Lindy and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Terms say Lindy does not use customer content to train AI models and its AI providers have agreed not to; the security page says the same for your data.

Vendor's wording: “We do not use your Contributions to train AI models, and our AI model providers have agreed not to use them to train their models.”

Source: lindy.aiContributions sectionSecond source: lindy.aiChecked on 19 October 2026

United States. The Terms say the Services are hosted in the United States; cloud providers named in the privacy policy are Google Cloud Platform, Amazon Web Services, DigitalOcean, MongoDB and Cloudflare.

Vendor's wording: “Please be advised the Services are hosted in the United States.”

Source: lindy.aiSection 19 Privacy PolicySecond source: lindy.aiChecked on 19 October 2026

EU hosting not documented.

Vendor claim only: the security page says residency requirements are supported; no EU region, setting or plan is described, and the Terms say the Services are hosted in the United States.

Vendor's wording: “Data deletion requests, access rights, and residency requirements are all supported.”

Source: lindy.aiPrivacy ControlsChecked on 19 October 2026

DPA on request.

Yes. Data Processing Terms are built into the Terms of Service (no separate signing); Lindy acts as processor and the customer can ask to sign standard contractual clauses.

Vendor's wording: “When and to the extent we are acting as a Processor in our provision of the Services, and you are acting as the Controller, the following provisions apply:”

Source: lindy.aiData Processing TermsChecked on 19 October 2026

Not public.

No standalone list; the privacy policy names 32 companies by group (the terms authorise them). AI providers: Anthropic, OpenAI, Perplexity AI, Exa Labs, ElevenLabs, Deepgram.

Vendor's wording: “AI Model & AI Service Providers: Anthropic, OpenAI, Perplexity AI, Exa Labs, ElevenLabs, Deepgram”

Source: lindy.aiVendors, Consultants, and Other Third-Party Service ProvidersChecked on 19 October 2026

Not listed.

No listing found for search term 'Crivello', 'Lindy'

Source: dataprivacyframework.govSearch 'Crivello', 'Lindy' returned 'Query returned no results'Checked on 19 October 2026

No fixed period published. On account termination Lindy deactivates or deletes data from active databases (some kept for fraud and legal reasons); processor terms promise prompt deletion of customer personal data after the service ends, with certification on request.

Vendor's wording: “We shall promptly delete (and certify to such deletion upon your written request) all copies of Company Personal Data after the date of our cessation of the provision of the Services to you.”

Source: lindy.aiData Processing Terms item 9Second source: lindy.aiChecked on 19 October 2026

1 audited certification: SOC 2 Type II (audited by Johanson Group); HIPAA, GDPR and PIPEDA compliance are also claimed.

Vendor's wording: “SOC 2 Type II Certified Audited by Johanson Group.”

Source: lindy.aiCompliance & CertificationsChecked on 19 October 2026