AI image generators, design and video tools and the GDPR: 26 checked

Doesn't train on your data.

No. Adobe says it does not analyse customer content to train generative AI models (unless content is submitted to Adobe Stock), and team and company profiles are automatically opted out of content analysis for product improvement

Source: helpx.adobe.com · Checked on 18 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to switch off: team and company profiles are automatically opted out of content analysis, and customer content is not used to train generative AI

Source: helpx.adobe.com · Checked on 18 October 2026

DPA on request.

Yes. Adobe publishes a Data Processing Addendum for business customers and offers a generator for a signed copy

Source: adobe.com · Checked on 18 October 2026

57 listed.

Public. 57 third-party entries across Adobe's cloud services, including 11 AI model providers used for Firefly and Creative Cloud (OpenAI, Google, Black Forest Labs, Runway, ElevenLabs, Luma AI, fal.ai, Topaz Labs; Kuaishou and BytePlus in Singapore; Humain in Saudi Arabia)

Source: adobe.com · Checked on 18 October 2026

On the list, under review.

Active, re-certification under review (Adobe Inc.; EU-US DPF, Swiss-US DPF, UK Extension; non-HR data)

Source: dataprivacyframework.gov · Checked on 18 October 2026

€86.55 / user / mo.

EUR 86.55 per licence/month excl. VAT, annual plan billed monthly

Source: adobe.com · Checked on 18 October 2026

Doesn't say whether it trains on your data.

Not stated for the vendor's own use. The security page says its AI sub-processors are barred from training on customer data and that data processed by its AI models will not train public LLMs.

“Your data remains private. Our AI sub- processors are barred from using customer data for training.”

Source: beautiful.ai · Checked on 19 October 2026

No training setting described. The security page says AI providers are barred from training on customer data; generative AI integrations can be disabled for a company account on request.

“Generative AI integrations can be disabled for your company’s account upon request.”

Source: beautiful.ai · Checked on 19 October 2026

United States: the vendor says it processes and stores information on servers in the US; Google Cloud hosting is named.

“We process and store information on servers located in the United States of America.”

Source: beautiful.ai · Checked on 19 October 2026

DPA on request.

Yes, on request: EU customers can request a Data Processing Addendum by emailing privacy@beautiful.ai; it is not click-through.

“if Customer is located in the European Union, Customer may request a Data Processing Addendum (“DPA”) from us by contacting Beautiful.ai at privacy@beautiful.ai.”

Source: beautiful.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Beautiful'

Source: dataprivacyframework.gov · Checked on 19 October 2026

AI providers keep data a maximum of 30 days to prevent abuse. On termination, presentation data is deleted no earlier than 14 days after the termination notice; customers must retrieve it themselves.

“Data will be retained for a maximum of 30 days to mitigate against abuse.”

Source: beautiful.ai · Checked on 19 October 2026

SOC 2 Type II; the page also lists GDPR, CCPA and PCI (PCI-DSS via Stripe). SOC 2 Type II is the only independent audit named.

“Certifications include: CCPA, PCI, SOC 2 Type II, and GDPR”

Source: beautiful.ai · Checked on 19 October 2026

Limited: the vendor can switch off generative AI integrations for the company account on request; no self-serve admin setting described.

“Generative AI integrations can be disabled for your company’s account upon request.”

Source: beautiful.ai · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes. The privacy policy says user content and other collected information is used to train and improve CapCut's machine learning models. No separate business terms were found for the Teams plan.

“to understand how you use the Services, and to improve and develop the Services, including to train and improve our technology, such as our machine learning models and algorithms.”

Source: capcut.com · Checked on 19 October 2026

No training-specific setting found. EEA/UK users can object to processing based on legitimate interests, which is the stated basis for training, via the Data Subject Request Webform.

“The right to object to processing if we are processing your personal data on the basis of our legitimate interest”

Source: capcut.com · Checked on 19 October 2026

Malaysia, Singapore and the United States (secure servers). No hosting provider is named.

“We store the information we collect in secure servers located in Malaysia, Singapore and the United States.”

Source: capcut.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Bytedance', 'CapCut'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: information is kept as long as necessary; cloud-space files you uploaded are deleted at your request. The Türkiye section cites five-year legal retention.

“The retention periods differ depending on the type of information and the purposes for which we use the information.”

Source: capcut.com · Checked on 19 October 2026

€14.99 / user / mo.

Teams: EUR 14.99 per seat per month, or EUR 120 per seat per year; shown with 2 seats. VAT treatment not shown; the page says displayed prices are for reference only.

“EUR14.99 /month per seat Renews automatically. Cancel anytime.”

Source: capcut.com · Checked on 19 October 2026

Doesn't train on your data.

No for uploaded images and voices: the policy says they are never used to train Magnific's or its AI providers' models. Text prompts and generated outputs fall under a service-improvement purpose (right to object); training on them is not mentioned. Pricing page: 'No model training on your data'.

“Under no circumstances will we use your images or voices, or those of third parties that you upload to our platform, to train or improve our artificial intelligence models or those of third-party providers.”

Source: magnific.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do for uploaded images and voices: the vendor states it never trains on them. For text prompts and outputs used for service improvement, the policy gives a right to object (data-protection contact rpd@magnific.com); no in-app switch is described.

“You have the right to object to this processing based on our legitimate interests.”

Source: magnific.com · Checked on 19 October 2026

DPA on request.

Yes, on request: Individual and Business plan users can ask for a DPA by emailing the data-protection address and giving account details.

“Users of Individual and Business, and plans who require the formalization of a Data Processing Agreement (DPA) may request it by sending a communication to rpd@magnific.com”

Source: magnific.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Magnific AI, S.L.U., Málaga, Spain)

“Magnific AI, S.L.U., with Tax ID B-93183366 and registered office at 13 Molina Lario Street, 5th floor, 29015 Málaga, Spain.”

Source: magnific.com · Checked on 19 October 2026

Uploaded images and audio are deleted immediately after generation. Prompts and outputs are kept for the life of the contract, then blocked for the legal limitation period. Model providers keep data up to 30 days.

“Images and audio files uploaded by the User are deleted immediately after the generation of the synthetic content based on them.”

Source: magnific.com · Checked on 19 October 2026

€27 / mo.

EUR 27 per month when billed annually (EUR 36 on monthly billing), prices exclude VAT. Premium+ on the Individual tab; the Teams tab was not readable.

“Best value For creatives who need unlimited generations and full AI access €36€27/monthBilled annually”

Source: freepik.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes, per the privacy policy: Ideogram may use the information it collects (section 2 covers prompts and uploaded images) for training the models that power its services. No exemption for the Team plan is stated.

“training the models that power our Services”

Source: ideogram.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Ideogram'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: the privacy policy says information is kept as long as reasonably necessary for its purposes. You may have a right to ask Ideogram to delete personal information it holds about you.

“We retain your information for as long as is reasonably necessary for the purposes”

Source: ideogram.ai · Checked on 19 October 2026

United States: Kapwing says the service is provided from the US, and its sub-processor list shows MongoDB and Google Cloud (video storage), both in the USA.

“If you are located outside of the United States, you also consent to the transfer, storage, and processing of your information in and out of the United States.”

Source: kapwing.com · Checked on 19 October 2026

Published.

Yes, public at https://www.kapwing.com/help/kapwing-data-subprocessors/ (last updated May 26, 2026): 25 entries. AI providers include OpenAI, Google Cloud, ElevenLabs, DeepL, Perplexity, Pika, BytePlus, MiniMax Hailuo, Replicate, AssemblyAI.

“A sub-processor is a third-party service provider who have, or potentially will have, access to or process personal data that Kapwing processes for Kapwing Users.”

Source: kapwing.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Kapwing'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Deleted projects and workspaces are removed from view at once and from Kapwing's servers within 7 days; account deletion is immediate. Paid plans keep project files for the length of the subscription (free plan 3 days).

“It will be permanently removed from viewing and public access immediately and removed from our servers within 7 days.”

Source: kapwing.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Midjourney'

Source: dataprivacyframework.gov · Checked on 17 October 2026

You can switch the training off.

EU/EEA users only: email contact@opus.pro with the subject 'AI R&D – Opt-Out' and the account email, and OpusClip opts the data out of AI research and model development. No in-app setting is described.

“Under Article 21 GDPR, you may object at any time to such processing. Send an e-mail to contact@opus.pro with the subject line”

Source: opus.pro · Checked on 19 October 2026

United States: OpusClip runs on Google Cloud servers located in the United States.

“OpusClip runs on secure Google Cloud servers located in the United States.”

Source: opus.pro · Checked on 19 October 2026

No EU hosting.

Not offered; data is stored in the United States and EU data is transferred there under standard contractual clauses. No EU storage option is described.

“If you normally reside in the European Region, the personal data that we collect from you will be further transferred to, and stored at, a destination outside of the EEA”

Source: opus.pro · Checked on 19 October 2026

On the list.

Active (OpusClip; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: profile data is kept while the account exists, other data as long as necessary. Closing an account can destroy its content, and the Terms warn it cannot always be fully removed from records.

“Account termination may result in destruction of any Content associated with your account, so keep that in mind before you decide to terminate your account.”

