Crisp and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Crisp does not use customer data, AI inputs or AI outputs to train or fine-tune its AI models unless agreed in writing.

Vendor's wording: “Except as expressly agreed in writing, Crisp does not use Customer Data, AI Inputs, or AI Outputs to train or fine-tune the Crisp's artificial intelligence models.”

Source: crisp.chatAI terms, Crisp Data accessSecond source: crisp.chatChecked on 19 October 2026

EU: main servers in the Netherlands and Germany (DigitalOcean), encrypted backups in Ireland (AWS), AI features on Crisp's own infrastructure at Scaleway in France.

Vendor's wording: “Crisp's AI features run on Crisp's own in-house AI infrastructure, hosted in the EU (Scaleway)”

Source: crisp.chatSub-processor tableSecond source: crisp.chatChecked on 19 October 2026

Data in the EU by default.

EU hosting is the default for all plans; no setting needed. Optional third-party AI providers (OpenAI, Gemini, Anthropic) process in the US if you switch them on.

Vendor's wording: “The third-party LLM providers listed below are entirely optional: they are disabled by default and used only when explicitly enabled by the Customer.”

Source: crisp.chatSub-processor table notesChecked on 19 October 2026

DPA in the terms.

Yes. The Data Processing Agreement is part of the Agreement (the general terms) and can be downloaded from inside the Crisp account.

Vendor's wording: “and the Data Processing Agreement ("DPA") and its Annexes.”

Source: crisp.chatSection 1 AgreementSecond source: crisp.chatChecked on 19 October 2026

15 listed.

Public list at https://crisp.chat/en/sub-processors/ (updated 15 July 2026): 13 entries. AI and model providers: OpenAI, Gemini, Anthropic, Mistral (all optional, off by default), Microsoft Azure (optional translation and AI processing), Crisp's own AI on Scaleway.

Vendor's wording: “Crisp is based in France and makes use of the following sub-Processors:”

Source: crisp.chatPage bodyChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Crisp IM SAS, Nantes, France)

Vendor's wording: “CRISP IM SAS 2 Boulevard de Launay 44100 Nantes, France”

Source: crisp.chatContact blockChecked on 19 October 2026

Essentials keeps data without a time limit while the workspace exists. Deleting a workspace irreversibly deletes all its data; Crisp deletes account and customer data on request; accounts inactive for 12 months get a deletion notice. System logs are kept up to 1 year.

Vendor's wording: “We delete your account and all related customer data upon your request.”

Source: crisp.chatHow long do we retain your dataSecond source: crisp.chatChecked on 19 October 2026

Yes in practice: Hugo AI is enabled per workspace, and third-party LLM providers are disabled by default and only used when the customer enables them.

Vendor's wording: “they are disabled by default and used only when explicitly enabled by the Customer.”

Source: crisp.chatSub-processor table notesSecond source: crisp.chatChecked on 19 October 2026