Data

MailerLite and the GDPR: AI training, data location and DPA

Comfort: Trains on your data, with no documented way to stop it. No EU hosting · DPA on request.

Vendor: MailerLite LimitedSales, marketing and supportChecked on How we check

Verdict

Is MailerLite GDPR compliant?

Comfort

Business

Trains on your data, with no documented way to stop it

No EU hosting · DPA on request

Price: See details

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does MailerLite train on your data?

Trains on your data by default?

Checked

Trains on your data, with no documented way to stop it.

Yes for AI-feature inputs and outputs: the Terms give MailerLite a licence to use them to improve AI models. Nothing is stated for ordinary subscriber or campaign data. Its partners OpenAI and Google do not train on them.

Vendor's wording: “You grant MailerLite a license to use your Inputs and Outputs to improve AI models, and you agree to comply with any restrictions on AI usage.”

Source: mailerlite.com17. AI-Powered Features, 17.3Checked on

Location

Where does MailerLite store your data?

Where data is stored by default

Checked

EU: data centres in Germany (legacy Classic accounts) and the Netherlands (new MailerLite), run by Google Cloud EMEA Ltd.

Vendor's wording: “Data center of Legacy (Classic) with its location in Germany, and data center of new MailerLite with its location in the Netherlands”

Source: mailerlite.comAnnex 4, Google Cloud EMEA LtdChecked on

EU hosting on this plan

Checked

No EU hosting.

Not a setting: hosting is already in the EU (Germany and the Netherlands) per the trust page.

Vendor's wording: “Our services are hosted by trusted and certified data storage centers that are located in the European Union (Germany and the Netherlands)”

Source: mailerlite.comData center securityChecked on

Contract

Does MailerLite sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes, part of the terms: the DPA supplements the Terms of Service and takes effect when the customer agrees to them; no separate signing.

Vendor's wording: “This DPA is effective from the date the Customer agrees with the terms and conditions of the TOU.”

Source: mailerlite.comPreambleChecked on

Processors

Who else handles MailerLite data?

Sub-processors (companies that handle the data for them)

Checked

Published.

Yes, in Annex 4 of the DPA (https://www.mailerlite.com/legal/data-processing-agreement): 2 entries (Google Cloud EMEA Ltd, Vercom S.A.). No AI provider is listed there; OpenAI and Google Vertex AI appear in the privacy policy and AI policy instead.

Vendor's wording: “The controller has authorised the use of the following sub-processors:”

Source: mailerlite.comAnnex 4 - List of MailerLite Sub-ProcessorsChecked on

EU–US Data Privacy Framework

Checked

EU or Swiss vendor.

Not applicable (EU-based vendor, MailerLite Limited, Dublin, Ireland)

Vendor's wording: “MailerLite Limited, an Irish registered company at 88 Harcourt Street, Dublin 2, D02 DK18, Ireland”

Source: mailerlite.comController identificationChecked on

Retention

How long does MailerLite keep your data?

How long data is kept

Checked

Kept while the account is active; after a deletion request, data is deleted or anonymised within 30 days. Billing and transaction records are kept 7 years. AI prompt retention not stated, providers said to retain nothing.

Vendor's wording: “your data will be fully deleted or anonymized within 30 days from receiving an eligible request.”

Source: mailerlite.com11. Data retention, 11.2Checked on

Security

Which certifications and admin controls does MailerLite have?

Security certifications

Checked

1 named: ISO/IEC 27001:2022 (company and its data centres); GDPR compliant badge only.

Vendor's wording: “MailerLite is certified to ISO/IEC 27001:2022, the leading standard for Information Security Management Systems (ISMS).”

Source: mailerlite.comISO/IEC 27001Checked on

The vendor doesn't say: switch-off, admin controls, price.

Alternatives

MailerLite alternatives that don't train on your data

Other sales, marketing and support tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Pipedrive

    Growth · €39 / user / mo

    Says it doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Attio

    Pro · €74 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

  • Dynamics 365 Sales

    Professional · €56.30 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓?✓

  • folk

    Standard · €22 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✕

  • GetResponse Email Marketing

    Marketer · €44.28 / mo

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices