folk and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. folk states its AI features never train large language models on your data.

Vendor's wording: “Never used for training. Your data is not used to train any large language models (LLMs).”

Source: help.folk.appHow your data is handledChecked on 19 October 2026

Ireland, European Union (Amazon Web Services).

Vendor's wording: “folk's platform servers are located in Ireland, within the European Union, as specified in Article 9 of our Data Processing Agreement.”

Source: help.folk.appData hosting & international transfersChecked on 19 October 2026

EU hosting available.

Yes, by default: platform servers are in Ireland and there is no separate setting. Some sub-processors (e.g. OpenAI, Apollo) are in the US, so not all processing stays in the EU.

Vendor's wording: “While our platform servers are located in Ireland, some of our authorized sub-processors operate outside the European Union, including in the United States.”

Source: help.folk.appInternational data transfersChecked on 19 October 2026

DPA on request.

Yes. folk has a Data Processing Agreement defining its responsibilities as processor (hosting in Ireland is set in its Article 9, sub-processors in Appendix 2). How it is signed is not described.

Vendor's wording: “Our Data Processing Agreement defines our respective responsibilities when processing personal data.”

Source: help.folk.appGDPR complianceChecked on 19 October 2026

Published.

Yes. The privacy policy has a table of 26 processors with region and opt-out flag; the full list is in DPA Appendix 2. AI/model providers in the table: OpenAI (USA), Perplexity (USA), ElevenLabs (USA); enrichment: Apollo, Datagma, People Data Labs, Prospeo, DropContact.

Vendor's wording: “The recipients of Personal Data are the following: Processor Type of data Reason Region Can opt out TurboPuffer Contact data Search EU No”

Source: folk.app5. Recipient of Personal Data (processor table)Checked on 19 October 2026

Not listed.

No listing found for search term 'Folk'

Source: dataprivacyframework.govSearch 'Folk' returned 'Query returned no results'Checked on 19 October 2026

Account data kept while active. After a deletion request: removed from databases within 7 days, from backups within 730 days, from logs within 930 days. Call transcripts (if enabled) are kept indefinitely; call audio is not kept.

Vendor's wording: “from Our databases within 7 days after the deletion request date; from Our database backups within 730 days after the deletion request date;”

Source: folk.app8. Data retention, security, and deletionChecked on 19 October 2026

2 named: SOC 2 Type 1 completed (Type 2 in progress, report under NDA) and an annual CASA security assessment through Google's App Defense Alliance. Internal benchmarks (PCI DSS, AWS) are not certifications.

Vendor's wording: “folk has completed its SOC 2 Type 1 audit and is pursuing SOC 2 Type 2.”

Source: help.folk.appCertifications & complianceChecked on 19 October 2026

Yes: folk says every AI feature can be turned off and enrichment providers like Perplexity can be disabled in settings. Who may do it (admin or user) is not stated.

Vendor's wording: “Every AI feature can be turned off.”

Source: help.folk.appAI features & your dataChecked on 19 October 2026

€22 / user / mo.

€22 per member/month billed yearly (€27 billed monthly) for Standard; VAT treatment not shown.

Vendor's wording: “Standard Popular $24 22€/member/month $288 259€ billed yearly”

Source: folk.appStandard plan cardChecked on 19 October 2026