Kustomer and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes, for the customer's own AI features: in the DPA the customer instructs Kustomer to train the AI/ML features of the service on its behalf, de-identifying data where necessary. Kustomer says it does not train global models, does not share data with other customers, and bars third-party LLM providers from training on it.

Vendor's wording: “further instructs Kustomer, where necessary, to deidentify or anonymize Personal Data, to train the AI and ML features of the Services on behalf of Client as part of the Processing”

Source: kustomer.comDPA 2.3 (Instructions)Second source: kustomer.comChecked on 19 October 2026

United States and European Union. The privacy statement says the service is hosted in both; it does not say which is the default for an account.

Vendor's wording: “The Services are hosted and operated in the United States (“U.S.”) and the European Union (“EU”) through Kustomer and our sub-processors.”

Source: kustomer.comTransfers sectionChecked on 19 October 2026

DPA on request.

Yes. Kustomer offers a Data Processing Addendum as part of the subscription agreement; clients with older versions can request the current one.

Vendor's wording: “Kustomer offers our Clients a Data Processing Addendum (DPA) to the subscription agreement for our Services”

Source: kustomer.comData Processing AddendumChecked on 19 October 2026

On the list.

Active (Kustomer, LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Kustomer'Checked on 19 October 2026

Kept while the contract runs. Kustomer deletes client data within 90 days after access ends; admins can delete customer personal data, removed within 90 days of the request.

Vendor's wording: “We endeavor to delete the Personal Data that we process on behalf of our Clients as soon as reasonably practicable, but in no event more than ninety (90) days following the date a Client’s access to our Services has been terminated”

Source: kustomer.comData RetentionChecked on 19 October 2026

Four named: SOC 2, ISO 27001, ISO 27701, ISO/IEC 42001 (plus GDPR). The AI FAQ specifies SOC 2 Type II.

Vendor's wording: “SOC 2, ISO 27001, ISO 27701, ISO/IEC 42001, and GDPR”

Source: kustomer.comSecurity and trust row of the plan tableChecked on 19 October 2026

Partly. The terms say certain AI features can be enabled or disabled as set out in Kustomer's documentation (not read), and apply only if the customer chooses to use them. A single organisation-wide switch is not confirmed.

Vendor's wording: “Instructions for enabling/disabling certain AI Features are outlined in the Documentation.”

Source: kustomer.comA. AI Features, 1.1Checked on 19 October 2026