AI models on customer data. Certain AI features are on by default; the customer adjusts or disables them in the company account.","status":"verified","url":"https://recruitee.com/ai-statement","locator":"5.1 Data Protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not use your data to train AI models or for any secondary purposes beyond providing the Services, unless explicitly stated in our Tellent Terms & Conditions."},{"key":"eu_residency_option","value":"Yes, by default; no setting needed. Recruitee says all data stays within the EU, but the sub-processor list includes Intercom (support tool) in the USA.","status":"verified","url":"https://recruitee.com/security-gdpr","locator":"Data export restrictions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All of your data will stay within the European Union."},{"key":"default_data_location","value":"Germany. Main infrastructure is on Google Cloud in Frankfurt and Berlin; AWS (also Mailgun email) in Frankfurt. Customer support tool Intercom is hosted in the US (N. Virginia).","status":"verified","url":"https://recruitee.com/terms","locator":"DPA Appendix 3, 1.1 Core Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data processing location: Frankfurt and Berlin, Germany (google: europe-west3, europe-west10)"},{"key":"dpa","value":"Yes. The DPA is an addendum to the Terms and applies automatically (no signature) unless a separate DPA was signed. Tellent is the processor.","status":"verified","url":"https://recruitee.com/terms","locator":"16.2 Data Processing Addendum","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Processing Addendum ('DPA') available on Tellent's website (https://tellent.com/terms) applies as an addendum to these Terms."},{"key":"subprocessor_list","value":"Yes, public in the DPA Appendix 3 of the terms (also trust.tellent.com): 16 entries for Tellent Recruitee (6 core, 10 optional; the 'Tellent' entry is the group's affiliates). AI-related: Google Cloud, Microsoft Azure, Textkernel, Affinda. The trust centre counts 17 across products.","status":"verified","url":"https://recruitee.com/terms","locator":"DPA Appendix 3: Sub-processors, 1. Tellent Recruitee SaaS","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subscriber agrees that Tellent engages the following parties as Sub-processors as described below for the Tellent Recruitee SaaS"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Recruitee B.V., Amsterdam)","status":"verified","url":"https://recruitee.com/terms","locator":"18.1 Tellent Contracting Party by Location","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Tellent entity entering into this Agreement as contracting party is: Recruitee B.V., a private company with limited liability incorporated under the laws of the Netherlands"},{"key":"data_retention","value":"Customer sets a retention period to delete expired profiles automatically. After the contract ends, the customer can export content for 30 days and Tellent may delete it 30 days after termination; the DPA requires return or deletion at the customer's choice.","status":"verified","url":"https://recruitee.com/terms","locator":"12.2 Data Export and Deletion of Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tellent may delete all Subscriber Content held by Tellent as part of terminated Services 30 (thirty) calendar days after termination."},{"key":"certifications","value":"2 named: ISO 27001:2022 and SOC 2 Type II (annual).","status":"verified","url":"https://trust.tellent.com/","locator":"Controls: Compliance and auditing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The information security management system is certified to ISO 27001:2022"},{"key":"admin_ai_controls","value":"Yes. Certain AI features are on by default; the customer can adjust or disable these settings at any time in the company account.","status":"verified","url":"https://recruitee.com/terms","locator":"Product-specific terms, 5.1 Tellent Intelligence General","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Certain Tellent Intelligence features may be enabled by default; you may adjust or disable these settings at any time via your company account."},{"key":"price_eur","value":"Not published: the pricing page shows plans Start, Advance and Optimize with no amounts; prices depend on plan, employee count and billing period, and are given in a demo. Annual payment gives 20% off; minimum one-year contract.","status":"not_published","url":"https://recruitee.com/pricing","locator":"FAQ: How does Tellent Recruitee’s pricing work?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our subscriptions are tiered based on the plan you choose, the number of employees at your organization, and your billing period."}]}]},{"slug":"tidio","name":"Tidio with Lyro AI Agent","vendor":"Tidio LLC (California); Tidio Poland Sp. z o.o. (Szczecin) joint controller","category":"phone-and-voice","plans":[{"id":"T432","plan":"Growth","tier":"business","price":{"label":"$49.17 / mo","amount":49.17,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in aggregated, anonymised form, unless you opt out through Tidio support. Input and Output are not used to train models exposed to other customers except in irreversibly aggregated form; its AI providers are barred from training.","status":"verified","url":"https://www.tidio.com/terms/","locator":"Section 20 AI Terms, Licence to Input","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Input and Output are not used to train foundation models exposed to other customers, except in irreversibly aggregated form. Customers may opt-out of improvement training via support."},{"key":"training_opt_out","value":"Contact Tidio support to opt out of improvement training.","status":"verified","url":"https://www.tidio.com/terms/","locator":"Section 20 AI Terms, Licence to Input","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers may opt-out of improvement training via support."},{"key":"eu_residency_option","value":"No EU-only setting or plan is described. Data is mainly processed in the EEA on servers there, but the US entity Tidio LLC may transfer some data to the US.","status":"verified","url":"https://www.tidio.com/privacy-policy/","locator":"Section on transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We mainly process the data you submit within the EEA and the servers located there."},{"key":"default_data_location","value":"Mainly the EEA (servers located there); the US entity Tidio LLC may transfer some data to the US. Security page names AWS.","status":"verified","url":"https://www.tidio.com/privacy-policy/","locator":"Section on transfers","url2":"https://www.tidio.com/security/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We mainly process the data you submit within the EEA and the servers located there."},{"key":"dpa","value":"Yes. For users in the EU, UK or Switzerland the Terms contain a DPA incorporated by reference (no separate signature).","status":"verified","url":"https://www.tidio.com/terms/","locator":"Preamble of Terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"OUR TERMS CONTAIN AN ADDITIONAL DATA PROCESSING AGREEMENT (“DPA”), WHICH SHALL BE INCORPORATED HEREIN BY REFERENCE"},{"key":"subprocessor_list","value":"Only an AI-provider annex in the terms: 3 entries (OpenAI EU, Anthropic US, Google Cloud EU, each 'Training on Customer Data: No'). Full sub-processor list (trust.tidio.com) not readable by server.","status":"not_captured","url":"https://trust.tidio.com/","locator":"Public list link in the vendor's DPA or trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Tidio LLC; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Tidio'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Chat and AI content retention periods are not stated. When you delete the account in-app, undelivered messages and other information no longer needed are deleted; if you only unsubscribe on a device, data can be kept up to 6 months.","status":"verified","url":"https://www.tidio.com/terms/","locator":"Suspending Your Tidio Account","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"your information may be stored with us for a longer period (but only up to 6 months)"},{"key":"certifications","value":"1 named: SOC 2 report completed (also claims GDPR and CCPA compliance; PCI-DSS is for payments via Stripe). No ISO 27001 named.","status":"verified","url":"https://www.tidio.com/security/","locator":"Other tools that help us keep your data secure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have successfully completed our SOC 2® examination, reinforcing our focus on protecting customer data."},{"key":"admin_ai_controls","value":"Not stated. The pages describe roles and permissions but no admin setting to switch Lyro/AI off organisation-wide.","status":"not_published","url":"https://www.tidio.com/security/","locator":"Looked in security page, terms Section 20, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Growth starts at $49.17 per month (250 billable conversations; Lyro AI conversations are sold separately)","status":"not_published","url":"https://tidio.com/pricing/","locator":"Plan comparison table, Growth","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"tldv","name":"tl;dv","vendor":"tl;dv","category":"meetings-and-notes","plans":[{"id":"T405","plan":"Pro","tier":"personal","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: tl;dv says it does not use customer recordings, transcripts, notes or files to train foundation or other generative AI models, and its AI providers do not train on them either.","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 9 AI Model Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"does not use Customer Content, including meeting recordings, transcripts, notes, files, or other data processed through the Services, to train, fine-tune, or improve foundation models"},{"key":"training_opt_out","value":"Nothing to do: tl;dv states it does not train on customer content.","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 9 AI Model Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is not used by tldx Solutions GmbH or such providers to train or improve their general-purpose AI models."},{"key":"eu_residency_option","value":"Yes: the account preferences let you choose whether AI is hosted in Europe or the US; other hosting is in the EEA. The page does not say which plans have the choice.","status":"verified","url":"https://tldv.io/features/security-commitment/","locator":"Trusted and Secure Generative AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you can now choose where your AI is hosted"},{"key":"default_data_location","value":"European Economic Area: Google Cloud, Wasabi and Hetzner data centres, including Germany and Finland. Part of the AI processing can run in the US depending on the account's AI hosting setting.","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 8 Is your data sent outside the European Union","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All our services are hosted in Europe (within the European Economic Area) with the exception of part of our service involving artificial intelligence, depending on your choice of hosting location."},{"key":"dpa","value":"Not stated; no data processing agreement is mentioned in the privacy policy, terms or security page. The trust centre (trust.tldv.io) needs a browser.","status":"not_published","url":"https://tldv.io/privacy/","locator":"Privacy policy; terms; security commitment","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No separate list (tldv.io/subprocessors returns 404). The privacy policy section 7.2 names 18 providers: Google Cloud, Hetzner, Wasabi, Stripe, Mixpanel, Cloudflare, Sentry, Intercom, CustomerIO, Gmail, Slack, Deel, Hubspot, Paragon, and AI/transcription: Anthropic, Google Vertex, AssemblyAI, ElevenLabs.","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 7.2 Third-parties and subcontractors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Artificial Intelligence provider Anthropic, Google Vertex"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Tldx Solutions GmbH, Aachen, Germany)","status":"verified","url":"https://tldv.io/privacy/","locator":"Section on the data controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Data Controller is Tldx Solutions GmbH, headquartered at Tldx Solutions GmbH, Kaiser-Friedrich-Allee 51, 52074"},{"key":"data_retention","value":"Recordings and transcripts: free users 3 months; paying users until the account is deleted.","status":"verified","url":"https://tldv.io/privacy/","locator":"Retention period table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Free user: 3 months Paying user: until account deletion"},{"key":"certifications","value":"1 audit report named: SOC 2 Type II (report on request). GDPR compliance is claimed. Its hosting providers hold ISO 27001; tl;dv itself names no ISO certificate.","status":"verified","url":"https://tldv.io/features/security-commitment/","locator":"SOC2 Compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"tl;dv is SOC2 compliant. Our SOC 2 (Type II) shows our commitment towards a continuous effective build and improvement of our system and organization controls"},{"key":"admin_ai_controls","value":"Not stated; team admin pages describe privacy defaults, auto-recording and custom AI note templates, but no setting to switch AI features off for the organisation.","status":"not_published","url":"https://intercom.help/tldv/en/articles/15033855-team-custom-ai-notes","locator":"Help centre: team management articles","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page is a JavaScript page and returns no text.","status":"not_captured","url":"https://tldv.io/app/pricing/","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T18","plan":"Business","tier":"business","price":{"label":"€29 / user / mo","amount":29,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Customer content is not used to train foundation or generative models, by tl;dv or its AI providers","status":"verified","url":"https://tldv.io/privacy/","locator":"Privacy policy (published 9 Sep 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: tl;dv does not use recordings, transcripts, notes or files to train or improve generative AI models, and its AI providers may not either","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 9 'AI Model Training'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"EU by default; AI processing in the EU or the US depending on the AI hosting location chosen in account preferences","status":"verified","url":"https://tldv.io/privacy/","locator":"AI processing section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"EU: hosted primarily in the EU (Google Cloud, Wasabi and Hetzner in Germany and Finland)","status":"verified","url":"https://tldv.io/privacy/","locator":"Section 8","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, listed among Trust Center resources (access route not captured)","status":"verified","url":"https://trust.tldv.io","locator":"Resources list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. 16 entries, mostly Europe; Anthropic (AI provider) listed as US, while the Google Cloud entry says Anthropic models run via Vertex AI in the EU; GitLab and Intercom in the US","status":"verified","url":"https://trust.tldv.io/subprocessors","locator":"'1-10 of 16 results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Tldx Solutions GmbH, Aachen)","status":"verified","url":"https://tldv.io/privacy/","locator":"Controller section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"data_retention","value":"Recordings and transcripts of paying users are kept until the account is deleted (free users: 3 months); logs are kept for 10 days; users can delete recordings themselves","status":"verified","url":"https://tldv.io/privacy/","locator":"Table 'Retention period', row 'Video and audio recording, written transcriptions'","url2":"https://intercom.help/tldv/en/articles/5946236-how-can-i-delete-my-recordings","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II (2026 report); GDPR listed. No ISO certification shown","status":"verified","url":"https://trust.tldv.io/","locator":"Trust Center compliance tiles and documents","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly. Team admins set default privacy and sharing rules, auto-recording rules and team AI note templates under Your Team > Admin Controls; no switch that turns AI features off is described","status":"verified","url":"https://intercom.help/tldv/en/articles/15033823-team-auto-recording","locator":"Steps 'Go to Your Team > Admin Controls'","url2":"https://intercom.help/tldv/en/articles/15033798-team-privacy-defaults","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 29 per seat/month billed annually","status":"verified","url":"https://tldv.io/app/pricing/","locator":"Business card","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"todoist","name":"Todoist","vendor":"Todoist Inc. (Doist)","category":"workspace-and-projects","plans":[{"id":"T456","plan":"Business","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, for Todoist's own use: the privacy policy says information collected, including via AI tools, is not used to develop, improve or train generalized or non-personalized AI or machine learning models. Training by its third-party LLM providers is not stated.","status":"verified","url":"https://www.todoist.com/privacy","locator":"Privacy Policy, how we use your Information (improving the Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"However, we do not use information we collect from you, including via artificial intelligence tools, to develop, improve, or train generalized/non-personalized artificial intelligence or machine learning models."},{"key":"training_opt_out","value":"Nothing to do for Todoist's own training: the privacy policy states it does not use collected information to train generalized AI or machine learning models.","status":"verified","url":"https://www.todoist.com/privacy","locator":"Privacy Policy, how we use your Information (improving the Services)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we do not use information we collect from you, including via artificial intelligence tools, to develop, improve, or train generalized/non-personalized artificial intelligence or machine learning models."},{"key":"eu_residency_option","value":"Not stated; no EU data-storage option found. The privacy policy says EEA and UK users transfer their data to the U.S. for storage and processing.","status":"not_published","url":"https://www.todoist.com/privacy","locator":"Privacy Policy, international transfers; Security Policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States, on Amazon Web Services servers.","status":"verified","url":"https://www.todoist.com/security","locator":"Security Policy, Data Protection, At Rest","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We use Amazon Web Services (AWS) servers to host all user data."},{"key":"dpa","value":"Not stated on the pages read. The privacy policy says Todoist acts as a data processor for team workspaces, but no data processing agreement is mentioned in the Terms or Privacy Policy; the trust centre could not be read without a browser.","status":"not_published","url":"https://www.todoist.com/privacy","locator":"Privacy Policy and Terms of Service searched for DPA / data processing / processor","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"A public list exists at https://trustcenter.doist.com/subprocessors (named in the Terms as the list of LLM providers) but could not be read, so entries and AI providers are uncounted.","status":"not_captured","url":"https://www.todoist.com/terms","locator":"Terms of Service, 5.6 AI Features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Doist'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Doist' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Information is kept as long as needed for the stated purposes. When an account is deleted, data is removed from production systems and usually only an encrypted backup copy remains for 90 days. No retention setting for AI prompts is stated.","status":"verified","url":"https://www.todoist.com/privacy","locator":"Privacy Policy, Erasure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"upon deleting your account, all your Information will be removed from our production systems. Usually, only an encrypted copy of your Information will remain on our backup archives for 90 days"},{"key":"certifications","value":"1 named: SOC 2 Type II (certified as of December 2025). Report is in the trust centre.","status":"verified","url":"https://www.todoist.com/business","locator":"Business page FAQ, Is Todoist SOC2 Compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Yes. Todoist is SOC2 Type II certified as of December 2025."