Coda / Superhuman Docs and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless the user opts out. The plans page lists Model training as 'Opt out' for Free, Pro and Business and 'Off by default' for Enterprise. The privacy policy says the choice is a training control in account settings.

Vendor's wording: “Model training Opt out Opt out Opt out Off by default”

Source: superhuman.comPlans and features, Privacy: Model training row (columns Free, Pro, Business, Enterprise)Second source: coda.ioChecked on 19 October 2026

You can switch the training off.

Turn off the AI training control in account settings (the policy gives no menu path). The plans page lists model training as 'Opt out' for Business, i.e. on until switched off; whether an admin can set it for the whole organisation is not stated for Docs.

Vendor's wording: “AI training control. As described above, you can decide whether Superhuman can use your user content to train our AI models”

Source: coda.ioPrivacy Policy, 'Your Rights and Choices'Checked on 19 October 2026

Hosted on Amazon Web Services; the DPA allows processing in the United States and other places where Superhuman and its sub-processors operate. No region is named.

Vendor's wording: “Docs is hosted on Amazon Web Services (AWS). Encryption key management is provided through AWS Key Management Service (KMS).”

Source: coda.ioDPA Exhibit B, hosting paragraphChecked on 19 October 2026

DPA in the terms.

Yes. A Data Privacy Addendum is part of the agreement between the customer and Superhuman and takes precedence over the main terms.

Vendor's wording: “is incorporated into and subject to the terms and conditions of the current version of any agreements”

Source: coda.ioData Privacy Addendum, opening paragraphChecked on 19 October 2026

Published.

Yes, public at https://coda.io/trust/subprocessor: 20 third-party sub-processors plus 8 Superhuman group companies. AI providers listed: Anthropic, Azure, Baseten, OpenAI.

Vendor's wording: “Superhuman Platform (including products offered as “Grammarly”, “Coda”, “Superhuman Go”, and “Superhuman Mail”) engages certain third-party vendors”

Source: coda.ioSuperhuman Subprocessors, Third-party Sub-processorsChecked on 19 October 2026

On the list.

Active (Superhuman Platform Inc. (formerly Grammarly, Inc.); EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Superhuman Platform'Checked on 19 October 2026

Deleted documents stay in primary storage 7 days for recovery, then are removed; they remain in backups for another 35 days before being purged (unless the account holder directs otherwise).

Vendor's wording: “documents are retained in primary storage for seven (7) days to allow for recovery, then permanently removed from primary storage”

Source: coda.ioDPA Exhibit B, hosting paragraphChecked on 19 October 2026

5 named: ISO 27001, ISO 27017, ISO 27018, SOC 2 Type 2 (enterprise customers only) and SOC 3. HIPAA, GDPR and CCPA are listed as compliance programmes.

Vendor's wording: “SOC 2 Type 2 (Type Ⅱ) Trust Services Principles Available for enterprise customers”

Source: coda.ioTrust centre, Security, ComplianceChecked on 19 October 2026

€33 / user / mo.

EUR 33 per member/month billed annually (EUR 40 billed monthly) for the Superhuman Business plan, which bundles Mail, Grammarly, Docs and Go; VAT not shown.

Vendor's wording: “per member / month, billed annually €40 when billed monthly”

Source: superhuman.comPlans page, Business cardChecked on 19 October 2026