Chatbase and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The privacy policy says Chatbase does not use your data to train AI models and uses retrieval (RAG) instead.

Vendor's wording: “No AI Training: We do not use your data to train AI models. We use Retrieval-Augmented Generation (RAG) to generate responses without compromising your data.”

Source: chatbase.coSecurity section, 'No AI Training'Second source: chatbase.coChecked on 19 October 2026

United States: AWS us-east-1, with Supabase and Vercel named as providers.

Vendor's wording: “Our database and application run on AWS infrastructure (us-east-1), managed by reputable providers such as Supabase and Vercel.”

Source: chatbase.coSecurity section, 'Infrastructure Security'Checked on 19 October 2026

DPA in the terms.

Yes. The DPA supplements the Terms of Service and includes EU Standard Contractual Clauses by reference; no signature step is described.

Vendor's wording: “This Data Processing Addendum (“DPA”) supplements the Terms of Service (the “Agreement”) entered into by and between Customer”

Source: chatbase.coPreambleChecked on 19 October 2026

Not listed.

No listing found for search term 'Chatbase'

Source: dataprivacyframework.govSearch 'Chatbase' returned 'Query returned no results'Checked on 19 October 2026

Customer data is deleted within 30 days of a written deletion request or end of the agreement, backups included; return instead of deletion is possible. Retention while the account is active is not stated.

Vendor's wording: “Company shall delete Customer’s Personal Data within thirty (30) days of Company’s receipt of Customer’s written deletion request or termination of the Agreement, whichever occurs first.”

Source: chatbase.coSection 2.4 / Annex II, limited data retentionChecked on 19 October 2026

1 named certification: SOC 2 Type II. Also claims GDPR compliance and HIPAA-eligible Enterprise workspaces (no ISO 27001 named).

Vendor's wording: “Chatbase is SOC 2 Type II compliant, supports GDPR requirements, and provides HIPAA-eligible Enterprise workspaces.”

Source: chatbase.coEnterprise security and privacy sectionChecked on 19 October 2026