},{"key":"admin_ai_controls","value":"Not stated; no admin switch for turning off AI features for a whole team was found. The security page describes admin and user roles for billing, users and sharing only.","status":"not_published","url":"https://www.todoist.com/security","locator":"Security Policy, Todoist Business Admin Controls; AI help article","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: prices are shown in USD only and the amounts are not in the page text (rendered by script).","status":"not_captured","url":"https://www.todoist.com/pricing","locator":"Pricing, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"tray-ai","name":"Tray.ai","vendor":"Tray.ai, Inc.","category":"automation","plans":[{"id":"T487","plan":"Pro","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. The master subscription agreement says Tray will not use Customer Data to train large language models or AI systems.","status":"verified","url":"https://tray.ai/legal/msa/","locator":"Merlin AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tray will not use Customer Data to (i) train any large language models or artificial intelligence systems"},{"key":"training_opt_out","value":"Nothing to do: the agreement says Tray does not use Customer Data to train AI systems. OpenAI is used only if the customer opts in.","status":"verified","url":"https://tray.ai/legal/msa/","locator":"Merlin AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tray will not use Customer Data to (i) train any large language models or artificial intelligence systems"},{"key":"eu_residency_option","value":"Available but not shown as included in Pro: the pricing page lists 'Regional hosting' on the Enterprise card and among the paid add-ons. The trust page says customers choose US, EU or APAC hosting.","status":"verified","url":"https://tray.ai/pricing","locator":"Enterprise plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Advanced on-premise SSO, HIPAA, Regional hosting"},{"key":"default_data_location","value":"United States on Amazon Web Services by default; EU (AWS Ireland) or APAC (Australia) only when that region is selected.","status":"verified","url":"https://tray.ai/legal/sub-processors/","locator":"Core Sub-processors / EU and APAC Core Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where an EU or APAC region has been selected, only the following will be used."},{"key":"dpa","value":"Yes. A standard DPA with EU Standard Contractual Clauses is incorporated by reference into the customer agreement.","status":"verified","url":"https://tray.ai/legal/dpa/","locator":"Introduction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA shall be incorporated by reference into the agreement between Customer and Tray"},{"key":"subprocessor_list","value":"Public list at https://tray.ai/legal/sub-processors/ (updated 12 July 2024): 16 rows, 10 companies. AI provider: OpenAI, optional and opt-in only.","status":"verified","url":"https://tray.ai/legal/sub-processors/","locator":"Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In the course of running the Tray platform we will use a range of third party sub-processors to process customer’s personal data in their workflows."},{"key":"dpf_status","value":"Active (Tray.ai; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Tray.ai'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Pro plan keeps logs for 7 days. On termination Tray deletes or returns personal data per the agreement (no day count given).","status":"verified","url":"https://tray.ai/pricing","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"7-day insights 7-day log retention 700+ connectors"},{"key":"certifications","value":"Two audited attestations named: SOC 1 Type 2 and SOC 2 Type 2 (examined by Schellman, 1 Aug 2024 to 31 Jul 2025); annual penetration tests. HIPAA, GDPR and CCPA are listed as privacy compliance; no ISO named.","status":"verified","url":"https://tray.ai/trust/","locator":"Security in every layer / Attestations","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We complete SOC 1 and SOC 2 Type 2 audits, conduct annual penetration tests"},{"key":"admin_ai_controls","value":"Yes. An administrative user can disable Merlin AI in the customer's account settings.","status":"verified","url":"https://tray.ai/legal/msa/","locator":"Merlin AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer’s administrative user may disable Merlin AI in Customer’s account settings."},{"key":"price_eur","value":"Not published: pricing is usage-based and quoted by sales.","status":"not_published","url":"https://tray.ai/pricing","locator":"Frequently asked questions, How does pricing work?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Contact our sales team for a customized quote based on your specific requirements and expected usage."}]}]},{"slug":"trello","name":"Trello","vendor":"Atlassian (Trello)","category":"workspace-and-projects","plans":[{"id":"T102","plan":"Premium","tier":"business","price":{"label":"$10 / user / mo","amount":10,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Not at present: Atlassian's data contribution (which de-identifies and uses in-app data to improve its apps) currently covers Confluence, Jira, Jira Service Management and platform apps; apps without contribution settings, such as Loom or Bitbucket, contribute nothing, and Trello is not listed","status":"verified","url":"https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings-availability/","locator":"Section 'Data contribution settings availability'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off today; workspace admins can still turn Trello's AI features off (Workspace settings > AI)","status":"verified","url":"https://support.atlassian.com/organization-administration/docs/atlassian-intelligence-features-in-trello/","locator":"Section on activation ('Workspace admins can turn AI on or off')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"None documented: Atlassian's data residency documentation does not mention Trello","status":"not_published","url":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","locator":"Data residency article (full text, no Trello mention)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated for Trello; Atlassian's sub-processors for Trello host in the US and other regions","status":"not_published","url":"https://www.atlassian.com/legal/sub-processors","locator":"Rows listing Trello, 'Location' fields","url2":"https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Atlassian's DPA applies automatically under the Atlassian Customer Agreement, which covers Trello","status":"verified","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"DPA (effective 17 Aug 2026; checked 16 Oct for Confluence)","url2":"https://www.atlassian.com/legal/sub-processors","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public (Atlassian's list): 11 of 29 entries (10 companies) apply to Trello, including AWS with Bedrock, Google Vertex AI and OpenAI","status":"verified","url":"https://www.atlassian.com/legal/sub-processors","locator":"Entries with 'Trello' under 'Applicable Cloud Products'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Atlassian' (checked 16 Oct 2026)","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No retention period stated for Trello content; Atlassian's DPA governs deletion after termination","status":"not_published","url":"https://www.atlassian.com/legal/data-processing-addendum","locator":"Deletion clause","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Trello is listed among the products covered by Atlassian's ISO/IEC 27001:2022 certification and SOC 2 reports","status":"verified","url":"https://www.atlassian.com/trust/compliance/resources/iso27001","locator":"Section 'Relevant products'","url2":"https://www.atlassian.com/trust/compliance/resources/soc2","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. AI is on by default for Standard and Premium workspaces; workspace admins can turn it on or off at any time under Workspace settings > AI","status":"verified","url":"https://support.atlassian.com/organization-administration/docs/atlassian-intelligence-features-in-trello/","locator":"Activation paragraph","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: USD 10 per user/month billed annually, USD 12.50 monthly","status":"not_published","url":"https://trello.com/pricing","locator":"Plan card 'Premium'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"tresorit","name":"Tresorit SecureCloud for Businesses","vendor":"Tresorit AG","category":"research-forms-and-storage","plans":[{"id":"T643","plan":"Business","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the terms, privacy policy or security page. Files are end-to-end encrypted, and Tresorit says it cannot read them.","status":"not_published","url":"https://tresorit.com/terms-of-use","locator":"Pages checked: terms-of-use, legal/privacy-policy, security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://tresorit.com/terms-of-use","locator":"Pages checked: terms-of-use, legal/privacy-policy, security","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes. The Business plan includes data residency options; admins assign users to a data centre such as France, Germany, Ireland or the Netherlands (also Switzerland, UK, US and others).","status":"verified","url":"https://tresorit.com/features/data-residency-options","locator":"Frequently asked questions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Data Residency Options are available for Business and Enterprise customers."},{"key":"default_data_location","value":"Ireland, unless the customer uses the data-residency option.","status":"verified","url":"https://tresorit.com/features/data-residency-options","locator":"Frequently asked questions","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers without Data Residency Options are automatically assigned to Ireland."},{"key":"dpa","value":"Yes. Business Subscriptions subject to EU data protection law agree to the Data Processing Addendum, which is available inside the Tresorit app.","status":"verified","url":"https://tresorit.com/terms-of-use","locator":"Data Processing Agreement","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If Customer has a Business Subscription and is subject to EU Data Protection Laws, Customer agrees to the Data Processing Addendum (available through the Tresorit application)."},{"key":"subprocessor_list","value":"A list is referenced in the privacy policy (help-centre page 'Third-party services'), but that page blocks non-browser fetches; count and AI providers not captured.","status":"not_captured","url":"https://tresorit.com/legal/privacy-policy","locator":"Who will process your personal data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (Swiss-based vendor, Tresorit AG, Zurich)","status":"verified","url":"https://tresorit.com/legal/privacy-policy","locator":"Who will process your personal data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tresorit services are provided by Tresorit AG (company registration no: CHE-349.825.210; address: Pfingstweidstrasse 60b., 8005 Zurich, Switzerland)"},{"key":"data_retention","value":"Deleted folders and their encrypted content are removed automatically within 90 days (Tresorit may keep data up to 60 days after deletion). Personal data held for a company follows the data processing agreement.","status":"verified","url":"https://tresorit.com/legal/privacy-policy","locator":"How long will we retain your information?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Once you delete a Tresorit Folder for any reason, Your Encrypted Content will also be automatically deleted within 90 days."},{"key":"certifications","value":"ISO 27001:2022, certified by TÜV Rheinland (1 certification named). The compliance page also lists TISAX and CJIS as frameworks without saying whether they are certified.","status":"verified","url":"https://tresorit.com/security","locator":"Compliance: ISO 27001","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Tresorit has certification for compliance with ISO 27001:2022."},{"key":"admin_ai_controls","value":"Not stated; no AI feature or AI admin setting appears on the Business plan page, terms or security page.","status":"not_published","url":"https://tresorit.com/pricing/business","locator":"Pages checked: pricing/business, security, terms-of-use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the Business plan card (per user/month, at least 3 users) shows no amount without a browser.","status":"not_captured","url":"https://tresorit.com/pricing/business","locator":"SecureCloud plan cards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"trint","name":"Trint","vendor":"Trint Limited (London, United Kingdom)","category":"meetings-and-notes","plans":[{"id":"T402","plan":"Advanced","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: Trint states it does not use customer data to train or improve its AI models.","status":"verified","url":"https://trint.com/docs/terms-conditions","locator":"Section 12.1 Artificial intelligence","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Trint does not use customer data to train or improve its AI models."},{"key":"training_opt_out","value":"Nothing to do: Trint states it does not train models on customer data.","status":"verified","url":"https://info.trint.com/knowledge/artificial-intelligence","locator":"Will be used for the AI models?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We do not train models on customer data, as we rely on publicly available datasets."},{"key":"eu_residency_option","value":"Yes: Trint lets you store data in the EU or the US (separate EU tenant on AWS). The page does not say how to pick it or whether it depends on the plan.","status":"verified","url":"https://trint.com/security","locator":"Control information flows","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Trint lets you store your data either in the EU or US to stay compliant with clear data retention and destruction policies."},{"key":"default_data_location","value":"No default stated: Trint runs separate EU and US tenants on AWS and says you can store data in the EU or the US.","status":"not_published","url":"https://trint.com/security","locator":"Control information flows","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes, built into the Terms of Service: clause 8 (Data Protection) and Annex A make Trint a processor for customer content, with sub-processor and transfer terms. No separate signing step is described.","status":"verified","url":"https://trint.com/docs/terms-conditions","locator":"Clause 8.3 Data protection","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Trint shall process the Customer Personal Data set out in Annex A, as a processor on behalf of the Customer in respect of the processing activities set out in Annex A."},{"key":"subprocessor_list","value":"Yes, public in the privacy policy (https://trint.com/docs/platform-privacy-policy): 24 rows (20 companies): 16 global, 5 US-tenant, 3 EU-tenant. Only AI provider named: Anthropic (internal use, basic account data).","status":"verified","url":"https://trint.com/docs/platform-privacy-policy","locator":"Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Global sub-processors used across both tenants (US and EU)"},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Trint Limited, London)","status":"verified","url":"https://trint.com/docs/platform-privacy-policy","locator":"Identity and contact information of the Data Controller","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Trint Limited is a company incorporated and registered in England and Wales (company number 09225083) with its registered office at C/O Mishcon de Reya, Africa House, 70 Kingsway, London"},{"key":"data_retention","value":"Data and media are kept for the lifetime of the subscription; secure deletion can be arranged at contract end or once a month on request. After termination Trint has no duty to keep content beyond 30 days.","status":"verified","url":"https://trint.com/security","locator":"Data retention & destruction","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"By default, we store any data or media uploaded to Trint for the lifetime of the subscription. However, secure deletion can be arranged at contract termination or once per month upon request."},{"key":"certifications","value":"2 named: ISO 27001 (ISO 27001:2022 per the support hub) and Cyber Essentials. No SOC 2 is named for Trint itself.","status":"verified","url":"https://trint.com/security","locator":"You're in safe hands","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are ISO 27001 and Cyber Essentials certified, while all data within Trint is encrypted in transit and at rest."},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch AI features off was found in the Terms, AI, security or access-management help pages. SSO is an Enterprise-plan feature.","status":"not_published","url":"https://info.trint.com/knowledge/artificial-intelligence","locator":"Support Hub: Artificial Intelligence, Access Management; Terms 12","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page (https://app.trint.com/plans) is a JavaScript app and returns no text.","status":"not_captured","url":"https://app.trint.com/plans","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"typeform","name":"Typeform","vendor":"Typeform (TYPEFORM SL)","category":"sales-marketing-and-support","plans":[{"id":"T105","plan":"Business","tier":"business","price":{"label":"€84 / mo","amount":84,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Typeform says none of its customers' data is used to train any model, whichever model powers the feature","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/33777155298708-AI-with-Typeform-FAQ","locator":"Question 'Is the data used to train models?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: no customer data is used to train any model","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/33777155298708-AI-with-Typeform-FAQ","locator":"Question 'Is the data used to train models?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not on Business: EU data hosting is for new customers on Enterprise or Growth Custom","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data","locator":"Question 'Where do you store my data and how is it protected?'","url2":"https://help.typeform.com/hc/en-us/articles/360060587391-Enterprise-plan","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"United States: data is hosted on AWS with the main servers in Virginia","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data","locator":"Question 'Where do you store my data and how is it protected?'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes, without signing: Typeform's DPA (updated 20 Jul 2026) and Section 4 of its privacy policy apply to all customers; a custom signed DPA is only for Enterprise or Growth Custom","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360060666952-Do-I-have-to-sign-a-Data-Processing-Agreement-DPA","locator":"Whole article","url2":"https://www.typeform.com/legal/data-processing-agreement","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"subprocessor_list","value":"Public. Response data goes only to AWS (US, or EU for EU-hosted customers) unless optional features are used; 15 more for optional features such as AI (OpenAI, AWS, Google Cloud), integrations and enrichment; 27 distinct entries across all lists","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360029617191-What-other-companies-do-we-share-data-with-","locator":"Tables 'Sub-processors that process response data', '…optional services' and '…process customer data'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Not applicable to the contracting company (EU-based vendor, TYPEFORM SL, Barcelona); no listing found for search term 'Typeform'","status":"verified","url":"https://www.typeform.com/legal/service-terms-and-conditions","locator":"Opening paragraph naming TYPEFORM SL","url2":"https://www.dataprivacyframework.gov/list","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as needed for the purposes collected; deleting the account deletes its personal data and the customer chooses deletion or return; backups kept 15 days","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360029259552-Security-at-Typeform","locator":"Section 'Data retention'","url2":"https://www.typeform.com/legal/data-processing-agreement","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II; ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 42001; audited against HIPAA","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/360029259552-Security-at-Typeform","locator":"Certifications section","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Partly: admins can turn off AI-Powered Insights in Admin settings; no account-wide switch for Typeform's other AI features was found","status":"verified","url":"https://help.typeform.com/hc/en-us/articles/33777155298708-AI-with-Typeform-FAQ","locator":"Paragraph on Smart Insights ('turn AI-Powered Insights off in your Admin settings')","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"price_eur","value":"EUR 84 per month billed yearly for the plan (5 users, 10,000 responses a month); VAT basis not stated","status":"verified","url":"https://www.typeform.com/pricing","locator":"Plan card 'Business' with 'Yearly' selected","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"typingmind-teams","name":"TypingMind Teams","vendor":"Typing Technology Co. Ltd. (TypingMind)","category":"assistants","plans":[{"id":"T321","plan":"Professional","tier":"business","price":{"label":"$249 / mo","amount":249,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. TypingMind says conversations on its system are never used for training. Prompts sent to the AI provider you connect (OpenAI, Anthropic, Google) follow that provider's own policy.","status":"verified","url":"https://docs.typingmind.com/security-and-compliance/data-usage-and-model-training-policy.md","locator":"Data Usage and Model Training Policy, top","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All of your conversations on the TypingMind system are strictly confidential and never used for training purposes."},{"key":"training_opt_out","value":"Nothing to do: TypingMind states conversations on its system are never used for training. Check the terms of the AI provider whose key you connect.","status":"verified","url":"https://docs.typingmind.com/security-and-compliance/data-usage-and-model-training-policy.md","locator":"Data Usage and Model Training Policy, top","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All of your conversations on the TypingMind system are strictly confidential and never used for training purposes."},{"key":"eu_residency_option","value":"Yes. When creating a cloud instance you select Europe under Data Center: web server on Vercel and database on AWS, both in the EU. Calls to AI providers may still leave the EU.","status":"verified","url":"https://docs.typingmind.com/typingmind-team/account-management/eu-data-center.md","locator":"EU Data Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you can opt-in to have all of your data hosted in EU data center"},{"key":"default_data_location","value":"Not stated as a default. The DPA lists AWS in the USA (us-west-1) and Germany (eu-central-1) and Vercel in the USA and Europe; EU-only hosting is something you opt into when creating the instance.","status":"not_published","url":"https://docs.typingmind.com/security-and-compliance/data-processing-agreement.md","locator":"Appendix II sub-processor table; EU Data Center doc","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. A DPA based on EU standard clauses is published and is signed between the customer and Typing Technology Co. Ltd.; it prevails over other agreements.","status":"verified","url":"https://docs.typingmind.com/security-and-compliance/data-processing-agreement.md","locator":"Opening paragraph and Clause 4","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is entered into between Typing Technology Co. Ltd. and the undersigned Customer identified in the applicable Appendix I"},{"key":"subprocessor_list","value":"Yes, in the DPA appendix (https://docs.typingmind.com/security-and-compliance/data-processing-agreement.md): 11 entries (AWS, Render, Vercel, Customer.io, Sentry, Axiom, Stripe, Lemon Squeezy, Paddle, Help Scout, Mailgun). No AI model provider is listed; customers bring their own.","status":"verified","url":"https://docs.typingmind.com/security-and-compliance/data-processing-agreement.md","locator":"Appendix II list of sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"| Amazon AWS | Cloud Hosting & Databases | USA (us-west-1), Germany (eu-central-1) |"},{"key":"dpf_status","value":"No listing found for search term 'Typing Technology', 'TypingMind'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Typing Technology', 'TypingMind' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period published. Data is kept only as long as needed for its purpose and deleted or anonymised afterwards or on request; on termination the customer chooses deletion or return of all data (DPA). Professional adds chat logs and export.","status":"verified","url":"https://docs.typingmind.com/security-and-compliance/privacy-policy.md","locator":"Section 6 How We Store and Protect Your Data","url2":"https://docs.typingmind.com/security-and-compliance/data-processing-agreement.md","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We store your data only for the period of time needed to realize the purpose for which it was collected."},{"key":"certifications","value":"SOC 2 shown as Compliant (report type not stated) and GDPR as Compliant on the trust center: 1 security certification named.","status":"verified","url":"https://trust.typingmind.com/","locator":"Compliances","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"### SOC 2 Compliant ### GDPR Compliant"},{"key":"admin_ai_controls","value":"Partly. On Professional, admins set roles and permissions and per-user limits on which models users can use or see. No setting to switch AI off is documented (the product is a chat front end for models you connect).","status":"verified","url":"https://docs.typingmind.com/typingmind-team/getting-started/compare-typingmind-team-plans.md","locator":"Full Feature Comparison, User Management","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Per-user model usage & visibility limits | ❌ | ❌ | ✅"},{"key":"price_eur","value":"Shown in USD only: Professional $249 per month on the pricing page (struck-through $499; page has Monthly/Annual toggle, annual gives 2 months free), incl. 5 seats; extra seats $8 per seat per month. The docs comparison page lists $299 per month.","status":"not_published","url":"https://custom.typingmind.com/pricing","locator":"Pricing page, Professional box","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"v0","name":"v0","vendor":"Vercel Inc. (v0)","category":"code-and-app-builders","plans":[{"id":"T536","plan":"Business","tier":"business","price":{"label":"$100 / user / mo","amount":100,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No by default. Vercel says v0 users other than Free/Premium users on a Hobby account are opted out of AI training by default, and paid Pro plans have training off unless the team opts in (Team Settings, Data Preferences).","status":"verified","url":"https://vercel.com/changelog/updates-to-terms-of-service-march-2026","locator":"FAQ, As a v0 only user, what does this change mean for me?","url2":"https://v0.app/pricing","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Any other v0 user will be opted out of AI training by default"},{"key":"training_opt_out","value":"Nothing to do by default (Business is opted out). To check or reverse an opt-in: Team Settings (not Account Settings), Data Preferences, toggle from Opt-In to Opt-Out.","status":"verified","url":"https://vercel.com/changelog/updates-to-terms-of-service-march-2026","locator":"FAQ, How can I opt out of data sharing?","url2":"https://v0.app/docs/faqs","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Click Team Settings in the top left of your dashboard (not Account Settings) Click Data Preferences Toggle from Opt-In to Opt-Out"},{"key":"eu_residency_option","value":"Not stated for v0 chats and prompts. Vercel lets customers choose a deployment region for apps they publish, which does not cover v0 prompt data.","status":"not_published","url":"https://vercel.com/docs/security/compliance","locator":"Looked in: v0 FAQ, v0 Security page, Vercel DPA, Vercel compliance docs ('Where does my data live?')","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Vercel says its primary processing facilities are in the US and data can be processed anywhere Vercel or its sub-processors operate. No v0-specific region is named.","status":"verified","url":"https://vercel.com/legal/dpa","locator":"Data Processing Addendum, Processing in the United States","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Vercel's primary processing facilities are in the United States."},{"key":"dpa","value":"Yes. Vercel's Terms of Service incorporate its Data Processing Addendum by reference; the DPA text itself says it forms part of the Enterprise terms or another executed agreement, so a signed copy for Business is not described.","status":"verified","url":"https://vercel.com/legal/terms","locator":"Terms, 10.1 Vercel's Role","url2":"https://vercel.com/legal/dpa","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"in accordance with Vercel's Data Processing Addendum (\"DPA\"), which is incorporated by reference"},{"key":"subprocessor_list","value":"The Vercel DPA says the sub-processor list is at security.vercel.com, which returned 403 to a non-browser fetch, so no entries could be counted.","status":"not_captured","url":"https://security.vercel.com","locator":"Trust Center","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Vercel Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Vercel'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period. Vercel keeps information for the minimum necessary period, then deletes or anonymises it. For v0, users can download their chats and ask support to delete v0 outputs; models already trained are not updated.","status":"verified","url":"https://vercel.com/legal/privacy-policy","locator":"How We Retain Your Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We retain your information for the minimum necessary period to fulfill our legal and contractual obligations"},{"key":"certifications","value":"SOC 2 Type 2 is stated to cover v0 (1 certification confirmed). Vercel's compliance page also lists ISO 27001:2022, PCI DSS, HIPAA and TISAX for the Vercel platform; whether v0 is in their scope is not stated.","status":"verified","url":"https://v0.app/docs/faqs","locator":"FAQ, Is v0 compliant?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"v0 is included in the scope of Vercel's SOC 2 report."},{"key":"admin_ai_controls","value":"Not stated for Business. SAML SSO and role-based access control are listed only under Enterprise, and no setting to switch AI features off for the organisation is described.","status":"not_published","url":"https://v0.app/pricing","locator":"Looked in: Pricing cards, v0 Security page, v0 Teams docs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: Business $100 per user/month, excluding VAT and other taxes.","status":"not_published","url":"https://v0.app/pricing","locator":"Pricing, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"vapi","name":"Vapi","vendor":"Vapi","category":"phone-and-voice","plans":[{"id":"T67","plan":"Core","tier":"business","price":{"label":"$29 / mo","amount":29,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form: Vapi's terms let it use your content to improve its call features (speech recognition, end-of-turn and interruption detection); tailoring beyond that needs your permission. The 2023 privacy policy also allows training","status":"verified","url":"https://vapi.ai/terms-of-service","locator":"Section 4, paragraph starting 'We use Your Content to' (terms of 14 Sep 2026)","url2":"https://vapi.ai/privacy","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Not described: no setting or opt-out for training on call data is documented; zero data retention (ZDR) is included in Core","status":"not_published","url":"https://vapi.ai/pricing","locator":"Core package feature list ('ZDR included')","url2":"https://vapi.ai/privacy","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No EU option documented as a customer setting; customers can route storage to their own buckets","status":"not_published","url":"https://docs.vapi.ai/security-and-privacy/data-flow.md","locator":"Sections on custom storage","url2":"https://security.vapi.ai/item/subprocessors","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated. Vapi's sub-processors are listed as operating in the US and the EU","status":"not_published","url":"https://security.vapi.ai/item/subprocessors","locator":"Subprocessors table, column 'Location'","url2":"https://docs.vapi.ai/security-and-privacy/data-flow.md","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. Vapi's Data Processing Addendum is part of its Terms of Service","status":"verified","url":"https://vapi.ai/terms-of-service","locator":"Opening paragraph ('these Terms of Service, the DPA and Privacy Policy')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 22 entries: 19 listed for the US and EU, 3 US only (Groq, WorkOS, Databricks); models and voices from OpenAI, Anthropic, Google, xAI, Azure, AWS, ElevenLabs, Deepgram, Cartesia and others, used when selected","status":"verified","url":"https://security.vapi.ai/item/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Vapi'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Vapi' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Raw call data is kept for 30 days on Core (14 days on usage-only, 180 on Pro); recording retention is configurable and zero data retention is included; audio streams are not stored","status":"verified","url":"https://vapi.ai/pricing","locator":"Package feature lists ('raw data retention')","url2":"https://docs.vapi.ai/security-and-privacy/data-flow.md","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II, SOC 3 and PCI DSS v4.0.1; HIPAA (with add-on), GDPR and CCPA listed","status":"verified","url":"https://security.vapi.ai/","locator":"Compliance section","url2":"https://docs.vapi.ai/faq.md","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Limited on Core: up to 2 organisations; role-based access control comes with Pro, SSO with Premier. Model and voice providers are chosen per assistant by the builder","status":"verified","url":"https://vapi.ai/pricing","locator":"Package feature lists ('RBAC + ZDR', 'Custom RBAC + ZDR + SSO')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published in EUR: Core package USD 29 per month plus per-minute usage for hosting, models, voices and telephony","status":"not_published","url":"https://vapi.ai/pricing","locator":"Success package 'Core' and usage calculator","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"veed","name":"VEED","vendor":"Veed Limited","category":"design-images-and-video","plans":[{"id":"T555","plan":"Business","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No. VEED's Terms limit its right to train AI on uploaded content to the Free tier and say this does not apply to paid subscriptions such as Business. Enterprise is also excluded.","status":"verified","url":"https://www.veed.io/terms-of-use","locator":"Brief summary of these terms (Free-tier training right)","url2":"https://www.veed.io/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This does not apply if you have a paid-for subscription (e.g., ‘Basic’, ‘Pro’ or ‘Business’)"},{"key":"training_opt_out","value":"Nothing to do on Business: the Terms say the training right applies only to the Free tier. Free users can object, but must then upgrade or delete their account.","status":"verified","url":"https://www.veed.io/terms-of-use","locator":"Free tier users only: using your content to improve our Applications","url2":"https://www.veed.io/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"‘Free’ tier users only - using your content to improve our Applications"},{"key":"eu_residency_option","value":"EU hosting is the default (Google Cloud Platform West 1); no region setting to choose is described. Some sub-processors operate outside the EU.","status":"verified","url":"https://www.veed.io/security","locator":"Security FAQs > Where is the data processed?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"VEED’s servers are located in the EU (we use Google Cloud Platform - West 1)."},{"key":"default_data_location","value":"European Union: VEED's servers are in the EU, on Google Cloud Platform (West 1). Sub-processors elsewhere are listed separately.","status":"verified","url":"https://www.veed.io/security","locator":"Security FAQs > Where is the data processed?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"VEED’s servers are located in the EU (we use Google Cloud Platform - West 1)."},{"key":"dpa","value":"Yes: the Terms of Use include a Personal Data Processing Agreement (with EU standard contractual clauses) for business clients on paid services, so Business is covered without a separate contract.","status":"verified","url":"https://www.veed.io/terms-of-use","locator":"Personal Data Processing Agreement (Background)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"willing to enter into terms of sale for business clients for paid services (Master Agreement) that may require the Provider to process Personal Data on behalf of the Customer."},{"key":"subprocessor_list","value":"Not captured: the sub-processors page points to a list at trust.veed.io/subprocessors, which needs a browser to read.","status":"not_captured","url":"https://www.veed.io/data-subprocessors","locator":"Data sub-processors page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Not applicable (UK-based vendor, Veed Limited, London)","status":"verified","url":"https://www.veed.io/privacy","locator":"Contact details","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Full name of legal entity: Veed Limited"},{"key":"data_retention","value":"On termination of the contract, personal data in the service is deleted or destroyed within 60 days (or returned if the customer asks beforehand). No in-service retention period is given.","status":"verified","url":"https://www.veed.io/terms-of-use","locator":"Personal Data Processing Agreement 10.2","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the Provider will securely delete or destroy within 60 days or, if directed in writing by the Customer before the termination or expiry of the Master Agreement, return and not retain"},{"key":"certifications","value":"Not captured: security certifications are on trust.veed.io, which needs a browser; none are named in the privacy policy or Terms.","status":"not_captured","url":"https://trust.veed.io/","locator":"Trust centre","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch AI features off is described on the pricing, privacy or Terms pages.","status":"not_published","url":"https://www.veed.io/pricing","locator":"Looked in: Pricing page, Privacy Policy, Terms of Use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not captured: the pricing page builds its plan prices in the browser and returned no prices.","status":"not_captured","url":"https://www.veed.io/pricing","locator":"Pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"venice-ai","name":"Venice Pro","vendor":"Venice.ai","category":"assistants","plans":[{"id":"T301","plan":"","tier":"personal","price":{"label":"$18 / mo","amount":18,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Venice.ai agrees not to use user content to train models and to require its third-party LLM providers not to.","status":"verified","url":"https://venice.ai/legal/tos","locator":"10.2 User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Venice.ai agrees that it shall not use, and shall require that third-party large language model providers"},{"key":"training_opt_out","value":"Nothing to do: the terms state Venice.ai does not train on user content and requires its LLM providers not to.","status":"verified","url":"https://venice.ai/legal/tos","locator":"10.2 User Content","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Venice.ai agrees that it shall not use, and shall require that third-party large language model providers"},{"key":"eu_residency_option","value":"Not stated; no EU hosting option found. The terms say the service is intended for visitors in the United States.","status":"not_published","url":"https://venice.ai/legal/tos","locator":"20.9 International Use; privacy policy International Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States. Venice says the service is hosted in the U.S. and EU users' data is processed and stored there; chat history stays on the user's device.","status":"verified","url":"https://venice.ai/legal/privacy-policy","locator":"International Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Service is hosted in the United States (“U.S.”)."