Mammouth AI and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The DPA states Mammouth will not use customer personal data to train AI models; the provider page adds that models are never trained on prompts sent via Mammouth.

Vendor's wording: “For the avoidance of doubt, Mammouth shall not use Customer Personal Data to train artificial intelligence models.”

Source: info.mammouth.aiAnnex DPA, clause 2.3Second source: info.mammouth.aiChecked on 19 October 2026

European Economic Area: hosting by Hetzner (computing) and Neon (hosting), both in Germany; files on Cloudflare (EU) and Google Cloud (Belgium). Prompts go to AI model providers, some in the USA.

Vendor's wording: “As we are based in Europe, your personal data is processed and stored within the European Economic Area (EEA).”

Source: info.mammouth.aiSection 7 International Data TransfersSecond source: info.mammouth.aiChecked on 19 October 2026

No EU hosting.

No separate setting: EEA storage is the default for everyone. AI model calls are not EU-only: Fireworks AI, xAI and OpenRouter are listed as USA, OpenAI, Anthropic and Google as EU / USA.

Vendor's wording: “Fireworks AI Processing and generating USA xAI Processing and generating USA OpenRouter Processing and generating USA”

Source: info.mammouth.aiAnnex List of Sub-ProcessorsChecked on 19 October 2026

DPA on request.

Yes. A Data Processing Addendum is part of the Terms of Service and ranks third in the contract order; it applies automatically (no separate signing described).

Vendor's wording: “DPA: Mammouth’s DPA applies to such processing in compliance with GDPR.”

Source: info.mammouth.aiSection 6 Personal Data and DPA clauseChecked on 19 October 2026

Published.

Yes, in the Terms annex (https://info.mammouth.ai/docs/terms-of-service): 14 entries. AI providers: OpenAI, Anthropic, Mistral AI, Google, Fireworks AI, xAI, OpenRouter. Others: Hetzner, Neon, Cloudflare, Google Cloud, Sendinblue, Resend, Stripe.

Vendor's wording: “Main SubProcessors SubProcessor Activity Location of Activity Hetzner Computing EU (Germany)”

Source: info.mammouth.aiAnnex List of Sub-ProcessorsChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Mammouth AI SAS, Paris, France)

Vendor's wording: “The data controller for your personal data is Mammouth AI SAS, a company incorporated in France, having its registered office at 8 Rue Dupleix, 75015 Paris, France”

Source: info.mammouth.aiSection 1 Who We AreChecked on 19 October 2026

Chats are kept while the subscription is active and can be deleted at any time; deleted data is held up to 30 rolling days for abuse detection, then permanently removed. Account data is kept up to 1 year after the subscription ends. AI providers keep prompts no longer than 30 days.

Vendor's wording: “Once you delete your data, we might retain it for up to 30 rolling days for abuse detection”

Source: info.mammouth.aiSection 4 How Long Do We Retain Your DataSecond source: info.mammouth.aiChecked on 19 October 2026

Yes. Team owners can disable specific AI providers, API access and video generation for all members, and deploy connectors centrally.

Vendor's wording: “Owners can restrict certain features for all team members: Disable specific AI providers Disable API access Disable video generation”

Source: info.mammouth.aiPermissions sectionChecked on 19 October 2026

See details.

Team plan costs the same per user as individual plans, in EUR incl. VAT: Starter 12 euro, Standard 24 euro, Expert 72 euro per user per month (monthly billing shown).

Vendor's wording: “Same price per user for businesses as for B2C”

Source: mammouth.aiPricing page, Team boxChecked on 19 October 2026