Hootsuite and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes, by Hootsuite itself: the AI terms let it use Customer Content and AI outputs to develop and improve its AI features, including its machine-learning technologies. Third-party AI providers may not train on them, and nothing is shared with other customers.

Vendor's wording: “we may use Customer Content and Outputs to develop and improve the features of the AI-Powered Services (including our machine-learning technologies)”

Source: hootsuite.com2(c) Service ImprovementsChecked on 19 October 2026

United States: content is hosted in AWS data centres in the United States.

Vendor's wording: “your data is housed in secure data centres in the United States.”

Source: hootsuite.comWhere Your Data is LocatedChecked on 19 October 2026

DPA on request.

Yes, on request for self-serve plans: a pre-signed DPA is on the website and becomes binding once Hootsuite receives the customer's signed copy.

Vendor's wording: “you may enter into a DPA by visiting www.hootsuite.com/legal/data-processing-addendum to access a pre-signed DPA. Once we receive your signed DPA, this becomes legally binding”

Source: hootsuite.comSelf-Serve Terms of Service, clause 15Checked on 19 October 2026

Published.

Yes, https://hootsuite.com/legal/subprocessor-list (updated Sept 21, 2026): 20 rows, 15 companies. AI providers: OpenAI, Microsoft, Google Cloud Canada; Talkwalker (affiliate) for AI-powered services.

Vendor's wording: “Subprocessor list last updated: September 21, 2026”

Source: hootsuite.comSubprocessor ListChecked on 19 October 2026

Not listed.

No listing found for search term 'Hootsuite'

Source: dataprivacyframework.govSearch 'Hootsuite' returned 'Query returned no results'Checked on 19 October 2026

Kept as long as needed to provide the service; draft and published posts are retained while the customer uses it. Deleted or anonymised once no longer needed or on request; no fixed number of days; aggregated data is kept for analysis.

Vendor's wording: “We retain information about you only for as long as necessary to provide and manage our Services, to manage our business, and for financial and legal purposes.”

Source: hootsuite.com5. How long we retain your informationChecked on 19 October 2026

14 badges on the trust centre, of which 11 are certifications or attestations: ISO 27001:2022, ISO 27017, ISO 27018, ISO 27701, SOC 2 Type II, SOC 3, PCI, CSA STAR 1, Cyber Essentials, FedRAMP Li-SaaS, TX-RAMP. GDPR, CCPA and VPAT are compliance labels.

Vendor's wording: “GDPR ISO 27001:2022 ISO 27017 ISO 27018 ISO 27701 PCI SOC 2 Type II SOC 3”

Source: trustcenter.hootsuite.comComplianceChecked on 19 October 2026

€199 / user / mo.

EUR 199 per user/month, billed annually, excluding taxes (Professional)

Vendor's wording: “Prices displayed in EUR, based on annual billing, but do not include applicable taxes.”

Source: hootsuite.comProfessional plan card and price footnoteChecked on 20 October 2026