},{"key":"dpa","value":"Not stated; no data processing agreement found.","status":"not_published","url":"https://venice.ai/legal/tos","locator":"Privacy policy, terms of service; venice.ai/legal/dpa returns 404","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list found. Model providers are listed on the privacy page and in terms section 10.","status":"not_published","url":"https://venice.ai/legal/privacy-policy","locator":"Privacy policy (Model Providers), terms 9-10; /legal/subprocessors returns 404","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Venice.ai'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Venice.ai' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Venice says it does not store prompt or output content; chat history stays on the user's device. Generated videos are kept until downloaded. Venice says its model providers may not retain prompts beyond processing, though its privacy page says some providers apply their own retention.","status":"verified","url":"https://venice.ai/legal/privacy-policy","locator":"Prompts and Outputs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we will not have access to or store the content of your Prompts or Outputs"},{"key":"certifications","value":"Not stated; no security certifications found.","status":"not_published","url":"https://venice.ai/legal/privacy-policy","locator":"Privacy policy, terms, pricing page, venice.ai/privacy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; plan is a single-user personal subscription with no organisation admin controls described.","status":"not_published","url":"https://venice.ai/legal/tos","locator":"7.1 Limited License; pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $18 per month ($216 billed yearly) for Venice Pro.","status":"not_published","url":"https://venice.ai/pricing","locator":"Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"visme","name":"Visme","vendor":"Easy WebContent, LLC (Visme)","category":"design-images-and-video","plans":[{"id":"T573","plan":"Business","tier":"business","price":{"label":"$24.75 / user / mo","amount":24.75,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated. The terms only say input and output are hosted 'for the purpose of improving our products and services'; no training clause. Inputs go to OpenAI and fal.ai, with no statement about their training.","status":"not_published","url":"https://www.visme.co/terms_conditions/","locator":"7.3 AI-powered products and tools","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"you grant permission to Visme to host your input and output on our platform for the purpose of improving our products and services"},{"key":"training_opt_out","value":"Not stated; no training opt-out or setting described.","status":"not_published","url":"https://www.visme.co/terms_conditions/","locator":"7.3 AI-powered products and tools; privacy policy","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU data-residency option found.","status":"not_published","url":"https://www.visme.co/privacy/","locator":"Privacy policy, terms, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: files are stored on Amazon Web Services in the US.","status":"verified","url":"https://www.visme.co/privacy/","locator":"4. Where do we store your personal information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your personal information and files are stored on our servers on Amazon Web Services in the US."},{"key":"dpa","value":"Not stated; no data processing agreement found in the terms, privacy policy or pricing page.","status":"not_published","url":"https://www.visme.co/privacy/","locator":"Privacy policy, terms, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"No public sub-processor list. The terms name 2 AI providers that receive AI inputs: fal.ai and OpenAI.","status":"not_published","url":"https://www.visme.co/terms_conditions/","locator":"7.3 AI-powered products and tools","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"input data you provide, including any personal data you choose to include within that input, will be shared with third-party service providers, such as fal.ai and OpenAI LLC"},{"key":"dpf_status","value":"No listing found for search term 'Visme', 'Easy WebContent'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Visme', 'Easy WebContent' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept until you request deletion; you can delete your account in Account Settings. No fixed period.","status":"verified","url":"https://www.visme.co/privacy/","locator":"19. Retaining and deleting personal data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Personal data that we process for any purpose or purposes shall be kept until such time as we receive a request for deletion from you."},{"key":"certifications","value":"Not stated; no certification found in the privacy policy, terms or pricing page.","status":"not_published","url":"https://www.visme.co/privacy/","locator":"Privacy policy, terms, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated; no admin switch for AI features described. Business lists 'Privacy Controls' without detail.","status":"not_published","url":"https://www.visme.co/pricing/","locator":"Pricing, Business features","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $24.75 per person/month, billed annually ($297 per year).","status":"not_published","url":"https://www.visme.co/pricing/","locator":"Pricing, Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Business For teams that need branding collaboration and deeper control. US $24.75 /month per person"}]}]},{"slug":"voiceflow","name":"Voiceflow","vendor":"Voiceflow, Inc.","category":"phone-and-voice","plans":[{"id":"T415","plan":"For Businesses, pricing on request","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No, per the security page: customer data is not used to train any machine learning or AI models, and its model providers (OpenAI, Anthropic, Google) do not train on it. The Terms of Service separately license Voiceflow to use customer data to provide and improve the service.","status":"vendor_statement","url":"https://www.voiceflow.com/security","locator":"Security at Voiceflow","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is only used to provide and operate the service."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not use customer data to train AI models.","status":"vendor_statement","url":"https://www.voiceflow.com/security","locator":"Security at Voiceflow","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is only used to provide and operate the service."},{"key":"eu_residency_option","value":"Not stated: no EU data-residency option found; the privacy policy says data is hosted in Canada and other countries unless otherwise agreed.","status":"not_published","url":"https://www.voiceflow.com/security","locator":"Looked at security, privacy policy, DPA, GDPR pages and pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated by country: Voiceflow is based in Canada and may host and process data in Canada and other countries; the security page says it runs on AWS and GCP.","status":"not_published","url":"https://www.voiceflow.com/privacy","locator":"Transfer of information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are based in Canada, but, unless we expressly agree otherwise, we may host, transfer, and process data, including Personal Information, in Canada and in other countries"},{"key":"dpa","value":"Yes: a Data Processing Addendum is published and incorporated into the Terms of Service, so no signature is needed.","status":"verified","url":"https://www.voiceflow.com/legal/dpa","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) is hereby incorporated into and governed by the terms of the Terms of Service"},{"key":"subprocessor_list","value":"Not found as a public page: the DPA says sub-processors are in its Annex III, which is not shown on the page, and the trust centre could not be read.","status":"not_captured","url":"https://www.voiceflow.com/compliance/gdpr","locator":"Where are subprocessor terms documented?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The subcontracting section and Annex III of our Data Processing Addendum address subprocessors."},{"key":"dpf_status","value":"No listing found for search term 'Voiceflow'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Voiceflow' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as needed to provide the service; deleted under internal policies after the subscription ends. No period is stated; model providers are set to zero data retention.","status":"verified","url":"https://www.voiceflow.com/privacy","locator":"12. Data retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Voiceflow will retain Personal Information we process on behalf of our customers or collect directly from our customers for as long as needed to provide Service to our customers"},{"key":"certifications","value":"4 listed on the security page: SOC 2 Type II, ISO 27001, GDPR, HIPAA.","status":"vendor_statement","url":"https://www.voiceflow.com/security","locator":"Certifications and compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Explore our compliance frameworks, supporting documentation, and what they mean for your team."},{"key":"admin_ai_controls","value":"Not stated: no organisation-wide switch to turn AI features off was found; the page mentions team roles and permissions only.","status":"not_published","url":"https://www.voiceflow.com/pricing","locator":"Looked at pricing, security, terms, privacy and DPA pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published. The business plan is 'Request pricing' / 'Book a demo'; no amounts are shown.","status":"not_published","url":"https://www.voiceflow.com/pricing","locator":"For Businesses","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Deploy and manage AI agents across your customer experience, with control and visibility."}]}]},{"slug":"webflow","name":"Webflow Premium","vendor":"Webflow, Inc.","category":"code-and-app-builders","plans":[{"id":"T542","plan":"site plan","tier":"business","price":{"label":"$25 / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No for AI features: Webflow and its subcontractors may not use AI Inputs and Outputs (prompts, content you give the AI and what it returns) to train, improve or fine-tune models without your prior consent. Training on other site content is not addressed.","status":"verified","url":"https://webflow.com/legal/ai-terms","locator":"2.1 Input and Output; No Training","url2":"https://webflow.com/feature/ai","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Webflow will use Inputs and Outputs solely to provide the AI Offerings to Customer. Webflow will not (and will not permit its subcontractors to) use them to train, improve, or fine-tune the AI Offerings or any underlying models without Customer’s"},{"key":"training_opt_out","value":"Nothing to do for AI inputs and outputs: the AI Terms prohibit training on them without your prior consent.","status":"verified","url":"https://webflow.com/legal/ai-terms","locator":"2.1 Input and Output; No Training","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Webflow will not (and will not permit its subcontractors to) use them to train, improve, or fine-tune the AI Offerings or any underlying models without Customer’s prior consent. ### 2.2"},{"key":"eu_residency_option","value":"Not stated; no EU hosting option is described in the DPA, privacy policy or security page.","status":"not_published","url":"https://webflow.com/security","locator":"Security page; DPA and privacy policy also checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated by country: Webflow is US-based and its DPA says infrastructure runs in AWS data centres 'in multiple regions and availability zones'.","status":"not_published","url":"https://webflow.com/legal/dpa","locator":"Annex II security measures","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Webflow infrastructure is managed via Amazon Web Services’ ISO 27001 certified data centers, and hosted in multiple regions and availability zones. All database servers are"},{"key":"dpa","value":"Yes: a Data Processing Addendum is published and applies where data protection laws apply; a pre-signed DocuSign version is available to sign.","status":"verified","url":"https://webflow.com/legal/dpa","locator":"Intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you would like to execute a DocuSigned version of this Data Processing Addendum, please review and sign our pre-signed DPA here. ## 1. Definitions Capitalized terms that are used"},{"key":"subprocessor_list","value":"Yes: https://webflow.com/legal/subprocessors (updated 9 Jul 2026), 37 entries. AI providers: Anthropic and OpenAI.","status":"verified","url":"https://webflow.com/legal/subprocessors","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Subprocessor list includes any of our service providers who may have access to your or your end users’ personal information when Webflow acts as your processor. The type of"},{"key":"dpf_status","value":"Active (Webflow; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Webflow'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Personal information processed for you is kept during the agreement and deleted after termination unless law requires keeping it. Retention of AI prompts is not stated.","status":"verified","url":"https://webflow.com/legal/dpa","locator":"Annex I, period of retention","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon the termination of the Agreement, Webflow will delete all Personal Information processed on behalf of Customer unless local laws, regulations, or other requirements"},{"key":"certifications","value":"6 named: ISO 27001, ISO 27017, ISO 27018, ISO 42001, SOC 2 and PCI-DSS.","status":"verified","url":"https://webflow.com/security","locator":"Compliance at a glance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Webflow maintains third-party certifications that validate how we handle data, access, and operational controls across our"},{"key":"admin_ai_controls","value":"Partly: the AI Terms say the customer may manage and disable applicable AI settings in its account settings; the steps are not given in the terms.","status":"verified","url":"https://webflow.com/legal/ai-terms","locator":"2.2 Customer Controls and Identification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer may manage and disable applicable settings at any time in its account settings as described here. Webflow shall identify"},{"key":"price_eur","value":"Shown in USD only: $25 per month billed yearly for the Premium site plan (Basic is $15).","status":"not_published","url":"https://webflow.com/pricing","locator":"Site plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"wellsaid","name":"WellSaid Business","vendor":"WellSaid Labs, Inc.","category":"phone-and-voice","plans":[{"id":"T425","plan":"team plan","tier":"business","price":{"label":"$160 / user / mo","amount":160,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No: WellSaid states it does not use customer inputs and outputs to train its models (own closed model)","status":"verified","url":"https://wellsaidlabs.com/features/features-security","locator":"FAQ: How does WellSaid use customer data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we do not use your inputs and outputs to train our models and do not claim ownership of your content."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train on customer inputs and outputs","status":"verified","url":"https://wellsaidlabs.com/features/features-security","locator":"FAQ: How does WellSaid use customer data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"we do not use your inputs and outputs to train our models and do not claim ownership of your content."},{"key":"eu_residency_option","value":"No: the service is hosted in the United States and EU users are described as transmitting data to the US; no EU region offered","status":"verified","url":"https://wellsaidlabs.com/privacy","locator":"International Visitors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Service is hosted in the United States and all Users of the Service acknowledge"},{"key":"default_data_location","value":"United States: customer data is processed and stored on Google Cloud Platform hosted in the US","status":"verified","url":"https://wellsaidlabs.com/features/features-security","locator":"FAQ: Where is customer data processed and stored?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customer data is processed and stored in the Google Cloud Platform, which is hosted in the US."},{"key":"dpa","value":"Yes: a published Data Processing Agreement forms part of the WellSaid Services Agreement, with EU Standard Contractual Clauses deemed signed by entering the agreement","status":"verified","url":"https://wellsaidlabs.com/dpa","locator":"Intro and section 7 Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Agreement (“DPA”) forms part of and is incorporated into the WellSaid Services Agreement"},{"key":"subprocessor_list","value":"Yes: Schedule 3 of the DPA at https://wellsaidlabs.com/dpa lists 7 sub-processors (Google Cloud, Azure, Mixpanel, Verisoul, PerspectiveAI, Hive, MongoDB); AI-related: Azure (language mechanics), PerspectiveAI and Hive (content moderation)","status":"verified","url":"https://wellsaidlabs.com/dpa","locator":"Schedule 3 / Section 6 Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"A list of WellSaid’s Subprocessors is available at Schedule 3."},{"key":"dpf_status","value":"No listing found for search term 'WellSaid'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'WellSaid' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for content: kept as long as needed to provide the service; on written request WellSaid returns or destroys all personal data within 90 days","status":"verified","url":"https://wellsaidlabs.com/dpa","locator":"Section 8 Return or Destruction of Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"WellSaid will, at the choice of Customer and upon Customer’s written request return to Customer and/or securely destroy all Personal Data within 90 days of such request"},{"key":"certifications","value":"2 named: SOC 2 Type I and SOC 2 Type II (plus a GDPR compliance claim); ISO is mentioned only for the hosting services","status":"verified","url":"https://wellsaidlabs.com/features/features-security","locator":"Compliance frameworks","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"upholding compliance standards for personal data under General Data Protection Regulation (GDPR), SOC2 Type I and SOC2 Type II certification."},{"key":"admin_ai_controls","value":"Not stated: Business plan has a team workspace and collaborator seats; no admin switch for AI features described (SSO and security controls are Enterprise-only)","status":"not_published","url":"https://wellsaidlabs.com/ai-voice-pricing","locator":"Team plans and plan comparison","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $160 per user/month, billed annually at $1,920 per year per user (Business, up to 5 seats)","status":"not_published","url":"https://wellsaidlabs.com/ai-voice-pricing","locator":"Team plans: Business","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"whimsical","name":"Whimsical","vendor":"Whimsical, Inc.","category":"workspace-and-projects","plans":[{"id":"T468","plan":"Pro","tier":"business","price":{"label":"$10 / mo","amount":10,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No by default. Whimsical does not use your Customer Data, or let others use it, to train the models behind Whimsical AI. It may improve models with data you voluntarily give as feedback or that you give permission for.","status":"verified","url":"https://whimsical.com/terms/ai-terms","locator":"Whimsical AI Terms, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Whimsical does not use your Customer Data or permit others to use your Customer Data to train the machine learning models used to provide Whimsical AI functionality."},{"key":"training_opt_out","value":"Nothing to do: the vendor states it does not train on customer data. Model improvement uses data only if you give feedback or permission.","status":"verified","url":"https://whimsical.com/terms/ai-terms","locator":"Whimsical AI Terms, data use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Whimsical does not use your Customer Data or permit others to use your Customer Data to train the machine learning models used to provide Whimsical AI functionality."},{"key":"eu_residency_option","value":"Not offered or not stated: Whimsical says services are hosted in the US and describes no EU data-region setting.","status":"not_published","url":"https://whimsical.com/terms/privacy","locator":"Privacy Notice, security page, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: Whimsical says the website and services are hosted in and provided from the US, on Amazon Web Services.","status":"verified","url":"https://whimsical.com/terms/privacy","locator":"Privacy Notice, data location","url2":"https://whimsical.com/company/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Website and our Services are hosted in and provided from the United States"},{"key":"dpa","value":"Yes. A Data Processing Addendum is published and referred to in the Privacy Notice; it carries the Standard Contractual Clauses for transfers outside Europe.","status":"verified","url":"https://whimsical.com/terms/privacy","locator":"Privacy Notice, International Transfer of Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The SCCs are part of our Data Processing Addendum located at https://whimsical.com/terms/dpa."