Source: opus.pro · Checked on 19 October 2026

2: SOC 2 Type 2 (report on request) and SOC 3; GDPR compliance is also listed on the Trust Center.

“## Compliance ### SOC 2 Type 2 Request ### SOC 3 ### GDPR”

Source: trust.opus.pro · Checked on 19 October 2026

Doesn't train on your data.

No. Pictory states it will not use customer content or generated videos to train or fine-tune its general AI or machine-learning models unless the customer agrees in writing.

“Pictory will not use your Customer Content or Pictoried Content to train or fine-tune its general artificial intelligence or machine learning models, except as expressly agreed by you in writing.”

Source: pictory.ai · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: Pictory states it will not train on customer content unless the customer agrees in writing.

“Pictory will not use your Customer Content or Pictoried Content to train or fine-tune its general artificial intelligence or machine learning models, except as expressly agreed by you in writing.”

Source: pictory.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Pictory'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: personal information is kept as long as needed or required by law. Customers can delete their content, but the Terms warn that some copies can remain on the service.

“We will retain your personal information for as long as needed for the purposes described above and/or as required by law.”

Source: pictory.ai · Checked on 19 October 2026

2: SOC 2 and ISO 27001, both shown as 'Compliant' on the Trust Center (SOC 2 type not stated).

“Details ### SOC 2 Compliant ### ISO 27001 Compliant”

Source: pictory-corp.trust.site · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes. The Terms say Pika uses anonymized or aggregated content, including prompts and outputs, to train its models unless a separate written agreement says otherwise.

“Unless otherwise agreed in writing, you acknowledge that Pika may use anonymized or aggregated Content, including Inputs, Outputs, and your interactions with the Service”

Source: pika.art · Checked on 19 October 2026

No self-serve opt-out found. The Terms say enterprise customers with a separate written agreement get their own data-use and training terms.

“If you are an enterprise customer with a separate written agreement, the terms of that agreement will govern data use and training.”

Source: pika.art · Checked on 19 October 2026

United States: Pika says the service is operated from the US and that EEA, Swiss and UK data is transferred to the US. No hosting provider or region is named.

“The Service is operated from the United States and might not be available or appropriate in all jurisdictions.”

Source: pika.art · Checked on 19 October 2026

DPA on request.

Yes, on request: customers in a jurisdiction that requires one (such as GDPR) can ask Pika for a Data Processing Agreement, which is then incorporated into the Terms.

“you may request that Pika enter into a Data Processing Agreement, which will be incorporated by reference into these terms of service.”

Source: pika.art · Checked on 19 October 2026

Not listed.

No listing found for search term 'Mellis', 'Pika'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period for prompts or content: kept only as long as necessary, and storage limits and retention periods vary by plan. Biometric data is kept at most three years after account deletion. Deleting personal data requires deleting the account.

“we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for as set forth in this privacy policy”

Source: pika.art · Checked on 19 October 2026

Trains on your data unless you switch it off.

Yes: all created visuals (thumbnails) and uploaded images are included in AI training by default unless you opt out by email. The Terms also give Piktochart a broad licence to use Your Content 'for any purpose'.

“By default, all Content you create and/or upload to Piktochart is automatically included in our AI training program.”

Source: piktochart.com · Checked on 19 October 2026

You can switch the training off.

Email ai-privacy @ piktochart.com to opt out. It applies to future training only; content already used may stay in trained models.

“You can opt-out of this program at any time by emailing ai-privacy @ piktochart.com.”

Source: piktochart.com · Checked on 19 October 2026

Not public.

No separate list; the privacy policy has a third-party table: 21 rows, 17 companies. AI providers: Google and Replicate.

“We use third-party services to help us provide some of our services (e.g., web hosting, data storage, communication, customer support, payment, maintenance, development and analysis, etc.).”

Source: piktochart.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Piktochart'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period for content; erasure on request (not absolute). Temporary image-processing files in Google Cloud Storage are removed within 48 hours.

“Data in Cloud Storage is automatically removed within 48 hours.”

Source: piktochart.com · Checked on 19 October 2026

Ireland: Pitch is hosted on Amazon Web Services in the eu-west-1 region.

“The servers where Pitch's data is stored are located in Ireland (eu-west-1 region).”

Source: pitch.com · Checked on 19 October 2026

EU hosting not documented.

Data is stored in the EU (Ireland) by default; no separate setting is needed. The DPA says processing happens inside the EU/EEA in principle, with other locations only after prior notice.

“The processing of Customer Data by the Processor shall in principle take place inside the European Union or another contracting state of the European Economic Area (EEA).”

Source: pitch.com · Checked on 19 October 2026

DPA on request.

Yes: a DPA is published at pitch.com/dpa, with a pre-signed PDF version customers download and sign.

