Which AI assistant is GDPR compliant? 34 assistants checked

Doesn't train on your data.

No. Brave says it does not use Leo conversations for model training (free Leo; Brave has no business plan).

“We do not use your conversations for model training.”

Source: brave.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: Brave states it does not use Leo conversations for model training.

“Your conversations are not persisted for model training.”

Source: brave.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Brave Software'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Prompts and responses are not stored on Brave's servers (large prompts can be cached for a few minutes). Chat history stays on the device; it can be turned off or deleted at brave://settings/leo-ai.

“We don’t store or retain prompts, responses, context, or personal data on our servers.”

Source: brave.com · Checked on 19 October 2026

Free.

Free, no account needed. Leo Premium is a separate paid subscription for individuals; its price is not shown on the Leo page.

“No account or signup is required to access the free Brave Leo experience.”

Source: brave.com · Checked on 19 October 2026

Trains on your data in part.

Vendor statement only: the security page says it does not train on your data. The Terms do not mention training and grant a broad licence to use content to operate and improve services.

“We value your trust, ensuring our models are trained without utilizing your individual data.”

Source: copy.ai · Checked on 19 October 2026

Nothing to do according to the vendor, which says it does not train on your data. No setting or email is described.

“We value your trust, ensuring our models are trained without utilizing your individual data.”

Source: copy.ai · Checked on 19 October 2026

United States and European Union, no per-customer region stated.

“We use cloud-based services to store and process data in the United States and European Union and will store data at additional sites, at our discretion”

Source: copy.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'CopyAI'

Source: dataprivacyframework.gov · Checked on 19 October 2026

SOC 2 (1 named; report available on request, type not stated). No ISO certificate named.

“Request our complete SOC 2 report, or speak with our sales team to learn more about the security and reliability of the Copy.ai Platform.”

Source: copy.ai · Checked on 19 October 2026

Doesn't train on your data.

No. Felo states that user content (prompts, uploaded files, answers) is not used as training data for the service's AI models unless the customer gives explicit consent.

“コミュニケーション情報:当社とコミュニケーションを取る場合、お客様の送信内容に含まれるお名前、連絡先情報、送信されたメッセージの内容など なお、上記のユーザーコンテンツは、お客様の明示的な同意がある場合を除き、本サービスのAIモデルの学習データとして利用いたしません。 ## 2. 個人情報の管理について”

Source: felo.ai · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do by default: user content is not used for training unless the customer explicitly consents. No opt-out setting is described.

“コミュニケーション情報:当社とコミュニケーションを取る場合、お客様の送信内容に含まれるお名前、連絡先情報、送信されたメッセージの内容など なお、上記のユーザーコンテンツは、お客様の明示的な同意がある場合を除き、本サービスのAIモデルの学習データとして利用いたしません。 ## 2. 個人情報の管理について”

Source: felo.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Felo'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Says it doesn't train on your data.

No. Google says prompts, outputs and training data in the Business, Standard and Plus editions are not used to train Google models or models for any other customer.

“Your data—including prompts, outputs, and training—aren’t used to train Google models or models for any other customer”

Source: cloud.google.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: Google states the Business edition does not train on customer data, and no setting is described.

“Your data—including prompts, outputs, and training—aren’t used to train Google models or models for any other customer”

Source: cloud.google.com · Checked on 19 October 2026

Published.

Yes: Google Cloud Platform Subprocessors list at cloud.google.com/terms/subprocessors. Counted 37 third-party rows (support, labeling and hosting firms) and 73 Google group rows. No external AI model providers appear. List covers all Cloud services, not Gemini Enterprise alone.

“Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.”

Source: cloud.google.com · Checked on 19 October 2026

On the list.

Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

7 named: ISO 27001, ISO 27017, ISO 27018, PCI DSS, and SOC 1, SOC 2 and SOC 3 reports, plus penetration testing; Gemini Enterprise (including Agentspace) is marked in scope for all of them.

“The following Services fall within the scope of one or more of: Google's ISO 27001 Certification, ISO 27017 Certification, ISO 27018 Certification, PCI DSS Certification, SOC 1 Report, SOC 2 Report and SOC 3 Report and Penetration Testing Report.”

Source: cloud.google.com · Checked on 19 October 2026

Limited. Admins can add or remove team members, control which connectors teams can use, enable or disable chat sharing, and manage billing. No switch to turn AI features off is described for the Business edition.

“Admins can add or remove team members, control team access to connectors, enable or disable chat sharing, and manage billing.”

Source: cloud.google.com · Checked on 19 October 2026

Microsoft Azure; the policy also says data can be stored and processed in the United States. No specific Azure region is named.

“Your data will be stored on Microsoft Azure in accordance with its applicable policies and requirements”

Source: genspark.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'MainFunc', 'Genspark'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Account data is kept while the account is active; after closing the account it is deleted from servers within 30 days. Users can also request deletion.

“If you close your account, we will delete your account data from our servers within 30 days.”

Source: genspark.ai · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (Norwegian vendor, Opera Norway AS, Oslo)

“Opera browsers are developed and published by Opera Norway AS, a company registered under the laws of Norway.”

Source: opera.com · Checked on 19 October 2026

Chats are kept on Opera servers (encrypted) and deleted after 365 days if logged in, or 30 days if not logged in. Users can delete chats at any time.

“The aforementioned data is stored, fully encrypted, on Opera’s servers, and will be automatically deleted after 365 days if you use AI Chat while logged into your Opera Account.”

Source: opera.com · Checked on 19 October 2026

Free.

Free, no login or sign-up needed. No paid plan is shown.

“Support your ideas with Opera browser’s free and accountless AI.”

Source: opera.com · Checked on 19 October 2026

Trains on your data in part.

Depends on the bot: official Poe bots and prompt bots on OpenAI, Anthropic, Google or Meta models do not train on chats; third-party developer bots and apps may train on them. Poe's privacy policy adds that model providers receive chats to improve their services.

“Official Poe bots and user-created prompt bots using Open AI, Anthropic, Google, and Meta’s AI models do not train on your chats”

Source: poe.com · Checked on 19 October 2026

No account-wide switch found. Check each bot's privacy shield icon: fully shaded bots are not used by AI providers for training; half-shaded third-party developer bots can use chats for training.

“Your interactions with the bot or app will not be used by AI model providers for training purposes.”

Source: poe.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Quora'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Deleting chats or the account removes them from Poe's systems; memory summaries can persist until deleted in settings. Model providers set their own retention (Poe cites OpenAI and Anthropic at 30 days). No Poe retention period stated.

“Each provider sets their own retention schedule (e.g. OpenAI and Anthropic retain your chats for 30 days).”

Source: poe.com · Checked on 19 October 2026

Doesn't train on your data.

No. Venice.ai agrees not to use user content to train models and to require its third-party LLM providers not to.

“Venice.ai agrees that it shall not use, and shall require that third-party large language model providers”

Source: venice.ai · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: the terms state Venice.ai does not train on user content and requires its LLM providers not to.

“Venice.ai agrees that it shall not use, and shall require that third-party large language model providers”

Source: venice.ai · Checked on 19 October 2026

United States. Venice says the service is hosted in the U.S. and EU users' data is processed and stored there; chat history stays on the user's device.

“The Service is hosted in the United States (“U.S.”).”

Source: venice.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Venice.ai'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Venice says it does not store prompt or output content; chat history stays on the user's device. Generated videos are kept until downloaded. Venice says its model providers may not retain prompts beyond processing, though its privacy page says some providers apply their own retention.

“we will not have access to or store the content of your Prompts or Outputs”

Source: venice.ai · Checked on 19 October 2026