},{"key":"subprocessor_list","value":"Yes: https://whimsical.com/terms/privacy/sub-processors lists 19 sub-processors (updated July 2026), including AI providers OpenAI and Anthropic, plus Amazon Web Services, Google Cloud, Google Workspace, Cloudflare, Turbopuffer (Canada), Plausible (Estonia) and Typeform (Spain).","status":"verified","url":"https://whimsical.com/terms/privacy/sub-processors","locator":"Subprocessor list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Subprocessor: OpenAI Service(s) provided: AI-enabled functionality Corporate location: USA"},{"key":"dpf_status","value":"No listing found for search term 'Whimsical'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Whimsical' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Whimsical deletes personal information when it no longer needs it for its purposes and is not legally required to keep it; no fixed number of days is stated. Account deletion is possible in settings; deletion requests go to privacy@whimsical.com.","status":"verified","url":"https://whimsical.com/terms/privacy","locator":"Privacy Notice, How Long We Keep Personal Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We generally delete information about you when we no longer need the information for the purposes for which we collect and use it"},{"key":"certifications","value":"1 certification: SOC 2 Type II. No ISO 27001 named.","status":"verified","url":"https://whimsical.com/security","locator":"Security page, compliance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We are SOC2 Type II compliant, certifying that our security policies and controls continuously meet the highest industry standards."},{"key":"admin_ai_controls","value":"Not stated; the AI terms say Whimsical may disable or degrade AI access for fair use, but no admin switch to turn AI off for a workspace is described.","status":"not_published","url":"https://whimsical.com/terms/ai-terms","locator":"Whimsical AI Terms, pricing page, MSA administrators clause","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $10 per editor/month on the Pro plan with annual billing selected (monthly billing costs more); viewers are free.","status":"not_published","url":"https://whimsical.com/pricing","locator":"Pricing, Pro plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Use Whimsical for free, or upgrade for advanced features and controls. Viewers are always free."}]}]},{"slug":"windsurf","name":"Windsurf / Devin Desktop","vendor":"Cognition AI, Inc. (Windsurf; some licences held by Exafunction, Inc.)","category":"code-and-app-builders","plans":[{"id":"T530","plan":"Teams","tier":"business","price":{"label":"$80 / user / mo","amount":80,"currency":"usd"},"canOptOut":true,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, unless an admin opts out. Cognition may use customer data for model training by default; paid plans (including Teams) can opt out, and only an administrator can do so on Teams.","status":"verified","url":"https://windsurf.com/terms-of-service-teams","locator":"Platform Terms of Service, 3.3.1 Use of Customer Data","url2":"https://windsurf.com/security","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cognition may use Customer Data for model training purposes and to improve and enhance the Services. If you subscribe to a paid Service Tier, you may opt out of this use"},{"key":"training_opt_out","value":"Paid plan: opt out on the Data Controls settings page. On Teams only an administrator can switch it on. After opt-out, data is not used for training and zero data retention is enabled with model providers.","status":"verified","url":"https://windsurf.com/security","locator":"Privacy & Intellectual Property, 'How is your data used to improve Devin?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you’re on a paid plan, you can opt out at any time on the Data Controls settings page."},{"key":"eu_residency_option","value":"Not stated for the Teams plan. No EU hosting or data-region setting appears in the terms, DPA, security page or pricing page.","status":"not_published","url":"https://windsurf.com/dpa","locator":"Looked in: Terms of Service, DPA, docs.devin.ai/admin/security, pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States. DPA Appendix C lists the cloud hosts: Google Cloud (marked Windsurf only) and Microsoft Azure and AWS (marked Devin only); every hosting row is located in the United States.","status":"verified","url":"https://windsurf.com/dpa","locator":"Appendix C: List of Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Core processing, profile data, logs, and indices"},{"key":"dpa","value":"Yes. The Data Processing Addendum is incorporated into the customer agreement and applies when personal data is processed; it includes EU standard contractual clauses.","status":"verified","url":"https://windsurf.com/dpa","locator":"Data Processing Addendum, opening paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"and is hereby incorporated into the Agreement"},{"key":"subprocessor_list","value":"Yes, published as Appendix C of the DPA (https://windsurf.com/dpa): 17 rows, 15 companies. AI providers: OpenAI, Anthropic, Google/Vertex, AWS/Bedrock, xAI, Databricks, Snowflake (some only if enabled).","status":"verified","url":"https://windsurf.com/dpa","locator":"Appendix C: List of Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following entities to the extent Customer Personal Data is included in the Customer Data submitted as input to The Cognition Platform."},{"key":"dpf_status","value":"No listing found for search term 'Cognition AI', 'Exafunction'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Cognition AI', 'Exafunction' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Customer data is kept for the duration of the customer relationship; with ZDR (after opt-out) it is not saved to disk and is deleted once the output is generated. Subprocessors delete within 30 days of DPA termination.","status":"verified","url":"https://windsurf.com/security","locator":"Privacy & Intellectual Property, 'What data retention policy does Cognition maintain?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cognition only retains data processed through Devin for the duration of the relationship with a given Customer"},{"key":"certifications","value":"SOC 2 Type II (since September 2024). No ISO certification named on the page read.","status":"verified","url":"https://windsurf.com/security","locator":"Security, Third-party audits and certification","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Cognition has been SOC 2 Type II certified since September 2024."},{"key":"admin_ai_controls","value":"Yes. On Teams and Enterprise, admins can restrict which AI models members use and switch individual AI features on or off (for example quick review, Codemaps, DeepWiki, MCP servers).","status":"verified","url":"https://docs.devin.ai/desktop/controls.md","locator":"Devin Desktop admin controls reference, table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Which models are available to members in Cascade, Devin Local, Command, and Devin CLI."},{"key":"price_eur","value":"Shown in USD only: Teams plan $80/month team minimum, with $40/month per full developer seat (up to 200 users).","status":"not_published","url":"https://windsurf.com/pricing","locator":"Pricing page, Team plans","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"$80/month for team plan + $40/mo per full dev seat"}]}]},{"slug":"wix","name":"Wix Business","vendor":"Wix.com Ltd.","category":"code-and-app-builders","plans":[{"id":"T544","plan":"website plan","tier":"business","price":{"label":"$39.77 / mo","amount":39.77,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes: Wix's Generative AI Policy lists user-generated content (such as images and page layouts) and automatically generated data about site users as sources it trains its own AI and machine-learning models on. No opt-out is described.","status":"verified","url":"https://support.wix.com/en/article/wixs-generative-ai-policy","locator":"Data processing and management; Dataset governance table","url2":"https://de.wix.com/about/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"in order to provide, maintain and improve our services to our users, including by developing, improving, and training Wix’s software tools, including artificial intelligence and machine learning models."},{"key":"training_opt_out","value":"Not stated: neither the Generative AI Policy nor the privacy policy describes a setting or request to stop Wix training on your content.","status":"not_published","url":"https://support.wix.com/en/article/wixs-generative-ai-policy","locator":"Whole policy; privacy policy (de.wix.com/about/privacy) and DPA also read","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"No: Wix says it has host servers in multiple locations around the world and it is currently not possible to select or change where your data is stored. The article adds that select custom hosting solutions are offered with Velo by Wix, included in the enterprise solution.","status":"verified","url":"https://support.wix.com/en/article/request-changing-your-host-server","locator":"Request: Changing Your Host Server","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Currently, it is not possible to select or change which host server your data is stored on."},{"key":"default_data_location","value":"Not stated by country: data about your site users is first processed by Wix.com Ltd. in Israel and then may go to other Wix entities worldwide; Wix says it has host servers in multiple locations around the world.","status":"not_published","url":"https://support.wix.com/en/article/list-of-wixs-sub-processors","locator":"Wix sub-processors","url2":"https://support.wix.com/en/article/request-changing-your-host-server","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"personal data of your Users-of-Users is first processed by Wix.com Ltd. (based in Israel). This data may then be transferred to other Wix entities worldwide for storage and service delivery."},{"key":"dpa","value":"Yes: the Wix Data Processing Addendum for Users forms part of the Wix Terms of Use and Privacy Policy and applies to data about your site visitors and customers; no signing is described.","status":"verified","url":"https://www.wix.com/about/privacy-dpa-users","locator":"Data Processing Addendum - Users, intro","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This DPA forms part of the Wix Terms of Use, Privacy Policy (the “Privacy Policy”) and any other applicable Wix terms or agreement governing the use of the Services"},{"key":"subprocessor_list","value":"Yes: https://support.wix.com/en/article/list-of-wixs-sub-processors, 24 rows (10 Wix group entities, 14 third parties such as AWS, Google Ireland, Snowflake). AI providers sit on a separate page: 14 incl. Anthropic, OpenAI, Google, Meta.","status":"verified","url":"https://support.wix.com/en/article/list-of-wixs-sub-processors","locator":"Wix sub-processors; Third-party sub-processors; AI service providers","url2":"https://support.wix.com/en/article/wixs-ai-service-providers-and-their-policies","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This page lists the sub-processors that Wix works with to process personal data of your site visitors and users"},{"key":"dpf_status","value":"Active (Wix.com Inc.; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Wix.com'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: on termination or on your written request Wix deletes your personal data and your site users' data 'as soon as reasonably practicable'; it may keep data where law requires. AI chat retention not stated.","status":"verified","url":"https://www.wix.com/about/privacy-dpa-users","locator":"Section E, Deletion of Users-of-Users Information","url2":"https://www.wix.com/about/privacy","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Upon termination of your use of the Services or your written request submitted through one of the methods detailed in the Privacy Policy, Wix shall delete your Personal Data"},{"key":"certifications","value":"5 named: ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 and PCI DSS Level 1.","status":"verified","url":"https://www.wix.com/website-security","locator":"Security standards","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your business meets the world’s highest website security standards, including ISO 27001, 27017, 27018 and SOC 2 Type 2. The"},{"key":"admin_ai_controls","value":"Not captured: Wix AI settings are documented in help pages and terms that need a browser.","status":"not_captured","url":"https://www.wix.com/about/terms-of-use","locator":"Server-readable text","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $39.77 per month for the Business plan on a yearly subscription paid in full at purchase; the page says taxes are set at checkout (it also shows 'Price includes GST'), and USD is for reference only.","status":"not_published","url":"https://www.wix.com/plans","locator":"Business plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"wordtune","name":"Wordtune","vendor":"AI21 Labs Ltd (Wordtune)","category":"writing-and-email","plans":[{"id":"T340","plan":"Unlimited","tier":"personal","price":{"label":"$6.99 / user / mo","amount":6.99,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in part: the Business privacy policy says that in certain cases anonymised data is used to train its AI algorithm, and the terms of use license your content to improve the algorithms behind Wordtune. No stop setting is described.","status":"verified","url":"https://www.wordtune.com/business/privacy-policy","locator":"Section 1, final paragraph (Finally, please note...)","url2":"https://www.wordtune.com/terms-of-use","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"In certain cases, we may or will anonymize or de-identify your Personal Data and further use it (for internal and external purposes, including, without limitation, to improve the services, to train our AI algorithm, for research purposes"},{"key":"training_opt_out","value":"Not stated: no setting or email to stop training is described on the privacy policies or terms.","status":"not_published","url":"https://www.wordtune.com/business/privacy-policy","locator":"Looked at Business and consumer privacy policies, terms of use, FAQ","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated: no EU data-location option found.","status":"not_published","url":"https://www.wordtune.com/privacy-policy","locator":"Looked at privacy policy (4.2), Business privacy policy, terms of use, FAQ, plans page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the privacy policy says personal data is processed and stored on AI21's servers there.","status":"verified","url":"https://www.wordtune.com/privacy-policy","locator":"4. Additional information regarding transfers, 4.2 External transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This includes processing and storing your Personal Data in our facilities and servers in the United States."},{"key":"dpa","value":"Business accounts: request a data processing agreement through the sales contact form. Not stated for the Unlimited plan.","status":"verified","url":"https://www.wordtune.com/business/privacy-policy","locator":"Section 2 (Your customers' personal data), 2.3","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"To the extent that Client needs to execute a data processing agreement,please request it at https://www.wordtune.com/business/contact-sales."},{"key":"subprocessor_list","value":"Not stated: no public sub-processor list found (0 entries); no AI model providers named.","status":"not_published","url":"https://www.wordtune.com/privacy-policy","locator":"Looked at privacy policy, Business privacy policy, terms of use, FAQ, plans page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'AI21 Labs'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'AI21 Labs' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept until AI21 deletes it or you send a valid deletion request (email privacy@wordtune.com); no fixed period; longer where law or disputes require.","status":"verified","url":"https://www.wordtune.com/privacy-policy","locator":"2.2 Retention of your Personal Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Your Personal Data will be stored until we proactively delete it or you send a valid deletion request."},{"key":"certifications","value":"1 named: SOC 2 (stated as 'SOC2 compliant' in the Business privacy policy; no report type or ISO certification named).","status":"verified","url":"https://www.wordtune.com/business/privacy-policy","locator":"3. How we protect and retain your information, 3.1","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have implemented appropriate technical, organizational and security measures designed to protect your Personal Data. Wordtune is SOC2 compliant."},{"key":"admin_ai_controls","value":"Not stated: plans table lists SAML SSO and centralized billing for business, but no admin switch for AI features.","status":"not_published","url":"https://www.wordtune.com/plans","locator":"Plans page comparison table; Business policy; terms","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $6.99 per user/month billed annually ($9.99 list); Business plan has no public price.","status":"not_published","url":"https://www.wordtune.com/plans","locator":"Plans & pricing: Unlimited card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"workable","name":"Workable Recruiting + HR","vendor":"Workable Software Limited (Workable, Inc.)","category":"documents-hr-and-finance","plans":[{"id":"T613","plan":"Standard","tier":"business","price":{"label":"$299 / mo","amount":299,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, per Workable's AI page: its AI tools are trained on feedback from user interactions and it says it uses customers' data to improve its in-house AI. The terms add that Workable can use aggregated data without identifying details to improve the Services.","status":"vendor_statement","url":"https://www.workable.com/workable-ai","locator":"FAQ: How is Workable different from tools like ChatGPT or Claude?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Our focus is to use customers' data to enhance the performance and accuracy of our in-house AI systems."},{"key":"training_opt_out","value":"Not stated; no setting or request to stop use of customer data for AI training is described in the terms, privacy policy, DPA or AI page.","status":"not_published","url":"https://www.workable.com/workable-ai","locator":"Terms, privacy policy, DPA, AI page (searched for train, opt out)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated; no EU hosting option found. The privacy policy says services are hosted in the US, with transfers covered by the Data Privacy Framework and standard contractual clauses.","status":"not_published","url":"https://www.workable.com/privacy","locator":"Privacy policy, terms, DPA, security page, sub-processors (searched for EU hosting, residency)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States (“U.S.”) through Workable, Inc. and its service providers"},{"key":"default_data_location","value":"United States. The services are hosted and operated in the US through Workable, Inc. and its providers; hosting is in AWS US East and Google Cloud US East.","status":"verified","url":"https://www.workable.com/privacy","locator":"International transfers section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The Services are hosted and operated in the United States (“U.S.”) through Workable, Inc. and its service providers"},{"key":"dpa","value":"Yes. The Data Processing Addendum is incorporated into the terms of use automatically; Workable is processor. A separately signed DPA or quote terms would override it.","status":"verified","url":"https://www.workable.com/legal/data-protection?tab=data-processing-addendum","locator":"Preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“Addendum”) is incorporated into the agreement(s) between the customer (“Customer” or “Controller”) and the Workable entity contracting with the Customer"},{"key":"subprocessor_list","value":"Yes, public at https://www.workable.com/subprocessors (updated 18 June 2026): 25 sub-processors plus 3 Workable affiliates. AI-related: OpenAI, Microsoft Azure (model inference), LangChain (orchestration), Deepgram (transcription), Google Cloud (Gemini for CV parsing).","status":"verified","url":"https://www.workable.com/subprocessors","locator":"Workable sub-processors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Azure United States To provide AI model inference services."},{"key":"dpf_status","value":"Active (Workable Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Workable'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active; the customer can delete candidate data itself. After the services end, Workable may delete all personal data at any time after 90 days. Deletion requests from candidates are handled within 30 days.","status":"verified","url":"https://www.workable.com/legal/data-protection?tab=data-processing-addendum","locator":"Return or deletion of data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Where the Controller has not deleted the personal data prior to the termination of the Services, Processor may delete all personal data at any time after 90 days following the date of termination"},{"key":"certifications","value":"4 named: ISO/IEC 27001, ISO/IEC 27017, SOC 2 (Type II, on request), SOC 3. Workable Agent page also cites the three first.","status":"verified","url":"https://www.workable.com/security","locator":"Workable protects your data at every level","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"SOC 2 (Type II) Trust Services Principles Contact us for access"},{"key":"admin_ai_controls","value":"Yes for the Workable Agent: an admin kill switch disables it across the whole account, and settings can be set per account, job or candidate. The terms call the AI-powered features optional.","status":"vendor_statement","url":"https://www.workable.com/workable-ai","locator":"You stay in control: Admin kill switch","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Disable the Agent across your entire account at any time."