Data

Klaviyo and the GDPR: AI training, data location and DPA

Email (paid): Trains on your data in part. EU hosting available · DPA on request.

Vendor: KlaviyoSales, marketing and supportChecked on How we check

Verdict

Is Klaviyo GDPR compliant?

Email (paid)

Business

Trains on your data in part

EU hosting available · DPA on request

Price: Quote only

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Klaviyo train on your data?

Trains on your data by default?

Checked

Trains on your data in part.

Yes, in aggregated or de-identified form: Klaviyo uses aggregated or de-identified customer data to improve and train its own models; its LLM providers (OpenAI, Anthropic, AWS Bedrock, Gemini) may not train on customer data

Source: klaviyo.comSection on model training and service improvementChecked on

Location

Where does Klaviyo store your data?

Where data is stored by default

Checked

United States: AWS hosting in the US; ClickHouse also hosts in Germany

Source: klaviyo.comSub-processor table, 'Data hosting location(s)' (updated 11 Sep 2026)Checked on

EU hosting on this plan

Checked

EU hosting available.

Yes, where agreed: if a customer has stipulated EU data residency, Klaviyo stores customer personal data in the EU, though some processing still happens outside the EU

Source: klaviyo.comClause on EU data residencyChecked on

Contract

Does Klaviyo sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes. Klaviyo's DPA is incorporated into and forms part of the Agreement

Source: klaviyo.comClause (A) ('incorporated into and forms part of the Agreement')Checked on

Processors

Who else handles Klaviyo data?

Sub-processors (companies that handle the data for them)

Checked

27 listed.

Public. 27 third-party entries, mostly hosting and processing in the US; AI features use Anthropic and OpenAI

Source: klaviyo.comSub-processor tableChecked on

EU–US Data Privacy Framework

Checked

On the list, under review.

Active, re-certification under review (Klaviyo; EU-US DPF, Swiss-US DPF for non-HR data, UK Extension)

Source: dataprivacyframework.govSearch 'Klaviyo'Checked on

Retention

How long does Klaviyo keep your data?

How long data is kept

Checked

Kept for the account; on request at closure Klaviyo returns the data, and it deletes customer personal data within 90 days of account closure or the end of the agreement

Source: klaviyo.comSection 'Deletion and Return'Checked on

Security

Which certifications and admin controls does Klaviyo have?

Security certifications

Checked

SOC 2 Type II, ISO 27001, ISO 27017 and PCI DSS; GDPR listed

Source: trust.klaviyo.comCompliance tilesChecked on

The vendor doesn't say: admin controls, price.

Alternatives

Klaviyo alternatives that don't train on your data

Other sales, marketing and support tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Pipedrive

    Growth · €39 / user / mo

    Says it doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Attio

    Pro · €74 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

  • Dynamics 365 Sales

    Professional · €56.30 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓?✓

  • folk

    Standard · €22 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✕

  • GetResponse Email Marketing

    Marketer · €44.28 / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices