Grok and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless the user opts out: SpaceXSI may use prompts, searches, uploads and Grok's responses to train its models; Private Chat is excluded

Source: x.aiFAQ 'Does SpaceXSI use my content for model training?'Second source: x.aiChecked on 17 October 2026

Doesn't train on your data.

No. Grok Business lists 'No training', and SpaceXSI says it does not use business data, prompts or outputs to train its models

Source: x.aiPricing card feature list ('No training')Second source: x.aiChecked on 17 October 2026

You can switch the training off.

The user deselects 'Improve the model': on grok.com under Settings > Data, in the app under Settings > Data Controls. Only new conversations are affected; Private Chat (ghost icon) is never used for training. Grok inside X has its own setting in X

Source: x.aiFAQ 'How do I select whether my content is used for model training?'Checked on 17 October 2026

No DPA.

No. The consumer privacy policy applies, with SpaceXSI as controller; it states it does not cover data processed for business customers

Source: x.aiOpening scope paragraphChecked on 17 October 2026

DPA in the terms.

Yes. When personal data is submitted, SpaceXSI's DPA applies automatically and is incorporated into its Enterprise Terms of Service

Source: x.aiFAQ on the Data Processing AddendumChecked on 17 October 2026

Published.

No list specific to consumers. The privacy policy names categories of service providers (hosting, cloud, analytics, content delivery, support, payments); SpaceXSI's public sub-processor list has 24 entries, 23 in the US

Source: x.aiSection on disclosure 'To our contracted service providers'Second source: x.aiChecked on 17 October 2026

Not listed.

No listing found for search terms 'xAI', 'X.AI' or 'SpaceX'

Source: dataprivacyframework.govSearches 'xAI', 'X.AI', 'SpaceX' each returned 'Query returned no results' (control search 'Zapier' returned its listing)Checked on 17 October 2026

24 listed.

Public. 24 entries: 23 in the US (AWS, Google Cloud, Oracle, Cloudflare, MongoDB, Stripe and others) and a SpaceXSI subsidiary in the UK

Source: x.aiSubprocessor tableChecked on 17 October 2026

Not listed.

No listing found for search terms 'xAI', 'X.AI' or 'SpaceX'

Source: dataprivacyframework.govSearches 'xAI', 'X.AI', 'SpaceX' each returned 'Query returned no results' (control search 'Zapier' returned its listing)Checked on 17 October 2026

Conversations stay until the user deletes them; deleted chats and Private Chats are removed within 30 days unless de-identified or needed for safety or legal reasons

Source: x.aiFAQ 'How long does SpaceXSI retain my information?'Second source: x.aiChecked on 17 October 2026

Custom data retention is listed as a Grok Business feature; no default period for chats is stated. API inputs and outputs are deleted within 30 days unless agreed otherwise

Source: x.aiPricing card feature list ('Custom data retention')Second source: x.aiChecked on 17 October 2026

Not offered: a personal account has no admin; the user manages training, personalisation and deletion

Source: x.aiSections on data controls and deletionChecked on 17 October 2026

SOC 2 Type I and Type II; GDPR and CCPA compliance claimed. The Trust Center requires a sign-up form

Source: x.aiBadges at the top and 'Security & compliance' in the pricing cardSecond source: trust.x.aiChecked on 17 October 2026

Partly. Grok Business includes role-based access control, team and seat management, SSO and SCIM, connectors and audit controls; switching individual AI features off is not described

Source: x.aiPricing card feature listChecked on 17 October 2026

Free.

Free use is available, including without an account; paid SuperGrok prices appear only after sign-in and were not captured

Source: x.aiFAQs on use without logging in and on retention for unregistered usersChecked on 17 October 2026