GDPR and AI phone agents: 32 voice AI tools checked

Doesn't say whether it trains on your data.

Not stated for Aircall itself; it says its AI features do not use customer data to train the AI providers' foundational models.

“The AI Features do not use Customer Data submitted to the Services or the resulting AI outputs to train, retrain or improve the providers' foundational models.”

Source: aircall.io · Checked on 19 October 2026

No opt-out is described. Aircall states its AI features do not use customer data to train its AI providers' foundational models; nothing is stated about Aircall's own training.

“The AI Features do not use Customer Data submitted to the Services or the resulting AI outputs to train, retrain or improve the providers' foundational models.”

Source: aircall.io · Checked on 19 October 2026

Call recordings and voicemails: AWS Oregon (USA) for North American numbers, AWS Frankfurt (Germany) for EMEA numbers. Everything else (account data, metadata, support data) stays in AWS US West, Oregon.

“All other personal information not scoped for the conversational data regional hosting, including Customer account data, Customer contact data, Customer financial/payment data, Information about user, Call/SMS metadata, Additional call-related data, etc., as well as any Personal Data provided during support interaction, remains stored on AWS US West servers in Oregon, USA.”

Source: aircall.io · Checked on 19 October 2026

EU hosting not documented.

Partly. New accounts are assigned a US, EU (AWS Frankfurt) or Australia hosting region by signup phone number country code for recordings, voicemails and, for new accounts, transcripts and AI data; existing accounts are still migrating.

“new Aircall accounts are automatically assigned to a US, EU, or Australia hosting location — based on the phone number/country code used at signup — for the data types above.”

Source: aircall.io · Checked on 19 October 2026

DPA on request.

Yes. The DPA is part of the Terms of Use or Master Subscription Agreement automatically; no action or signature needed.

“there is no action needed on your side in order to conclude a Data Processing Agreement (DPA) with Aircall”

Source: aircall.io · Checked on 19 October 2026

Published.

Yes: https://aircall.io/subprocessorlist/ . 26 entries: 20 third parties (including 6 AI providers) and 6 Aircall group entities. AI providers: Microsoft Azure, Deepgram, ElevenLabs, AssemblyAI, Cartesia AI, Firecrawl.

“Generation of conversation insights (Call summarisation, Key topics list, Talk ratio etc.) from voice transcriptions.”

Source: aircall.io · Checked on 19 October 2026

On the list.

Active (Aircall.io, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Call recordings kept for the period in your plan (can be indefinite), at most 30 days after the relationship ends; admins can ask support to change it or delete calls. AI providers keep nothing (zero data retention). DPA: export within 30 days after termination, then deletion.

“We by default store your call recording for the period indicated in your pricing plan, which may be indefinite (but always up to 30 days following the termination of your relationship with Aircall).”

Source: aircall.io · Checked on 19 October 2026

SOC 2 Type 2 (1 certification named). The security programme is only 'aligned with' ISO 27001 and SOC II; AWS hosting holds ISO 27001, SOC 2, PCI DSS, FedRAMP.

“Aircall is SOC2 Type 2 compliant”

Source: aircall.io · Checked on 19 October 2026

EU hosting not documented.

Enterprise only: the pricing page lists data residency under the Enterprise plan, not Build.

“Forward deployed engineer available BAA, SSO, data residency”

Source: bland.ai · Checked on 19 October 2026

DPA not stated.

A DPA exists but is written for customers with an Enterprise Services Agreement; it is not stated to apply to the self-serve Build plan.

“This DPA amends and forms part of the Agreement.”

Source: bland.ai · Checked on 19 October 2026

Published.

Yes: https://bland.ai/legal/subprocessors . 18 entries (AWS, Cloudflare, Datadog, Fivetran, GitHub, Google Workspace, HashiCorp, Linear, Okta, Redis Cloud, Retool, Slack, Stripe, Supabase, Temporal, Twilio, Vanta, Vercel); no AI model providers listed.

“Bland engages the following third parties to process Customer Data.”