},{"key":"price_eur","value":"Shown in USD only: Standard $299/month ($3,588/year) for 1-20 employees, price rises by company-size band; Premier $599/month. Includes recruiting and HR; AI credits (3,000 free per ATS plan) are metered.","status":"not_published","url":"https://www.workable.com/pricing","locator":"Pick your plan: Standard card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"BUNDLE RECRUITING AND HR TO SAVE UP TO 20% $299/month $3,588/year"}]}]},{"slug":"wrike","name":"Wrike","vendor":"Wrike, Inc.","category":"workspace-and-projects","plans":[{"id":"T452","plan":"Business","tier":"business","price":{"label":"$25 / user / mo","amount":25,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Wrike does not use Customer Data, or let others use it, to train the machine learning models behind Wrike AI. It may use usage data, metadata and thumbs up/down feedback to improve Wrike AI.","status":"verified","url":"https://www.wrike.com/security/terms/","locator":"Terms of Service, 8.11 Improving Wrike AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Wrike does not use Customer Data or permit others to use Customer Data to train the machine learning methods and data models underlying Wrike AI."},{"key":"training_opt_out","value":"Nothing to do: Wrike's Terms state it does not use Customer Data to train the models behind Wrike AI.","status":"verified","url":"https://www.wrike.com/security/terms/","locator":"Terms of Service, 8.11 Improving Wrike AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Wrike does not use Customer Data or permit others to use Customer Data to train the machine learning methods and data models underlying Wrike AI."},{"key":"eu_residency_option","value":"Yes. Eligible customers can have workspaces stored in Wrike's EU data centre; to change location, contact Wrike support or your Wrike representative. Plan eligibility is not stated.","status":"verified","url":"https://www.wrike.com/privacy/","locator":"Privacy Policy, 10. International Data Transfers","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"eligible Customers can arrange to have their Workspaces stored in our data center located in the European Union."},{"key":"default_data_location","value":"Set by where you register: accounts created from Europe go to the Paris, France data centre; all other accounts go to the U.S. data centre in Santa Clara, California.","status":"verified","url":"https://www.wrike.com/pricing/","locator":"Pricing FAQ, 'Where will my data be hosted?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Accounts created from Europe are hosted in our European data center in Paris, France, while all other accounts are hosted in our primary U.S. data center in Santa Clara, California."},{"key":"dpa","value":"Yes. A public Data Processing Addendum covers customer personal data worldwide and incorporates the EU and UK Standard Contractual Clauses; the Terms refer to it.","status":"verified","url":"https://www.wrike.com/legal/trust-center/","locator":"Legal, Data Processing Addendum and SCCs","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) applies to the processing of personal data by Wrike on your behalf"},{"key":"subprocessor_list","value":"Yes, public at https://www.wrike.com/legal/subprocessors-list/: 21 rows (19 companies; Shibumi appears 3 times) plus 11 affiliate companies. AI providers: Microsoft (Azure OpenAI), Google (Vertex, Gemini), Anthropic (Claude), OpenAI.","status":"verified","url":"https://www.wrike.com/legal/subprocessors-list/","locator":"Sub-Processors and Affiliates","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Wrike Sub-Processors used for providing generative and agentic AI functionalities"},{"key":"dpf_status","value":"Active (Wrike, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Wrike'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for workspace content or Wrike AI prompts. The privacy policy gives retention only for account records (10 years after contract end for invoices and contracts) and Wrike's own meeting recordings (up to 12 months).","status":"not_published","url":"https://www.wrike.com/privacy/","locator":"Privacy Policy, 9. Data Retention; Terms; AI page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"4 named: SOC 2 Type II, ISO 27001, ISO 27018 and CSA STAR (Level 2 per the privacy policy).","status":"verified","url":"https://www.wrike.com/pricing/","locator":"Pricing FAQ, 'What does Wrike do to ensure GDPR compliance?'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We have the following independent third-party certifications:"},{"key":"admin_ai_controls","value":"Yes. Account owners can enable or disable generative AI for the entire account; they must accept the Wrike AI terms to enable it.","status":"vendor_statement","url":"https://www.wrike.com/ai/","locator":"Wrike AI page, FAQ on enabling generative AI","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Account owners can enable or disable generative AI for the entire account."},{"key":"price_eur","value":"Shown in USD only: $25 per user per month, Business plan, 5 to 200 users; billing basis and VAT not shown (prices exclude state/local taxes).","status":"not_published","url":"https://www.wrike.com/pricing/","locator":"Pricing, Business card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customizable platform to manage your workflows $25 user/month"}]}]},{"slug":"writer","name":"WRITER","vendor":"Writer, Inc.","category":"writing-and-email","plans":[{"id":"T355","plan":"Starter","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"No: Writer's terms for trial and paid non-Enterprise plans say it will not use your materials to train its models.","status":"verified","url":"https://writer.com/legal/terms-of-use/","locator":"Our Use of Materials","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will not use your Materials to train our models."},{"key":"training_opt_out","value":"Nothing to do: Writer states it does not train its models on your materials.","status":"verified","url":"https://writer.com/legal/terms-of-use/","locator":"Our Use of Materials","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We will not use your Materials to train our models."},{"key":"eu_residency_option","value":"Not stated; no data-region option found for Starter.","status":"not_published","url":"https://writer.com/legal/subprocessors/","locator":"Subprocessors table; plans page; trust page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated; the sub-processor list shows AWS and Google Cloud with 'United States' and 'European Union' locations but no default.","status":"not_published","url":"https://writer.com/legal/subprocessors/","locator":"Subprocessors table","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes: the Data Processing Agreement applies when you use WRITER for an organisation and is incorporated into the Terms of Use; EU SCCs are deemed signed.","status":"verified","url":"https://writer.com/legal/terms-of-use/","locator":"Intro to Terms of Use","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"When you are acting on behalf of an organization when accessing our Services, our Data Processing Agreement (“DPA”) applies and is incorporated by reference into these Terms."},{"key":"subprocessor_list","value":"Yes: https://writer.com/legal/subprocessors/ (updated 14 Oct 2026) lists 21 entries (20 companies plus Writer affiliates). AI/model providers: Baseten, OpenRouter, Parasail, Google Cloud, Microsoft Azure, AWS; web search: Exa.ai, Tavily.","status":"verified","url":"https://writer.com/legal/subprocessors/","locator":"Subprocessors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Writer and its affiliates engage third-party subprocessors to help us provide services to our customers."},{"key":"dpf_status","value":"Active (Writer, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Writer, Inc'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period. Under the DPA, Writer returns or deletes personal data at your written request; the Trust page adds an organisation-wide automated deletion schedule setting, with no plan named for it.","status":"verified","url":"https://writer.com/legal/data-processing","locator":"Section 9, Return or Destruction of Personal Data","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"Writer will, at the choice of Customer and upon Customer’s written request return to Customer and/or delete all Personal Data"},{"key":"certifications","value":"SOC 2 Type II; ISO/IEC 27001, 27701 and 42001 (4 certifications); HIPAA and PCI compliance also named.","status":"verified","url":"https://writer.com/trust/","locator":"Security: ISO and SOC 2 Type II certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"We undergo annual SOC 2 Type II evaluations and hold ISO/IEC 27001, 27701, and 42001 certifications"},{"key":"admin_ai_controls","value":"Not clear for Starter; the plans page lists team and org-level policies and basic admin reporting, and Enterprise adds advanced admin controls.","status":"not_published","url":"https://writer.com/plans/","locator":"Compare plans and features: Governance","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: the plans page says Starter is 'monthly or annual per-seat plans with fixed credit limits' with no amount; up to 5 users, 14-day free trial.","status":"not_published","url":"https://writer.com/plans/","locator":"Plan cards and FAQ: How does WRITER's pricing work?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"writesonic","name":"Writesonic","vendor":"Writesonic, Inc.","category":"assistants","plans":[{"id":"T313","plan":"Growth","tier":"business","price":{"label":"$399 / mo","amount":399,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"No. Writesonic does not train or fine-tune general-purpose models on customer data (also for its model providers) unless the customer joins a separate training programme. It may use de-identified, aggregated data to improve the service.","status":"verified","url":"https://writesonic.com/legal/terms","locator":"6.4 No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Writesonic does not use Customer Data to train or fine-tune any general-purpose, foundation, or large-language model offered by Writesonic or by any Model Provider"},{"key":"training_opt_out","value":"Nothing to do: Writesonic states it does not train on customer personal data.","status":"verified","url":"https://writesonic.com/legal/dpa","locator":"12.1 No Training on Customer Data","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Writesonic does not use Customer Personal Data to train or fine-tune any general-purpose, foundation, or large-language model offered by Writesonic or by any Model Provider."},{"key":"eu_residency_option","value":"Not stated for Growth. The DPA says only that hosting regions are configurable by enterprise contract; it does not name an EU region, and all listed hosting providers show United States.","status":"not_published","url":"https://writesonic.com/legal/dpa","locator":"Schedule 2, Hosting","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Azure (primary); Amazon Web Services for select workloads. Hosting region(s) configurable by enterprise contract."},{"key":"default_data_location","value":"United States: Microsoft Azure (primary) and Amazon Web Services for select workloads.","status":"verified","url":"https://writesonic.com/legal/dpa","locator":"Schedule 3 Sub-processors, Cloud hosting and infrastructure","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Microsoft Azure Primary cloud hosting, storage, networking, compute United States"},{"key":"dpa","value":"Yes. The DPA is part of the Terms of Service and applies automatically.","status":"verified","url":"https://writesonic.com/legal/terms","locator":"Customer Data section","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Writesonic will process such personal data in accordance with the Data Processing Agreement, which is incorporated into and forms part of this Agreement."},{"key":"subprocessor_list","value":"Yes, in Schedule 3 of the DPA (https://writesonic.com/legal/dpa): 44 entries, all listed as United States. AI providers: OpenAI, Anthropic, Microsoft Azure OpenAI, Azure Foundry for Anthropic, OpenRouter, Cohere, Google Cloud, plus Stability AI and ElevenLabs.","status":"verified","url":"https://writesonic.com/legal/dpa","locator":"Schedule 3 Sub-processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"The following Sub-processors may process Customer Personal Data to support the Services."},{"key":"dpf_status","value":"No listing found for search term 'Writesonic'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Writesonic' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Data is kept while the account is active. After termination it can be exported for 30 days, then deleted; the privacy policy says up to 30 days after account deletion. Backups are overwritten in the ordinary course.","status":"verified","url":"https://writesonic.com/legal/terms","locator":"Term and Termination","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"for thirty (30) days after termination, Writesonic will make Customer Data available for export through documented self-service mechanisms; thereafter Writesonic will delete Customer Data subject to the DPA and applicable law."},{"key":"certifications","value":"SOC 2 Type 2 (1 certification, per the DPA security schedule). The trust centre also shows GDPR and HIPAA marked \"Compliant\". No ISO certificate.","status":"verified","url":"https://writesonic.com/legal/dpa","locator":"Schedule 2 Technical and Organizational Measures, Compliance certifications","url2":"https://writesonic.trust.site/","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Compliance certifications SOC 2 Type 2."},{"key":"admin_ai_controls","value":"Not stated; no organisation-wide switch for AI features found.","status":"not_published","url":"https://writesonic.com/legal/terms","locator":"Looked at legal/terms, legal/dpa, pricing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in USD only: $399 per month billed annually. Growth includes 3 users and 2 projects.","status":"not_published","url":"https://writesonic.com/pricing","locator":"Pricing page, Growth card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"xero","name":"Xero","vendor":"Xero (NZ) Limited","category":"documents-hr-and-finance","plans":[{"id":"T605","plan":"Premium","tier":"business","price":{"label":"$75 / mo","amount":75,"currency":"usd"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated for Xero itself. Xero says JAX chat does not use your data to train the third-party LLMs it uses. Its privacy notice says data is analysed to improve services and develop products, including using AI/ML, without saying customer content trains its own models.","status":"not_published","url":"https://www.xero.com/ai-in-accounting/jax/","locator":"JAX page FAQ \"Does JAX use customer data to train the model?\"; privacy notice section 4 improve our services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"No, JAX chat doesn’t use your data to train the LLMs it uses."},{"key":"training_opt_out","value":"Not published. Xero names no training opt-out. For JAX chat it says you can leave it unopened or restrict who can use it through Xero roles and permissions.","status":"not_published","url":"https://www.xero.com/legal/privacy/","locator":"Privacy notice (AI/ML purpose); terms and JAX page checked","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not published. Xero describes international transfers but offers no EU-only storage option or setting.","status":"not_published","url":"https://www.xero.com/legal/privacy/","locator":"Section 10; pricing and security pages checked for a region option","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"default_data_location","value":"Not fixed. Xero transfers data to Australia, New Zealand and the United States, citing the location of its teams and data hosting locations, and replicates data between data centres.","status":"verified","url":"https://www.xero.com/legal/privacy/","locator":"Privacy notice, 10 'International transfers'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Australia, New Zealand and the United States—due to the location of our teams and data hosting locations"},{"key":"dpa","value":"Yes. Xero's terms incorporate data processing terms that apply to personal data processed on the customer's behalf.","status":"verified","url":"https://www.xero.com/legal/terms/","locator":"Terms of use, clause 21 'Use of personal data we process on your behalf'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Our data processing terms apply to the personal data that we process on your behalf"},{"key":"subprocessor_list","value":"Yes. https://www.xero.com/legal/xero-subprocessors/ lists 21 third-party subprocessors and 11 Xero group entities (32 entries). AI providers: Anthropic and OpenAI (conversational AI); cloud hosts include AWS, Microsoft Azure and Google Cloud.","status":"verified","url":"https://www.xero.com/legal/xero-subprocessors/","locator":"Xero subprocessors page, Third parties and Xero affiliates lists","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic, Conversational artificial intelligence services, United States"},{"key":"dpf_status","value":"No listing found for search term 'Xero'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Xero' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the customer relationship lasts and afterwards while there is a business or legal need, for example tax and accounting rules; then deleted or anonymised.","status":"verified","url":"https://www.xero.com/legal/privacy/","locator":"Privacy notice, 8 'Personal data retention'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"We'll retain your personal data for as long as we've a relationship with you and for a period of time afterwards where we have an ongoing business or legal need to keep it."},{"key":"certifications","value":"ISO/IEC 27001:2022 certified and SOC 2 reports from independent audits (two audited items). The page also states PCI DSS v4.0 SAQ A compliance, a merchant self-assessment.","status":"verified","url":"https://www.xero.com/security/","locator":"Security page, 'ISO 27001 security standard compliance'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Xero is certified as compliant with ISO/IEC ISO27001:2022"},{"key":"admin_ai_controls","value":"Partly. Xero says JAX only runs when opened and that you can restrict particular people from using JAX chat by adjusting their Xero roles and permissions. No single organisation-wide AI switch is described.","status":"verified","url":"https://www.xero.com/ai-in-accounting/jax/","locator":"JAX page FAQ \"I no longer want to use JAX; how can I opt out?\"","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you don’t want certain people in your organisation using JAX chat, you can adjust their Xero roles and permissions."},{"key":"price_eur","value":"Shown in USD only: $75 per month for Premium, billed monthly. No euro price and no VAT shown.","status":"not_published","url":"https://www.xero.com/pricing-plans/","locator":"Pricing page, Premium plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Premium $75 USD per month Good for established businesses of all sizes"}]}]},{"slug":"yousign","name":"Yousign","vendor":"Youtrust SAS (formerly Yousign), Caen, France","category":"documents-hr-and-finance","plans":[{"id":"T581","plan":"Plus","tier":"business","price":{"label":"€23 / user / mo","amount":23,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Not stated; no AI feature or training clause found in the privacy policy, terms, DPA or security page. Only an AI connector is offered, which hands requests to your own AI assistant.","status":"not_published","url":"https://yousign.com/privacy","locator":"Privacy policy, terms, data processing agreement, security page, AI connector page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Not stated; no training clause found, so no opt-out is described.","status":"not_published","url":"https://yousign.com/privacy","locator":"Privacy policy, terms, DPA, security page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes, by default: hosting is only in France, so no setting is needed to keep data in the EU.","status":"verified","url":"https://yousign.com/security","locator":"Hosting in France","url2":"https://yousign.com/subprocessors","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Youtrust solutions are exclusively hosted in France."},{"key":"default_data_location","value":"France. The solutions are hosted only in France; signed documents and audit trails are archived at Arkhineo (France).","status":"verified","url":"https://yousign.com/security","locator":"Hosting in France","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Youtrust solutions are exclusively hosted in France. The evidence files we create for each electronic signature are legally archived at Arkhinéo"},{"key":"dpa","value":"Yes. The Data Processing Agreement is an integral part of the Contract and takes effect when the Contract is signed; no separate signing step.","status":"verified","url":"https://yousign.com/data-processing","locator":"1. Purpose","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Agreement comes into effect from the date of signature of the Contract to which it is attached"},{"key":"subprocessor_list","value":"Yes, public list at https://yousign.com/subprocessors, dated 2 July 2026: 38 entries. AI provider shown: Dust (AI assistants, hosted in Ireland); no OpenAI, Anthropic or Mistral.","status":"verified","url":"https://yousign.com/subprocessors","locator":"Subprocessor table (Latest update: 2 July 2026)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Solution that allows the creation of virtual assistants powered by AI"},{"key":"dpf_status","value":"Not applicable (EU-based vendor, Youtrust SAS, Caen, France)","status":"verified","url":"https://yousign.com/privacy","locator":"Contact / data controller entity","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Youtrust SAS, Rue de Suède Avenue Pierre Berthelot, 14000 Caen, France."},{"key":"data_retention","value":"Documents stay in the account for the subscription period; Youtrust can add size or period limits after one month notice; no deletion period after cancellation stated. Personal data erased when purposes end, subject to legal retention.","status":"verified","url":"https://yousign.com/terms","locator":"9.6 Document Management","url2":"https://yousign.com/data-processing","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"is kept, within the authorised usage limit, in the Corporate Account and/or the User Account used to instigate the signature process during the Subscription period."},{"key":"certifications","value":"eIDAS trust-service certifications (e-signature, e-seal, time stamping); ISO/IEC 27001 named on the AI connector page; GDPR compliance claimed. 2 certifications.","status":"verified","url":"https://yousign.com/security","locator":"Certifications and Standards","url2":"https://yousign.com/ai-connector","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Youtrust is a trusted third party and has eIDAS certifications for electronic signature, electronic seal and time stamping."},{"key":"admin_ai_controls","value":"Not stated; no admin setting to switch the AI connector off is described (it is available on all plans; users can revoke access in account settings).","status":"not_published","url":"https://yousign.com/ai-connector","locator":"FAQ on AI connector","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 23 per user/month, excluding VAT, on yearly billing (EUR 276 per user per year); the page also shows EUR 360 per year as the monthly-billing figure.","status":"verified","url":"https://yousign.com/pricing-application","locator":"Plus plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Plus Advanced features with unlimited eSignatures. 23 € Excl. VAT per user/month 360 € 276 € per year"}]}]},{"slug":"zapier","name":"Zapier","vendor":"Zapier","category":"automation","plans":[{"id":"T40","plan":"Free","tier":"free","price":{"label":"Free","amount":0,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in de-identified form: Zapier may derive de-identified data sets from customer content and use them to improve its products, including model training, unless the account submits the opt-out form; only Company and Enterprise plans are opted out automatically","status":"verified","url":"https://zapier.com/legal/terms-of-service","locator":"Section 7(b) 'Improvements', clauses (ii) and (iii) (effective 9 Apr 2026)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Only by form: the account must submit Zapier's opt-out form linked in the terms; no in-app switch is described","status":"verified","url":"https://zapier.com/legal/terms-of-service","locator":"Section 7(b) 'Improvements'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not available","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Data storage section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (AWS)","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Data storage section","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. The DPA (effective 27 Aug 2026) is incorporated by reference in the Terms of Service; no signature needed","status":"verified","url":"https://zapier.com/legal/data-processing-addendum","locator":"Preamble","url2":"https://zapier.com/legal/terms-of-service","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 33 third-party entries (23 infrastructure, 5 support, 5 service-specific) plus affiliates; 8 named AI providers; new version effective 23 Oct 2026","status":"verified","url":"https://zapier.com/legal/subprocessors","locator":"Sub-processor tables","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Zapier, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zapier'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Zap content and history are kept for 29 to 69 days: Zapier deletes data older than the previous month on the first Monday of each month","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Section on data retention ('On the first Monday of each month…')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II and SOC 3 reports; no ISO certification listed","status":"verified","url":"https://trust.zapier.com/","locator":"Trust Center 'Badges'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Not offered: the Admin Center is available on Team and Enterprise plans only","status":"verified","url":"https://help.zapier.com/hc/en-us/articles/38925392216973-Review-your-account-in-the-admin-center","locator":"Box 'Available on plans: Team or Enterprise plan'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Free (USD 0 per month; 'Free forever')","status":"verified","url":"https://zapier.com/pricing","locator":"Plan card 'Free'","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""}]},{"id":"T09","plan":"Team","tier":"business","price":{"label":"From €63.09 / mo","amount":63.09,"currency":"eur"},"canOptOut":true,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"Conditional yes: Zapier may derive de-identified data sets from customer content and use them, including for model training, unless the customer submits an opt-out form; Company and Enterprise plans are opted out automatically","status":"verified","url":"https://zapier.com/legal/terms-of-service","locator":"Section on Usage Information and Derived Data (effective 9 Apr 2026)","url2":"https://zapier.com/legal/subprocessors","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"The account must submit Zapier's opt-out form (linked in Terms of Service section on Improvements). No in-app switch is described for Team; Company and Enterprise plans are opted out automatically","status":"verified","url":"https://zapier.com/legal/terms-of-service","locator":"Section 'Improvements', clause (ii) and (iii) on Derived Data","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not available","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Data Privacy FAQ, EU-only storage question","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States (AWS)","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Data Privacy FAQ, 'Where does Zapier store data?'","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. DPA (effective 27 Aug 2026) is incorporated by reference in the Terms of Service; no signature needed, signed copy available","status":"verified","url":"https://zapier.com/legal/data-processing-addendum","locator":"Preamble and introductory note","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 33 third-party entries (23 infrastructure, 5 support, 5 service-specific) plus affiliates; 8 named AI providers; all list USA, Meta also other countries. New version posted 9 Oct 2026, effective 23 Oct 2026","status":"verified","url":"https://zapier.com/legal/subprocessors","locator":"Posted/effective dates; three tables","url2":"","checkedOn":"2026-10-16","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zapier'","url2":"https://zapier.com/legal/data-privacy","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Zap content and history are kept for 29 to 69 days: Zapier deletes data older than the previous month on the first Monday of each month. Only Company and Enterprise can set a custom 7–30 day period","status":"verified","url":"https://zapier.com/legal/data-privacy","locator":"Section on data retention ('On the first Monday of each month…')","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"SOC 2 Type II and SOC 3 reports; GDPR and CCPA badges. No ISO certification listed","status":"verified","url":"https://trust.zapier.com/","locator":"Trust Center 'Badges' and announcement of 3 Aug 2026","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Not stated for Team. The Admin Center (Team and Enterprise) has an 'AI models' governance page, but Zapier says Team accounts see only their plan's features; AI restrictions and own-AI-provider controls are documented for Enterprise","status":"not_published","url":"https://help.zapier.com/hc/en-us/articles/38925392216973-Review-your-account-in-the-admin-center","locator":"Sections 'Governance settings' and 'Limitations'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"From EUR 63.09 per month billed yearly, for the account (up to 25 users, lowest task tier); not per seat","status":"verified","url":"https://zapier.com/pricing","locator":"Currency selector EUR, 'Pay yearly' selected, Team card","url2":"","checkedOn":"2026-10-16","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"zendesk","name":"Zendesk","vendor":"Zendesk, Inc.","category":"sales-marketing-and-support","plans":[{"id":"T109","plan":"Suite Team","tier":"business","price":{"label":"€55 / user / mo","amount":55,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-18","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, for Zendesk's own non-generative models: Zendesk uses Service Data, with identifier fields removed, to train its cross-customer classification and clustering models. Generative features use outside AI models that do not train on customer data","status":"verified","url":"https://support.zendesk.com/hc/en-us/articles/5729714731290-Zendesk-AI-Data-Use-Information","locator":"Sections 'No generative content trained on customer data' and 'Protection of customer data' (edited 7 Jul 2025)","url2":"https://www.zendesk.com/trust-center/","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"training_opt_out","value":"Not published: no opt-out from training Zendesk's own machine-learning models is described on the pages read","status":"not_published","url":"https://support.zendesk.com/hc/en-us/articles/5729714731290-Zendesk-AI-Data-Use-Information","locator":"Whole article","url2":"https://www.zendesk.com/trust-center/","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"eu_residency_option","value":"Not on Suite Team: the Data Center Location add-on (US, EEA, UK, APAC) is offered for Suite Professional, Suite Enterprise and Support Enterprise","status":"verified","url":"https://www.zendesk.de/pricing/","locator":"Feature comparison row 'Standort des Rechenzentrums' (add-on for Suite Professional and Enterprise)","url2":"https://support.zendesk.com/hc/en-us/articles/4408883599130-Regional-Data-Hosting-Policy","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"default_data_location","value":"No commitment: without the Data Center Location add-on, Zendesk makes no commitment on where Service Data is hosted","status":"verified","url":"https://support.zendesk.com/hc/en-us/articles/4408883599130-Regional-Data-Hosting-Policy","locator":"Opening paragraph (edited 29 Sep 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpa","value":"Yes. The Data Processing Agreement is part of the Zendesk Customer Agreement and applies when Service Data includes personal data","status":"verified","url":"https://www.zendesk.com/company/data-processing-agreement/","locator":"Opening paragraph","url2":"https://www.zendesk.com/company/agreements-and-terms/zendesk-customer-agreement/","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 2 infrastructure (AWS, Google), 27 service-specific including AI from OpenAI, Microsoft, Google, Mistral AI, Groq, ElevenLabs and Deepgram, 3 innovation-services, plus 23 Zendesk group companies","status":"verified","url":"https://support.zendesk.com/hc/en-us/articles/4408883061530-Sub-processor-Policy","locator":"Current tables (policy edited 2 Sep 2026, effective for existing customers 2 Oct 2026)","url2":"https://www.zendesk.com/company/data-processing-agreement/","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"dpf_status","value":"Active (Zendesk, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zendesk'","url2":"https://www.zendesk.com/company/agreements-and-terms/binding-corporate-rules","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept for the subscription; 90 days after cancellation an automated process starts deleting Service Data, and ticket, user and attachment data are deleted within 40 days of that start","status":"verified","url":"https://support.zendesk.com/hc/en-us/articles/4408883628954-Zendesk-Service-Data-Deletion-Policy","locator":"Opening sections and table 'Data Deletion Timeline for Structured Service Data' (edited 3 Jun 2026)","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"certifications","value":"SOC 2 Type II; ISO/IEC 27001:2022, 27017:2015, 27018:2019 and 27701:2019; PCI DSS; FedRAMP LI-SaaS; CSA STAR AI Level 1 and 2; HIPAA support","status":"verified","url":"https://www.zendesk.com/trust-center/","locator":"Compliance section","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"admin_ai_controls","value":"Partly: Zendesk's AI addendum says generative AI features can be disabled where applicable; no switch for its own machine-learning models was found","status":"verified","url":"https://www.zendesk.com/company/agreements-and-terms/ai-services-addendum/","locator":"Section 2 ('ability to disable them at any time')","url2":"","checkedOn":"2026-10-18","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 55 per agent/month paid yearly; VAT basis not stated","status":"verified","url":"https://www.zendesk.de/pricing/","locator":"Plan card 'Suite Team'","url2":"","checkedOn":"2026-10-18","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"zoho-books","name":"Zoho Books","vendor":"Zoho Corporation GmbH","category":"documents-hr-and-finance","plans":[{"id":"T607","plan":"Premium","tier":"business","price":{"label":"€60 / mo","amount":60,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes. Zoho says it uses anonymised service data to improve algorithm accuracy and uses your business data to build models tailored to your company.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Datenschutzrichtlinie, 'Automatisierung und künstliche Intelligenz'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln"},{"key":"training_opt_out","value":"Not published. Zoho describes model development on business data but names no opt-out; export and deletion of service data are separate rights.","status":"not_published","url":"https://www.zoho.com/privacy.html","locator":"Datenschutzrichtlinie, AI section and service-data rights","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":""},{"key":"eu_residency_option","value":"Not a setting you choose: location follows your country at sign-up. Zoho names EU data centres (Amsterdam, Dublin) on its compliance page, but the pages read do not say a Books account can be placed there on request.","status":"not_published","url":"https://www.zoho.com/terms.html","locator":"Terms clause on cloud facility location; compliance page lists EU1 Amsterdam and EU2 Dublin","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Assigned by country: the Terms say the cloud facility serving you depends on your region or country at sign-up, taken from your IP address. Zoho may migrate your account and may keep a local copy in your country.","status":"verified","url":"https://www.zoho.com/terms.html","locator":"Servicebedingungen, clause on the location of the cloud facility","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Standort der Cloud-Anlage, die für Sie als Server dient, hängt von der Zuordnung zwischen Ihrer Region bzw. Ihrem Land"},{"key":"dpa","value":"Yes, on request. Zoho invites customers to ask for a GDPR-compliant data processing addendum.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Datenschutzrichtlinie, section 'Sie können uns jederzeit kontaktieren'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"einen DSGVO-konformen Zusatz zur Datenverarbeitung anfordern"},{"key":"subprocessor_list","value":"A public sub-processor directory exists, filterable by service, data centre and category (including AI Service Providers), but its entries load by script and were not readable. Count and AI providers not captured.","status":"not_captured","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Sub-processor directory (entries load dynamically)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Zoho'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zoho' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept as long as needed for the purposes in the policy, and longer for legal, tax, accounting or claim reasons; service data can be exported or deleted on request.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Datenschutzrichtlinie, 'Aufbewahrung von Informationen'","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"Wir behalten uns vor, Ihre personenbezogenen Informationen so lange zu speichern, wie dies im Rahmen der in dieser Datenschutzrichtlinie beschriebenen Zwecke erforderlich ist."},{"key":"certifications","value":"Compliance page names for Zoho cloud services: ISO/IEC 27001, 27701, 27017, 27018, 9001 and 22301; ISO 20000-1 for data-centre operations; SOC 2 Type 2; SOC 1 Type 2 and SOC 1 Audit Trail (Books named); GoBD (Books); PCI DSS SAQ-D self-assessment.","status":"verified","url":"https://www.zoho.com/compliance.html","locator":"Compliance at Zoho, Certifications list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zoho is SOC 2 Type 2 compliant."},{"key":"admin_ai_controls","value":"Partly. Zoho says admins are given the option to turn off some sub-processors (it lists AI service providers as a category). Which AI providers can be switched off, and any single AI-off switch, were not readable.","status":"verified","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Sub-processor page, closing note","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Some of the sub-processors will be enabled by default, and the admin will be given the option to turn it off"},{"key":"price_eur","value":"€60 per company per month, or €50 per company per month with annual billing, on the Premium plan. VAT is not shown.","status":"verified","url":"https://www.zoho.com/books/pricing/","locator":"Preise page, Premium plan block","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (Hermes VPS, DE)","quote":"60€ 50€ Preis/Unternehmen/Monat Preis/Unternehmen/Monat (jährliche Abrechnung)"}]}]},{"slug":"zoho-crm","name":"Zoho CRM","vendor":"Zoho Corporation Private Limited","category":"sales-marketing-and-support","plans":[{"id":"T491","plan":"Professional","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in limited form. Zoho's privacy policy says it uses anonymised service data sets to improve the accuracy of its AI/ML algorithms, and uses your company's data to build custom models for your company only.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Automatisierung und künstliche Intelligenz (privacy policy, German)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln."