Bluedot and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The terms say Bluedot does not use customer content to train or improve AI models, and its vendors may not either.

Vendor's wording: “Bluedot does not use Customer Content to train or improve artificial intelligence models. Our vendors and service providers are not permitted to use Customer Content for their own model training or product improvement.”

Source: bluedothq.com4. Customer Content, Ownership, and AI ProcessingChecked on 19 October 2026

European Union by default (hosted on AWS); US storage available on request under an agreed arrangement.

Vendor's wording: “Customer Content is stored and processed in the European Union by default. Customers may request storage and processing in the United States, subject to an agreed arrangement with Bluedot.”

Source: bluedothq.com9.1 Customer ContentChecked on 19 October 2026

EU hosting available.

Yes, EU is the default for customer content; no setting needed. EU data residency is also listed in the security FAQ.

Vendor's wording: “Customer Content is stored and processed in the European Union by default.”

Source: bluedothq.com9.1 Customer ContentChecked on 19 October 2026

DPA not stated.

A Data Processing Agreement is offered (security page FAQ); how it is concluded (signed, click-through) is not described.

Vendor's wording: “We offer a Data Processing Agreement, support EU data residency, and apply privacy-first controls across our product and infrastructure.”

Source: bluedothq.comFAQs: Is Bluedot GDPR compliant?Checked on 19 October 2026

Not listed.

No listing found for search term 'Bluedot'

Source: dataprivacyframework.govSearch 'Bluedot' returned 'Query returned no results'Checked on 19 October 2026

Kept as long as it stays in your account. After you delete content or cancel, it is removed from active systems and may sit in backups for up to 30 days, then is permanently deleted. Export what you need first.

Vendor's wording: “It may remain in internal backups for up to 30 days for operational and disaster recovery purposes After this period, Customer Content is permanently deleted.”

Source: bluedothq.com6. Data Retention and BackupsChecked on 20 October 2026

SOC 2 Type II (1 certification named). GDPR-aligned controls are claimed but are not a certification.

Vendor's wording: “Bluedot maintains independently audited controls for security, availability, and confidentiality under the SOC 2 Type II framework.”

Source: bluedothq.comSOC 2 Type IIChecked on 19 October 2026