Source: bland.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Intelliga', 'Bland AI'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Not stated for call data. On the DPA, at the customer's request Bland deletes or returns personal data when the service ends; the request must be made within 14 days by emailing security@bland.ai. Zero-retention processing is mentioned as available for sensitive workflows.

“Customer may make its request within 14 days of the cessation date of the Services by emailing the request to security@bland.ai.”

Source: bland.ai · Checked on 19 October 2026

SOC 2 Type II; HIPAA (self-attested with BAA); GDPR; PCI DSS v4.0 (4 named, only SOC 2 Type II independently audited).

“SOC 2 Type IIHIPAAGDPRPCI DSS v4.0”

Source: bland.ai · Checked on 19 October 2026

EU: hosting at Hetzner (Nuremberg, Falkenstein, Helsinki) and OVH (Germany, France); telephony via Twilio's Ireland region; AI providers used through EU regions or EU endpoints

Source: fonio.ai · Checked on 17 October 2026

Data in the EU by default.

EU by default

Source: fonio.ai · Checked on 17 October 2026

DPA in the terms.

Yes. fonio's DPA (6 Aug 2026) applies to all clients and is part of the terms; German version prevails

Source: a.storyblok.com · Checked on 17 October 2026

3 listed.

Public in DPA Appendix 3 (16 Sep 2026): 10 main providers (Hetzner, OVH, Twilio Ireland, Voxbone, LiveKit, Soniox, OpenAI Ireland, Inworld AI, Mailgun, New Relic) and fallback providers including Deepgram, Google, ElevenLabs, Nylas and LangChain

Source: fonio.ai · Checked on 17 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, fonio GmbH, Vienna); its US sub-processors rely on the DPF or SCCs per Appendix 3

Source: fonio.ai · Checked on 17 October 2026

No period for call data is stated; after the contract ends, clients can export data for 30 days and fonio destroys data 30 days after termination unless the client instructs otherwise; Twilio keeps no audio

Source: fonio.ai · Checked on 17 October 2026

€99 / mo.

EUR 99 per month billed yearly, or EUR 119 monthly, for 1,000 minutes and one phone number (extra numbers EUR 9/month); VAT basis not stated

Source: fonio.ai · Checked on 17 October 2026

Trains on your data, with no documented way to stop it.

Yes: Gorgias may use Customer Data and outputs to build and improve its own internal AI models. It will not use Customer Data to train third-party providers' models, which operate with zero data retention.

“use information gathered, collected, and/or generated in the course of providing the Services, including Customer Data, Feedback, Aggregate Data, Usage Data, and Output (as defined below), solely to build and improve our internal machine learning and other artificial intelligence models”

Source: gorgias.com · Checked on 19 October 2026

DPA on request.

Yes. The Data Processing Agreement forms part of the Master Subscription Agreement.

“forms part of the Gorgias’ Master Subscription Agreement (the “Agreement”) between the applicable Gorgias customer which is a party to such Agreement”

Source: gorgias.com · Checked on 19 October 2026

25 listed.

Public list at https://www.gorgias.com/legal/list-of-data-subprocessors: 25 rows (4 infrastructure, 16 feature-specific, 5 Gorgias affiliates). OpenAI is the AI provider listed.

“OpenAi AI research and deployment company United States”

Source: gorgias.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Gorgias'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Within 90 days after the agreement ends Gorgias returns and deletes the customer's personal data; deletion requests go to support@gorgias.com. In-service retention is not stated.

“Gorgias shall, promptly and in any event within 90 days of expiration or termination of the Agreement”

Source: gorgias.com · Checked on 19 October 2026

SOC 2 Type II (report on request) and HIPAA compliance (report on request). Two named.

“SOC 2 Type II Certification Request the report”

Source: gorgias.com · Checked on 19 October 2026

The EU, according to a 2018 company blog post; the privacy policy and terms do not state a location.

“We keep all our data on the territory of the EU.”

Source: helpcrunch.com · Checked on 19 October 2026

EU hosting not documented.

Data is stated to be kept in the EU by default (2018 blog post); no separate residency setting or plan is described.

“We keep all our data on the territory of the EU.”

Source: helpcrunch.com · Checked on 19 October 2026

DPA on request.

Yes, on request: HelpCrunch says customers can ask by email to sign its DPA (statement from a 2018 GDPR blog post).

“Note! If you want to sign the DPA with HelpCrunch or request any details about it, just email us at”

Source: helpcrunch.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'HelpCrunch'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Cancelled accounts are permanently deleted after 6 months and can be restored within that time; a customer can ask for immediate deletion (2018 blog post).

“All the canceled accounts will be completely and permanently deleted after 6 months.”

Source: helpcrunch.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes, for Text's own AI: the DPA lets Text use customer data to improve its services, including training AI models; it says it does not share personal data with other clients. The AI principles say models are task-specific and per licence, and never used for general-purpose or third-party (OpenAI) training.

“for the purposes of providing, maintaining, and improving the Text Services, analysis, including training artificial intelligence (“AI”) models and similar or related Services and features”

Source: livechat.com · Checked on 19 October 2026

DPA on request.

Yes. The DPA is part of the Agreement accepted at sign-up; no separate signature is needed or offered.

“We do not sign the DPA as a separate agreement anymore - the DPA is already an integral part of the Agreement, meaning it does not require a separate signature.”

Source: livechat.com · Checked on 19 October 2026

On the list.

Active (Text, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period stated. The customer can delete or export data at any time with the in-product tools; for other requests Text answers within 30 days. After the agreement ends Text and its sub-processors may keep backups for legal reasons until permanently erased.

“If you need help deleting or exporting data outside built-in tools, just send us a written request. We’ll handle it within 30 days, using our standard methods.”

Source: livechat.com · Checked on 19 October 2026

Germany. All servers and stored data are hosted in Germany (OVH named in the pricing comparison); AI/LLM processing via Microsoft Azure on European servers only.

“Alles ist in Deutschland gehostet.”

Source: moin.ai · Checked on 19 October 2026

EU hosting not documented.

Included by default: German servers (OVH) and European-only Azure processing are marked for Business. A stricter 'Extended' EU-only AI option is marked for Professional only.

“Datenhaltung ausschließlich auf deutschen Servern”

Source: moin.ai · Checked on 19 October 2026

DPA on request.

Yes. An AVV (Auftragsverarbeitungsvertrag, Art. 28 GDPR) is offered; you request it by email. The comparison table marks it as included in Business.

“moinAI bietet einen Auftragsverarbeitungsvertrag (AVV), dessen Inhalt vom Datenschutzrecht im Art. 28 DSGVO vorgegeben wird.”

Source: moin.ai · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, knowhere GmbH, Hamburg)

“knowhere GmbH Karolinenstraße 9 20357 Hamburg”

Source: moin.ai · Checked on 19 October 2026

The customer sets how long conversations are stored, from 'nie' (never) up to 1 year, in Bot-Einstellungen > Generelles & Datenschutz; automatic deletion after the chosen period is possible. Deletion after cancellation is not stated.

“Die Speicherdauer der KI-Chatbot-Unterhaltungen kann individuell definiert werden. Möglich sind Zeiträume von nie bis 1 Jahr.”

Source: moin.ai · Checked on 19 October 2026

Data-centre ISO 27001 is marked for Business; moinAI's own ISO 27001 is 'Coming soon' for all plans. No SOC 2 named.

“ISO 27001-Zertifizierung Rechenzentren Zertifizierte Sicherheitsstandards der Rechenzentren”

Source: moin.ai · Checked on 19 October 2026

See details.

From 750 EUR per month with annual payment, or from 880 EUR per month paid monthly (Business; unlimited conversations, 15 AI agents, 3-month minimum term). VAT not stated.

“Business ab 880 € pro Monat (monatliche Zahlung) ab 750 € pro Monat (jährliche Zahlung)”

Source: moin.ai · Checked on 19 October 2026

United States: all customer data is stored and processed on AWS in Ohio (US-East-2)

“Murf securely stores and processes all Customer Data within the United States, leveraging Amazon Web Services (AWS) cloud infrastructure.”

Source: murf.ai · Checked on 19 October 2026

No EU hosting.

No: Murf says it does not store or replicate customer data outside AWS US-East-2 (Ohio)

“Murf does not replicate or store Customer Data outside of the US-East-2 region”

Source: murf.ai · Checked on 19 October 2026

Published.

Yes, public: https://murf.ai/legal/sub-processors (last updated 30/01/2025): 21 third-party entries plus 1 affiliate (Murf Software Solutions Private Limited, India). AI-related: OpenAI, Google (Gen AI, text to speech), Microsoft (Azure speech), AssemblyAI, IBM, Lambda Labs, AWS

“Murf engages the following entities to provide processing activities for Customer Data.”

Source: murf.ai · Checked on 19 October 2026

On the list.

Active (Murf Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Account data, including projects, media and text, is permanently deleted within 30 days of account termination, except what is kept for legal duties, security or fraud prevention. You can delete content or request deletion at any time; backups clear after a short delay.

“We permanently delete account information, including any project, media or text information uploaded by you, within 30 days of account termination, except as noted below.”

Source: murf.ai · Checked on 20 October 2026

3 named: ISO 42001, ISO 27001, SOC 2 Type II (also states GDPR and CCPA compliance)

“We are ISO 42001, ISO 27001, SOC 2 Type II, CCPA and GDPR compliant, and we undergo regular third-party audits”

Source: murf.ai · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes, where the client permits it: PolyAI uses snippets of call recordings and conversation turns for model training. Its public DPA also gives it a perpetual licence to use call data to develop and improve the service.

“We extract snippets of voice recordings and/or conversation turns to improve our virtual assistant (including model training).”

Source: poly.ai · Checked on 19 October 2026

DPA on request.

Yes: PolyAI publishes a Data Processing Agreement (last updated 1 October 2025). It takes effect when the customer agreement is signed and covers PolyAI acting as processor.

“This DPA shall commence on the date the Agreement is signed by both parties”

Source: poly.ai · Checked on 19 October 2026

UK (EU adequacy).

Not applicable (UK-based vendor, PolyAI Limited; the DPA uses the UK data-transfer addendum with PolyAI Limited as exporter). Its US affiliate PolyAI Technologies, Inc. is the importer under standard contractual clauses.

“Exporter - PolyAI Limited (as further identified in the Agreement)”

Source: poly.ai · Checked on 19 October 2026

Conversation data used for improvement is kept until annotation, evaluation or model training is complete. Under the DPA a customer can ask for a copy within 90 days of contract expiry, after which PolyAI deletes the data. Live recording retention is not stated.

“We will keep this information until completion of the relevant annotation, evaluation or model training.”

Source: poly.ai · Checked on 19 October 2026

1 named: ISO 27001 (no SOC 2 or others named).

“ISO 27001-certified Physical security – hosted on AWS providing robust physical data center security”

Source: poly.ai · Checked on 19 October 2026

Germany: sipgate hosts its product infrastructure in German data centres; for sona it runs its own language models there and says conversation data does not leave that infrastructure

“Die sipgate Produktinfrastruktur wird in Rechenzentren in Deutschland gehostet.”

Source: sipgate.de · Checked on 19 October 2026

EU hosting not documented.

Always in Germany by default; no setting needed (conversation data stays on sipgate's German infrastructure)

“Die Sprachmodelle hinter sona betreibt sipgate selbst, auf eigener Infrastruktur in deutschen Rechenzentren. Ihre Gesprächsdaten verlassen diese Infrastruktur nicht.”

Source: sipgate.de · Checked on 19 October 2026

DPA in the terms.

Yes: sipgate concludes a data processing contract (Auftragsverarbeitungsvertrag) with the customer for sona

“Der Vertrag zur Verarbeitung von Daten im Auftrag legt fest, wie sipgate personenbezogene Daten im Auftrag der Kund:innen”

Source: sipgate.de · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (German-based vendor, sipgate GmbH, Düsseldorf)

“sipgate GmbH Gladbacher Straße 74 40219 Düsseldorf”

Source: sipgate.de · Checked on 19 October 2026

1 named: ISO 27001 (all data centres hosting sipgate's product infrastructure in Germany); the pricing page also says 'EU AI Act-ready'

“Die sipgate Produktinfrastruktur wird in Rechenzentren in Deutschland gehostet. Dabei sind alle Rechenzentren erfolgreich nach ISO 27001 zertifiziert”

Source: sipgate.de · Checked on 19 October 2026

See details.

