Data

ElevenLabs and the GDPR: AI training, data location and DPA

Creator: Trains on your data unless you switch it off. EU hosting only on higher plans · DPA on request.

Vendor: ElevenLabsPhone and voiceChecked on How we check

Verdict

Is ElevenLabs GDPR compliant?

Creator

Personal

Trains on your data unless you switch it off

EU hosting only on higher plans · DPA on request

Price: $22 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does ElevenLabs train on your data?

Trains on your data by default?

Checked

Trains on your data unless you switch it off.

Yes, unless the user opts out: ElevenLabs trains on non-Enterprise data by default; Enterprise customers' data is not used

Source: elevenlabs.ioHelp article on data useSecond source: elevenlabs.ioChecked on

Switch-off

How do you turn off AI training in ElevenLabs?

How to switch training off

Checked

You can switch the training off.

The user turns off 'Improve the models for everyone': profile icon > Terms and privacy > Data use. Only new data is excluded

Source: elevenlabs.ioSection 'How can I modify my data use settings?'Second source: elevenlabs.ioChecked on

Location

Where does ElevenLabs store your data?

Where data is stored by default

Checked

United States for storage per the privacy policy; the Trust Center adds that non-Enterprise data may be processed in the US, EU or Singapore for latency

Source: elevenlabs.ioSection 'International Data Transfers' ('transferred to the United States for storage')Second source: compliance.elevenlabs.ioChecked on

EU hosting on this plan

Checked

EU hosting only on higher plans.

Not on Creator: choosing a hosting location is an Enterprise option

Source: compliance.elevenlabs.ioLocation column ('Enterprise: US or Customer's Selected Hosting Location; Non-Enterprise: US, EU or Singapore')Checked on

Contract

Does ElevenLabs sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes for business use: the terms point to ElevenLabs' DPA (8 Apr 2026) for personal data in business clients' content, and sign-up with a company email may make the company the controller

Source: elevenlabs.ioTerms list of incorporated documents ('Our Data Processing Addendum, which governs…business clients')Second source: elevenlabs.ioChecked on

Processors

Who else handles ElevenLabs data?

Sub-processors (companies that handle the data for them)

Checked

32 listed.

Public. 32 entries; LLM services from Google, Anthropic, OpenAI, xAI, Fireworks and Databricks; media generation partners include ByteDance, Kling, Runway, Creatify, Fal and Sync; locations include the US, EU, Singapore, Indonesia and Malaysia

Source: compliance.elevenlabs.ioSubprocessors list ('32 results', all pages)Second source: elevenlabs.ioChecked on

EU–US Data Privacy Framework

Checked

On the list.

Active (ElevenLabs; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'ElevenLabs'Checked on

Retention

How long does ElevenLabs keep your data?

How long data is kept

Checked

No fixed period for self-serve content: ElevenLabs may delete it after 180 days of inactivity; voice-derived data is kept no longer than 3 years after the last interaction. Zero Retention Mode is offered (plan not stated)

Source: elevenlabs.ioSection 9.2.2 (Self-Serve Services)Second source: elevenlabs.ioChecked on

Security

Which certifications and admin controls does ElevenLabs have?

Security certifications

Checked

SOC 2 Type 2, SOC 3, ISO 27001, 27017, 27018, 27701 and 42001, PCI DSS 4.0.1 Level 1; HIPAA, GDPR and EU AI Act listed

Source: compliance.elevenlabs.ioCompliance section and documentsChecked on

Admin controls for AI

Checked

Not offered on Creator: it is a single-user plan; workspace and admin features come with higher plans

Source: elevenlabs.ioPlan cards (Creator is per user)Checked on

The vendor doesn't say: price.

Alternatives

ElevenLabs alternatives that don't train on your data

Other phone and voice tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Crisp

    Essentials · $95 / mo

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • RingCentral AI Receptionist

    standalone plan · $49 / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Synthflow

    Enterprise · $30,000 / yr

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • BOTfriends X

    See details

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓?✓

  • Parloa AI Agent Management Platform

    enterprise, consumption-based · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓?✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices