Krea and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No: Krea commits not to use Business subscription inputs and outputs to train its AI models.

Vendor's wording: “Krea commits that it will NOT use your Inputs or Outputs to train its AI models or algorithms.”

Source: krea.aiUse of Content for Training and Service ImprovementChecked on 19 October 2026

United States: the services are hosted on US servers; the sub-processor summary shows Amazon Web Services with data location US.

Vendor's wording: “The Services are hosted and operated in the United States”

Source: krea.aiInternational transfersChecked on 19 October 2026

DPA on request.

Yes, on request: the DPA is a Trust Center document that customers request; Business Terms are described as including data protection clauses.

Vendor's wording: “To receive the full register, request access to our DPA through this Trust Center”

Source: krea.aiTrust Center, SubprocessorsChecked on 19 October 2026

Not public.

Yes, but abbreviated: https://krea.ai/legal/subprocessors shows 8 primary sub-processors, all in the US, with no AI model provider listed. The full register is only in the DPA, on request.

Vendor's wording: “This is an abbreviated summary of our primary subprocessors.”

Source: krea.aiSubprocessorsChecked on 19 October 2026

Not listed.

No listing found for search term 'Krea'

Source: dataprivacyframework.govSearch 'Krea' returned 'Query returned no results'Checked on 19 October 2026

No fixed period for content. On ending the Business plan, members lose access and the owner should export content first; closing an account may destroy its content. Profile data is kept while the account exists.

Vendor's wording: “Account termination may result in destruction of any Content associated with your account”

Source: krea.aiTermination and account deletionChecked on 19 October 2026

One audit: SOC 2 (the Trust Center lists SOC 2 Type 1 and a bridge letter; the full report is available under NDA).

Vendor's wording: “Krea is SOC 2 compliant: an independent audit firm has examined our controls against the SOC 2 framework”

Source: krea.aiInformation security programmeChecked on 19 October 2026

Yes, partly: Business workspaces can restrict which AI models members may use and set custom roles and permissions.

Vendor's wording: “Restrict which AI models your workspace can use to manage costs and ensure compliance with your policies.”

Source: krea.aiBusiness plan featuresChecked on 19 October 2026