69.95 EUR per month excl. VAT (Starter: 1,000 included minutes, 2 parallel calls); a Free plan with 500 minutes exists

“Starter 69 95 Euro pro Monat zzgl. MwSt.”

Source: sipgate.de · Checked on 19 October 2026

United States: information submitted is transferred to, processed and stored in the US

“Information submitted to Speechify will be transferred to, processed, and stored in the United States.”

Source: speechify.com · Checked on 19 October 2026

No EU hosting.

No: privacy policy says information is processed and stored in the United States and users agree to US hosting; no EU option described

“Information submitted to Speechify will be transferred to, processed, and stored in the United States.”

Source: speechify.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Speechify'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No period stated: users can delete their account in Settings (paid subscribers cancel first); Speechify may keep some personal data as long as reasonably necessary for legitimate interests and legal obligations

“However, we may keep some of your Personal Data for as long as reasonably necessary for our legitimate business interests”

Source: speechify.com · Checked on 19 October 2026

SOC 2 (type not stated), a marketing claim on the business page; no ISO certification named

“Speechify is SOC 2 compliant and rigorous about data security”

Source: speechify.com · Checked on 19 October 2026

DPA on request.

Yes: a Data Processing Agreement pre-signed by Talkdesk is published; the customer countersigns it through DocuSign. The terms also say personal data is processed under it.

“The document has been pre-signed by Talkdesk Inc. on behalf of its respective affiliates.”

Source: talkdesk.com · Checked on 19 October 2026

On the list.

Active (Talkdesk; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Set by the customer, who can delete its data at any time. The customer can export data during the term and for 30 days afterwards; after termination Talkdesk deletes personal data as set out in the agreement or on request. No period for recordings or transcripts is stated.

“During the Service Term and for thirty (30) days thereafter, Customer may export its Customer Data from the Talkdesk Service”

Source: talkdesk.com · Checked on 19 October 2026

More than 30 claimed. Named on the security page: BSI C5, SOC 2 and 3, ISO 27001, PCI DSS Level 1, HIPAA, GDPR, ISO 22301, ISO/IEC 42001 (AI governance).

“Talkdesk provides a better way to trust with more than 30 security certifications (including BSI C5, SOC 2 and 3, ISO 27001, PCI DSS Level 1, HIPAA, GDPR, and the industry’s only ISO 22301 Business Continuity certification, and ISO/IEC 42001 for AI governance).”

Source: talkdesk.com · Checked on 19 October 2026

Says it doesn't train on your data.

No, per the security page: customer data is not used to train any machine learning or AI models, and its model providers (OpenAI, Anthropic, Google) do not train on it. The Terms of Service separately license Voiceflow to use customer data to provide and improve the service.

“Customer data is only used to provide and operate the service.”

Source: voiceflow.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: the vendor states it does not use customer data to train AI models.

“Customer data is only used to provide and operate the service.”

Source: voiceflow.com · Checked on 19 October 2026

DPA in the terms.

Yes: a Data Processing Addendum is published and incorporated into the Terms of Service, so no signature is needed.

“This Data Processing Addendum (“DPA”) is hereby incorporated into and governed by the terms of the Terms of Service”

Source: voiceflow.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Voiceflow'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept as long as needed to provide the service; deleted under internal policies after the subscription ends. No period is stated; model providers are set to zero data retention.

“Voiceflow will retain Personal Information we process on behalf of our customers or collect directly from our customers for as long as needed to provide Service to our customers”

Source: voiceflow.com · Checked on 19 October 2026

4 listed on the security page: SOC 2 Type II, ISO 27001, GDPR, HIPAA.

“Explore our compliance frameworks, supporting documentation, and what they mean for your team.”

Source: voiceflow.com · Checked on 19 October 2026