AI coding tools and app builders and the GDPR: 20 checked

Doesn't train on your data.

No by default for Teams. Training and dataset licensing do not apply to organisation-managed accounts unless the organisation's administrator has enabled them. Individual accounts outside the EEA/UK/Switzerland are opted in unless they opt out.

“or to organization-managed accounts except to the extent the organization’s administrator has enabled such uses”

Source: stackblitz.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do on Teams by default (excluded from training) as long as the administrator has not enabled it. Individual accounts opt out in account settings or by emailing privacy@stackblitz.com, free on every plan.

“you may opt out of the uses described in Sections 3.5(a) and 3.5(b) at any time, free of charge and regardless of your plan, through your account settings or by contacting privacy@stackblitz.com.”

Source: stackblitz.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'StackBlitz'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept while the account is active. After termination or suspension (not for cause) content can be exported for 30 days, after which it can be deleted. After voluntary closure it is deleted or anonymised within a 'reasonable period' (no number).

“we will make available a reasonable means to retrieve or export your content for thirty (30) days following the effective date of the termination or suspension”

Source: stackblitz.com · Checked on 19 October 2026

SOC 2 Type 2 (1 certification); the vendor also states GDPR and CCPA compliance.

“Bolt is SOC 2 Type 2 certified and compliant with GDPR and CCPA.”

Source: bolt.new · Checked on 19 October 2026

United States. Bubble's shared server environment (used on non-Enterprise plans) is hosted in the US on AWS, and the location cannot be changed.

“Bubble's shared server environment is hosted in the US, and we don't currently offer the possibility of changing that location.”

Source: manual.bubble.io · Checked on 19 October 2026

No EU hosting.

No, not on the Team plan. Only the Enterprise plan lets the customer choose the AWS region for hosting.

“on the other hand, lets you choose the AWS region where you want your app to be hosted”

Source: manual.bubble.io · Checked on 19 October 2026

DPA on request.

Yes, Bubble says it has Data Processing Agreements with customers that include EU standard contractual clauses. How a Team customer signs or obtains it is not described in readable pages.

“Bubble has implemented the SCCs into its DPAs with its customers and its processors”

Source: manual.bubble.io · Checked on 19 October 2026

On the list.

Active (Bubble Group, inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

SOC 2 Type II for security (1 certification), plus GDPR measures. The manual says Bubble was audited by Sensiba LLP; no ISO certification is named in the readable pages.

“Bubble is compliant with the SOC 2 Type II standard for security.”

Source: manual.bubble.io · Checked on 19 October 2026

Partly. The Bubble AI Agent follows each person's editor permissions, and reading app data is limited to owners and admins for the data types enabled in the Agent settings. No setting to switch the AI off for the whole team was found.

“is further limited to owners and admins, and only for the data types enabled in”

Source: manual.bubble.io · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes: the Terms of Service say that by using the AI services you authorise Hostinger to store and use your Input and Output, including for the training and development of machine learning models. No opt-out is described.

“you authorize Hostinger to store and use Input and Output for the purposes of providing you with the Services, to develop and improve the Services, including as part of the design, training and development process for machine learning models.”

Source: hostinger.com · Checked on 19 October 2026

DPA in the terms.

Yes: a Data Processing Addendum annexed to the Terms of Service covers Hostinger AI Builder as a Covered Service.

“and is annexed to and supplements our Terms of Service and any and all agreements governing”

Source: hostinger.com · Checked on 19 October 2026

Published.

Yes, inside the DPA (Appendix 3): 8 entries. AI providers: Anthropic Ireland, Limited and spectra tech, UAB (nexos.ai).

“AMAZON WEB SERVICES EMEA SARL Google Cloud EMEA”

Source: hostinger.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Hostinger International Limited, Larnaca, Cyprus)

“HOSTINGER INTERNATIONAL LIMITED, Cyprus private limited company, registered address 61 Lordou Vironos str., 6023”

Source: hostinger.com · Checked on 19 October 2026

Customer Data is deleted 30 days after the termination date; controls let you retrieve or delete data earlier. Retention of AI prompts is not stated.

“Deletion of Customer Data will take place thirty (30) days following Termination Date, subject to the terms of the particular”

Source: hostinger.com · Checked on 19 October 2026

Says it doesn't train on your data.

No, per the Codex pricing page: it says there is no training on business data by default. Only the pricing page was readable; the policy and business terms were blocked.

“No training on your business data by default.”

Source: developers.openai.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: the pricing page states business data is not used for training by default; no opt-out step is described.

“No training on your business data by default.”

Source: developers.openai.com · Checked on 19 October 2026

No EU hosting.

Not offered on Business per the Codex pricing page: 'Data retention and data residency controls' are listed under Enterprise & Edu (on top of Business), not on the Business card. Which regions Enterprise covers was not captured.

“Data retention and data residency controls”

Source: developers.openai.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'OpenAI'

Source: dataprivacyframework.gov · Checked on 19 October 2026

DPA in the terms.

Yes: the Shopify DPA supplements and is incorporated by reference into the Terms of Service, with an EEA/UK/Swiss appendix.

“This Shopify Data Processing Addendum ("DPA") supplements and is incorporated by reference into the Shopify Terms of Service, together with any terms applicable to”

Source: shopify.com · Checked on 19 October 2026

Published.

Yes: https://help.shopify.com/en/manual/your-account/privacy/subprocessors, 34 rows (20 Shopify entities, 14 third parties). AI providers: Anthropic, Applied Compute, Fireworks.ai, Groq, Microsoft, OpenAI.

“The Subprocessors used by Shopify for the performance of the Services under the Terms are listed below. To receive notifications”

Source: help.shopify.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Shopify International Limited, Dublin) for merchants outside the US, Canada and Asia-Pacific

“Shopify International Limited, a private company limited by shares incorporated in Ireland under registration”

Source: shopify.com · Checked on 19 October 2026

Store information is kept two years after closure or non-payment before deletion starts. Users can delete a Sidekick conversation and turn memory off per conversation; Sidekick recalls recent admin activity from about the last 12 hours.

“we retain store information for two years before we begin the deletion process. When”

Source: shopify.com · Checked on 19 October 2026

3 named: PCI DSS Level 1, SOC 2 Type II and SOC 3.

“Shopify has been issued SOC 2 Type II and SOC 3 reports”

Source: shopify.com · Checked on 19 October 2026

€79 / mo.

€79 per month for the Grow plan (shown with the 'Pay yearly' option; for small teams, up to 5 staff accounts). VAT is not stated.

“Grow €79/mo For small teams Start for free”

Source: shopify.com · Checked on 19 October 2026

EU hosting available.

Yes: the security page lists 'EU or US data residency' and says you can host your data in the EU (Germany). Which plans include it and how to select it is not stated.

“Host your data in the EU (Germany) or US. #### Encryption in transit & at rest Protect data both in transit with”

Source: softr.io · Checked on 19 October 2026

DPA on request.

Yes: a DPA with Softr Platforms GmbH is published as Appendix 1 to the terms and takes precedence over the Agreement.

“This Data Processing Agreement ("DPA") specifies the data protection obligations and rights of the parties in connection with the processing of personal data processed by Softr Platforms GmbH, Rosenthaler Str.”

Source: softr.io · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Softr Platforms GmbH, Berlin)

“Softr Platforms GmbH, Rosenthaler Str. 13, 10119 Berlin, Germany,”

Source: softr.io · Checked on 19 October 2026

After termination Softr keeps data for an 8-week grace period (you can request it), then deletes it; DPA 8.2 allows backup copies for 30 days after termination. Retention of AI inputs while active is not stated.

“Softr will delete the Customer Content including Customer Products and Customer's personal data in accordance with the arrangements in Appendix 1 after eight (8) weeks after the effectiveness of the termination (“Grace Period”) during”

Source: softr.io · Checked on 19 October 2026

SOC 2 Type II (report available on request through the Trust Center); GDPR compliance is also claimed. No ISO 27001 certificate is named on the security page.

“Access to our Trust Center containing our SOC 2 Type II report, Security Policies and Penetration Testing results are available on request. ### SOC”

Source: softr.io · Checked on 19 October 2026

United States servers: the privacy policy gives 'our servers in the US' as the example of where information is transferred. No hosting provider is named.

“such as, for example, to our servers in the US. We also”

Source: squarespace.com · Checked on 19 October 2026

DPA on request.

Yes: the Data Processing Addendum is part of the Agreement you accept by using the services (no signing needed).

“By using or accessing the Services, you're agreeing to these Terms, our Product Specific Terms, our Acceptable Use Policy and our Data Processing Addendum (collectively, this “Agreement”). If you're using”

Source: squarespace.com · Checked on 19 October 2026

Not public.

No public list: a list of current Sub-Processors is available on request by emailing privacy@squarespace.com. Its AI help article names OpenAI, Anthropic and Google as the AI software providers.

“A list of our current Sub-Processors is available upon request by sending an email to privacy@squarespace.com. Provided that your objection”

Source: squarespace.com · Checked on 19 October 2026

On the list.

Active (Squarespace, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: information is kept while the account is active and 'a reasonable period' after cancellation or trial expiry; you can delete your account yourself or by emailing privacy@squarespace.com.

“we may not immediately delete your information when your trial expires or you cancel all your paid Services. Instead, we keep your information for a reasonable period of time, so”

Source: squarespace.com · Checked on 19 October 2026

€24 / mo.

€24 per month and €18 per month are both shown for Core (the monthly and annual billing toggle); VAT treatment is not stated.

“Unlock our full array of business features as you grow your business. €24/mo €18/mo Get started→”

Source: squarespace.com · Checked on 19 October 2026