“If you are a business customer of Pitch, you can find our Data Processing Agreement here. Download our pre-signed PDF version and sign it.”

Source: pitch.com · Checked on 19 October 2026

Published.

Yes: published in the DPA (Annex 7.2, Further Processors). 13 entries, including OpenAI OpCo, LLC, Anthropic PBC and fal (Features & Labels Inc.) as AI providers.

“Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA API platform for accessing Large Language Model Claude”

Source: pitch.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Pitch Software GmbH, Berlin).

“Data controller is Pitch Software GmbH, Joachimstraße 7, 10119 Berlin/Germany”

Source: pitch.com · Checked on 19 October 2026

Account data is usually deleted 3 years after last activity or after the account is deleted; on contract end the customer chooses deletion or return of data (DPA). Database backups are kept up to 30 days.

“Subject to legal retention periods, we usually delete your data 3 years after the last user activity respectively after you have deleted your user account.”

Source: pitch.com · Checked on 19 October 2026

€20 / user / mo.

€20 per month per seat when paying yearly (Business plan, 1-200 seats); Team plan is €15.

“€20 month(paying yearly) For larger teams delivering winning presentations at scale”

Source: pitch.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes for AI chats: Prezi may keep AI chat content, anonymized or aggregated, to improve its AI models. Content marked Public is also used for training. Business Terms allow analysing customer content for quality and improvement.

“Prezi may retain the content of your AI chat sessions — in anonymized or aggregated form — for the purpose of further refining, enhancing, and improving its AI models”

Source: prezi.com · Checked on 19 October 2026

DPA in the terms.

Yes: a Prezi/Infogram Data Processing Agreement is published and is a condition of the engagement; it incorporates the EU Standard Contractual Clauses (Annex D).

“Partner / Customer's engagement with Prezi Inc. / Infogram is conditioned upon the agreement to this DPA.”

Source: prezi.com · Checked on 19 October 2026

Published.

Yes: https://prezi.com/legal/subprocessors/ lists 22 companies. No AI provider is listed, although the AI terms name OpenAI, LLC (United States) as an AI partner.

“Authorized Subprocessors Company Country Purpose Adyen Netherlands Payment Provider Amazon Web Services (AWS) United States Hosting Provider”

Source: prezi.com · Checked on 19 October 2026

On the list.

Active (Prezi Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Not fixed. DPA: on termination Prezi returns or destroys the personal data at the customer's choice and keeps only what law requires. No period for AI chat content.

“at the choice of Partner / Customer, return all the Partner / Customer Personal Data and copies of such data to Partner / Customer or securely destroy the data.”

Source: prezi.com · Checked on 19 October 2026

One: a SOC 2 Type 2 report on Security, available to Prezi Business subscribers who sign an NDA.

“We’ve successfully undergone an independent, external, third-party audit and obtained a SOC 2 Type 2 report on Security for Prezi.”

Source: prezi.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes. The Terms of Use let Runway use prompts and generated outputs to train and improve its AI models and describe no opt-out. The 'no training on your data' line is listed only under the Enterprise plan.

“You acknowledge that Inputs and Outputs may be used by the Company to train and improve its AI models, algorithms and related technology, products and services”

Source: runwayml.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Runway AI'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period for prompts or content: information is kept only as long as necessary. Face scans and voiceprints are kept up to three years after last interaction. No customer-set period is described.

“We will retain your information for only as long as necessary to provide the Service and for the other legitimate business purposes set out in this Policy such as safety, security, compliance, and dispute resolution.”

Source: runwayml.com · Checked on 19 October 2026

2: SOC 2 Type II and ISO/IEC 27001. Reports and certificate are available to Enterprise customers via the Trust Center.

“Runway maintains SOC 2 Type II certification, validating our security controls through rigorous independent auditing.”

Source: runwayml.com · Checked on 19 October 2026

Not offered on Team: the Team page lists roles, sharing policies and control over which third-party models a team can use as Enterprise features.

“Enterprise is the next step once you outgrow nine seats or one workspace, or need security and admin controls like SSO, roles and permissions, sharing policies and control over which third-party models your team can use.”

Source: runway.com · Checked on 19 October 2026

United States: files are stored on Amazon Web Services in the US.

“Your personal information and files are stored on our servers on Amazon Web Services in the US.”

Source: visme.co · Checked on 19 October 2026

Not listed.

No listing found for search term 'Visme', 'Easy WebContent'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept until you request deletion; you can delete your account in Account Settings. No fixed period.

“Personal data that we process for any purpose or purposes shall be kept until such time as we receive a request for deletion from you.”

Source: visme.co · Checked on 19 October 2026