},{"key":"training_opt_out","value":"Not stated: no setting or request route for opting out of the anonymised-data use is described on the pages read.","status":"not_published","url":"https://www.zoho.com/privacy.html","locator":"Automatisierung und künstliche Intelligenz","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not stated on the pages read (privacy, security, GDPR, compliance pages). The GDPR page only says the account is tied to the data centre chosen at sign-up.","status":"not_published","url":"https://www.zoho.com/gdpr.html","locator":"GDPR page; privacy and security pages","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Not stated as a single default. Zoho runs several data centres and the account sits in the one chosen at sign-up; the GDPR page refers to 'the Data Center you've signed up for'.","status":"not_published","url":"https://www.zoho.com/gdpr.html","locator":"GDPR page, DPA paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"mentioning in which Data Center you've signed up for your Zoho account"},{"key":"dpa","value":"Yes, on request: the organisation admin emails legal@zohocorp.com for the Data Processing Addendum and names the data centre the account is in.","status":"verified","url":"https://www.zoho.com/gdpr.html","locator":"GDPR page, DPA paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com to request a copy of the Data Processing Addendum"},{"key":"subprocessor_list","value":"A public list exists at https://www.zoho.com/privacy/sub-processors.html with separate tabs for sub-processors, third-party providers and AI service providers, but the entries load by script, so no count or AI provider names could be read.","status":"not_captured","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Sub-Processor directory","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Zoho'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zoho' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active. After cancellation, data is deleted from the live database at the next purge (every 6 months) and from backups 3 months later. Customers can access, export or delete their data.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Aufbewahrung von Informationen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Nach der Kündigung Ihres Kontos werden Ihre Daten automatisch innerhalb von 6 Monaten aus unserer aktiven Datenbank gelöscht, und 3 Monate später ebenfalls aus unseren Backups."},{"key":"certifications","value":"7 ISO certifications (27001, 27701, 27017, 27018, 9001, 20000-1, 22301), SOC 1 and SOC 2 Type 2 reports (plus SOC 2+HIPAA), and regional ones such as ENS (Spain), HDS (France), GoBD and Cyber Essentials Plus.","status":"verified","url":"https://www.zoho.com/compliance.html","locator":"Compliance page headings","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zoho has earned ISO/IEC 27001 certification for Applications, Systems, People, Technology, and Processes"},{"key":"admin_ai_controls","value":"Not stated on the pages read. The pricing page lists 'Access AI/Zia features' only as a Team-user licence limit, not as an admin switch.","status":"not_published","url":"https://www.zoho.com/crm/zohocrm-pricing.html","locator":"Team user permissions list","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Shown in INR only (as served to this fetch): ₹1,400 per user/month for Professional. The page has a currency switch that includes EUR which could not be read without a browser.","status":"not_published","url":"https://www.zoho.com/crm/zohocrm-pricing.html","locator":"Pricing cards (served in German, INR)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"zoho-desk","name":"Zoho Desk","vendor":"Zoho Corporation Private Limited","category":"phone-and-voice","plans":[{"id":"T443","plan":"Professional","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in a limited form: Zoho's privacy policy says it uses anonymised service data sets to improve the accuracy of its algorithms and uses your company data to build custom models for your company.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Privacy policy: Automatisierung und künstliche Intelligenz (German page)","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln."},{"key":"training_opt_out","value":"Not stated. No setting or email to stop the training described in the privacy policy was found.","status":"not_published","url":"https://www.zoho.com/privacy.html","locator":"Automatisierung und künstliche Intelligenz","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Yes in practice: Zoho runs EU data centres (Amsterdam and Dublin) and the account's data centre follows the country chosen at sign-up. No separate EU-only switch or plan condition is described.","status":"verified","url":"https://www.zoho.com/compliance.html","locator":"Cyber Essentials Plus entry, Applicable to","url2":"https://www.zoho.com/terms.html","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zoho UK office and EU Datacenters (EU1 Datacenter - Amsterdam, Netherlands; and EU2 Datacenter - Dublin, Ireland)"},{"key":"default_data_location","value":"Set by the country or region chosen at sign-up: Zoho assigns a regional cloud facility from that mapping and can migrate the account if the mapping changes.","status":"verified","url":"https://www.zoho.com/terms.html","locator":"Standort der Cloud-Anlage","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Standort der Cloud-Anlage, die für Sie als Server dient, hängt von der Zuordnung zwischen Ihrer Region bzw. Ihrem Land und den verfügbaren Cloud-Anlagen zum Zeitpunkt der Anmeldung ab."},{"key":"dpa","value":"Yes, on request: the organisation admin emails legal@zohocorp.com for Zoho's DPA and states which data centre the account is in.","status":"verified","url":"https://www.zoho.com/gdpr.html","locator":"DPA paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com"},{"key":"subprocessor_list","value":"A public directory exists at https://www.zoho.com/privacy/sub-processors.html (filter by service and data centre, with an AI Service Providers category), but entries load only in a browser, so no count was captured.","status":"not_captured","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Sub-Processor directory","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Zoho'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zoho' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Not stated for paid plans. Terms only say unpaid accounts inactive for 120 days can be closed and their data deleted.","status":"not_published","url":"https://www.zoho.com/terms.html","locator":"Richtlinie zu inaktiven Benutzerkonten","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"Seven ISO certificates for all cloud services (27001, 27701, 27017, 27018, 9001, 20000-1, 22301), SOC 2 Type 2 (all cloud services) and SOC 2 + HIPAA Type 2, whose scope names Zoho Desk. Company-wide page; SOC 1 scope does not list Zoho Desk.","status":"verified","url":"https://www.zoho.com/compliance.html","locator":"Certifications: SOC 2 + HIPAA Type 2 entry, Applicable to (also ISO and SOC 2 Type 2 entries)","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Applicable to - Zoho CRM, Zoho Bookings, Zoho Survey, Zoho Forms, Zoho Desk, Zoho Expense, Zoho Checkout, Zoho Connect and CommunitySpaces"},{"key":"admin_ai_controls","value":"Partly: the admin can turn certain sub-processors off (some are on by default, some off); an organisation-wide Zia switch is not confirmed.","status":"verified","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Notes below directory","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Some of the sub-processors will be enabled by default, and the admin will be given the option to turn it off"},{"key":"price_eur","value":"Shown in INR only (page fetched in German): ₹1,400 per user/month, billed annually; no EUR price captured.","status":"not_published","url":"https://www.zoho.com/desk/pricing.html","locator":"Professional plan card","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"zoho-projects","name":"Zoho Projects","vendor":"Zoho Corporation Private Limited","category":"workspace-and-projects","plans":[{"id":"T460","plan":"Premium","tier":"business","price":{"label":"See details","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-20","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, in limited form: the privacy policy lets Zoho use anonymised service data to improve its algorithms and your company data to build models tailored to your company.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Privacy policy (German), Automatisierung und künstliche Intelligenz","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln."},{"key":"training_opt_out","value":"None described: the privacy policy that permits this limited use offers no setting or request to stop it.","status":"not_published","url":"https://www.zoho.com/privacy.html","locator":"Privacy policy (German), Automatisierung und künstliche Intelligenz","url2":"","checkedOn":"2026-10-20","checkedFrom":"server fetch (non-browser)","quote":"(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln."},{"key":"eu_residency_option","value":"Not stated as a choice: the data centre is assigned from the sign-up country or region, and no setting to pick EU hosting is described on the Terms, Privacy, GDPR or pricing pages.","status":"not_published","url":"https://www.zoho.com/terms.html","locator":"Terms (Hosting-Standort), GDPR page, Privacy policy, Projects pricing page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"Assigned from the country or region detected when you sign up (by IP address); Zoho can move the account to another data centre. The data centre location is not named on these pages.","status":"verified","url":"https://www.zoho.com/terms.html","locator":"Terms of Service (German), Hosting-Standort","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Der Standort der Cloud-Anlage, die für Sie als Server dient, hängt von der Zuordnung zwischen Ihrer Region bzw. Ihrem Land"},{"key":"dpa","value":"Yes, on request: the organisation administrator emails legal@zohocorp.com to get Zoho's Data Processing Addendum, naming the data centre the account is in.","status":"verified","url":"https://www.zoho.com/gdpr.html","locator":"GDPR page, DPA paragraph","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com"},{"key":"subprocessor_list","value":"Yes, a public directory exists at https://www.zoho.com/privacy/sub-processors.html with an AI Service Providers category, but its rows load by JavaScript and could not be counted.","status":"not_captured","url":"https://www.zoho.com/privacy/sub-processors.html","locator":"Sub-processor directory","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"No listing found for search term 'Zoho'","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zoho' returned 'Query returned no results'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"Kept while the account is active. After cancellation, data is deleted from the live database at the next purge (run every 6 months) and from backups 3 months later. The customer can ask for export or deletion at any time.","status":"verified","url":"https://www.zoho.com/privacy.html","locator":"Privacy policy (German), Aufbewahrung von Informationen","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Sobald Sie Ihr Zoho-Benutzerkonto kündigen, werden Ihre Daten bei der nächsten Bereinigung, die alle 6 Monate durchgeführt wird, aus der aktiven Datenbank gelöscht."},{"key":"certifications","value":"Company-wide page lists 9 headline certifications: ISO/IEC 27001, 27701, 27017, 27018, ISO 9001, ISO/IEC 20000-1, ISO 22301, SOC 1 Type 2 and SOC 2 Type 2, plus regional schemes (ENS, HDS, Cyber Essentials Plus and others).","status":"verified","url":"https://www.zoho.com/compliance.html","locator":"Compliance at Zoho, Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Zoho is SOC 2 Type 2 compliant."},{"key":"admin_ai_controls","value":"Partly: Zoho's Projects AI page says all AI functions are turned off by default and you choose when to use them. A named admin setting to switch AI on or off for the organisation is not described.","status":"vendor_statement","url":"https://www.zoho.com/projects/ai.html","locator":"Zoho Projects AI page, FAQ: How does Zoho ensure the security of my data?","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"All AI functions are turned off by default."},{"key":"price_eur","value":"Not captured: the plan prices on the pricing page are filled in by JavaScript and are missing from the fetched text.","status":"not_captured","url":"https://www.zoho.com/projects/zohoprojects-pricing.html","locator":"Pricing page, Premium plan","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]},{"slug":"zoom","name":"Zoom Workplace","vendor":"Zoom","category":"meetings-and-notes","plans":[{"id":"T19","plan":"Pro","tier":"business","price":{"label":"€13.33 / user / mo","amount":13.33,"currency":"eur"},"canOptOut":false,"checkedOn":"2026-10-17","fields":[{"key":"trains_on_business_data_by_default","value":"No. Zoom does not use customer audio, video, chat, screen sharing, attachments or similar content to train Zoom's or third-party models","status":"verified","url":"https://library.zoom.com/ai/ai-whitepaper/data-governance-and-privacy","locator":"AI whitepaper, data governance","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"training_opt_out","value":"Nothing to switch off: Zoom does not use customer audio, video, chat, screen sharing, attachments or similar content to train its own or third-party AI models. Admins control whether users can attach extra context to AI feedback","status":"verified","url":"https://library.zoom.com/ai/ai-whitepaper/data-governance-and-privacy","locator":"Data use section and 'Administrators can control whether users share additional feedback context'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"eu_residency_option","value":"Not on Pro: Zoom's EU infrastructure (in-region storage and AI Companion processing) is for EU Education and Enterprise accounts","status":"verified","url":"https://media.zoom.com/download/assets/zoom-eu-infrastructure-fact-sheet.pdf/3d23251255a811f0bc811651fbd1a193","locator":"Fact sheet (April 2026), section II","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States by default for customer content; paid EU customers can route meeting traffic through EU data centres while content, account and diagnostic data stay in the US","status":"verified","url":"https://www.zoom.com/en/trust/gdpr/","locator":"GDPR page (updated 8 Aug 2024)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpa","value":"Yes. Zoom's Data Processing Addendum is incorporated into the Terms of Service for all customers","status":"verified","url":"https://www.zoom.com/en/trust/gdpr/","locator":"GDPR page (updated 8 Aug 2024)","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"subprocessor_list","value":"Public. 21 third parties plus Stripe for Events; AI: Anthropic (US), OpenAI (US, EU), Microsoft (many regions), AWS; latest change 2 Oct 2026; email sign-up","status":"verified","url":"https://www.zoom.com/en/trust/subprocessors/","locator":"Authorized sub-processors table and updates","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"dpf_status","value":"Active (Zoom; EU-US, Swiss-US, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'Zoom Communications'","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period: Zoom keeps content as long as needed for the uses in its Privacy Statement or as the law requires. Admins can disable and lock meeting transcripts so summaries are made without keeping a transcript; third-party AI providers keep nothing","status":"verified","url":"https://library.zoom.com/ai/ai-whitepaper/data-governance-and-privacy","locator":"Sections 'Data Retention' and 'Zero Data Retention for Meeting Summary'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"certifications","value":"ISO 27001, ISO 27017/27018, ISO 27701, SOC 2 Type 2 (also with HITRUST), CSA STAR Level 2, BSI C5, IRAP; PCI DSS for Zoom Phone and Contact Center; FedRAMP Moderate for the government offering","status":"verified","url":"https://www.zoom.com/en/trust/legal-compliance/","locator":"Compliance certifications list","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"admin_ai_controls","value":"Yes. Account owners and admins can enable or disable each AI feature for the whole account or for groups in the Admin Portal, and lock the settings","status":"verified","url":"https://library.zoom.com/ai/ai-whitepaper/administrative-controls","locator":"Section 'Account and Group Administrator Controls'","url2":"","checkedOn":"2026-10-17","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"EUR 13.33 per user/month billed annually, excl. VAT","status":"verified","url":"https://zoom.us/pricing?lang=de-DE","locator":"Workplace Pro card, Euros selected","url2":"","checkedOn":"2026-10-17","checkedFrom":"browser, Berlin (DE)","quote":""}]}]},{"slug":"zoominfo","name":"ZoomInfo Sales","vendor":"ZoomInfo Technologies LLC (Vancouver, USA)","category":"sales-marketing-and-support","plans":[{"id":"T504","plan":"Professional","tier":"business","price":{"label":"Quote only","amount":null,"currency":"none"},"canOptOut":false,"checkedOn":"2026-10-19","fields":[{"key":"trains_on_business_data_by_default","value":"Yes, per the privacy policy: its list of uses of collected information includes training LLMs and other AI models. The policy covers the website and services in general and does not say whether customer-entered content is included; the customer contract is not public.","status":"verified","url":"https://www.zoominfo.com/legal/privacy-policy","locator":"III. How We Use Information","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Fine-tune or train LLMs or other Artificial Intelligence models"},{"key":"training_opt_out","value":"Partly: for customer integration data (Contributory Network) an admin adjusts the Data Sharing settings in the ZoomInfo Admin Portal. No opt-out is stated for the general AI-training use.","status":"verified","url":"https://www.zoominfo.com/legal/privacy-policy","locator":"Contributory Network","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Customers who wish to manage or restrict ZoomInfo’s use of such information may do so by visiting the “Data Sharing” settings page"},{"key":"eu_residency_option","value":"Not stated; no EU storage option found.","status":"not_published","url":"https://www.zoominfo.com/legal/subprocessors","locator":"Looked in privacy policy, sub-processor list, trust centre pages, customer DPA","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"default_data_location","value":"United States: the sub-processor list shows Amazon Web Services and Google as hosting providers, both in the USA; the policy says data is processed and stored in the US and other countries.","status":"verified","url":"https://www.zoominfo.com/legal/subprocessors","locator":"List of Sub-Processors, Amazon Web Services","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Amazon Web Services, Inc. USA Cloud hosting and infrastructure provider"},{"key":"dpa","value":"Yes. ZoomInfo publishes a customer DPA (with SCCs and a UK addendum) that is incorporated into the software licence agreement.","status":"verified","url":"https://assets.ctfassets.net/kyld7105l6mt/4rCYqlkSI21FqkIqy9ayLo/ff1f0d216140f76e6f613bc942ce636c/DPA-ZoomInfo-C2P-SCCs-w_-UK-Addendum-April-23-25.docx.pdf","locator":"DPA preamble","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"This Data Processing Addendum (“DPA”) amends and is incorporated into the software license agreement"},{"key":"subprocessor_list","value":"Yes, public list at zoominfo.com/legal/subprocessors (updated 17 July 2026): 29 entries. AI providers listed: Anthropic, Google, OpenAI, Groq, LangChain and 1Mind AI.","status":"verified","url":"https://www.zoominfo.com/legal/subprocessors","locator":"ZoomInfo Sub-Processors","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"Anthropic, PBC USA Generative AI services"},{"key":"dpf_status","value":"Active (ZoomInfo; EU-US DPF, Swiss-US DPF, UK Extension)","status":"verified","url":"https://www.dataprivacyframework.gov/list","locator":"Search 'ZoomInfo Technologies'","url2":"","checkedOn":"2026-10-19","checkedFrom":"browser, Berlin (DE)","quote":""},{"key":"data_retention","value":"No fixed period for customer content in public documents; the DPA requires deletion or return of the data on termination at the customer's choice.","status":"verified","url":"https://assets.ctfassets.net/kyld7105l6mt/4rCYqlkSI21FqkIqy9ayLo/ff1f0d216140f76e6f613bc942ce636c/DPA-ZoomInfo-C2P-SCCs-w_-UK-Addendum-April-23-25.docx.pdf","locator":"DPA, SCC clause on termination of processing","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"the data importer shall, at the choice of the data exporter, delete all"},{"key":"certifications","value":"ISO 27001, ISO 27701, ISO 27017, ISO/IEC 42001 and SOC 2 Type II (5), plus TRUSTe Responsible AI certification.","status":"verified","url":"https://www.zoominfo.com/trust-center/security-at-zoominfo/","locator":"Certifications","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":"ZoomInfo holds ISO 27001, ISO 27701, ISO 27017, and ISO/IEC 42001:2023 certifications and has earned a comprehensive SOC 2 Type II attestation."},{"key":"admin_ai_controls","value":"Not stated; only an admin Data Sharing setting for integration data is described, no switch to turn AI features off.","status":"not_published","url":"https://www.zoominfo.com/legal/privacy-policy","locator":"Looked in privacy policy, trust centre pages, responsible AI page","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""},{"key":"price_eur","value":"Not published: the pricing page names ZoomInfo Professional, Copilot Advanced and Copilot Enterprise with no prices (free trial or sales contact).","status":"not_published","url":"https://www.zoominfo.com/pricing","locator":"Learn more about each package: ZoomInfo Professional","url2":"","checkedOn":"2026-10-19","checkedFrom":"server fetch (non-browser)","quote":""}]}]}]}