Data

Recraft and the GDPR: AI training, data location and DPA

Teams: Trains on your data unless you switch it off. EU hosting not documented · DPA on request.

Vendor: Recraft, Inc.Design, images and videoChecked on How we check

Verdict

Is Recraft GDPR compliant?

Teams

Business

Trains on your data unless you switch it off

EU hosting not documented · DPA on request

Price: $22 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Recraft train on your data?

Trains on your data by default?

Checked

Trains on your data unless you switch it off.

Yes: the Terms of Service allow Recraft to train its AI models on your prompts and images, on by default for accounts, unless you opt out in your profile settings. The Terms make no Teams exception.

Vendor's wording: “This training use is enabled by default, but you may opt out at any time by adjusting your preferences in your account profile settings.”

Source: recraft.aiSection 7.7 Licenses to RecraftChecked on

Switch-off

How do you turn off AI training in Recraft?

How to switch training off

Checked

You can switch the training off.

Switch training off in your account profile settings; the Terms make it on by default for all accounts, with no Teams exception.

Vendor's wording: “This training use is enabled by default, but you may opt out at any time by adjusting your preferences in your account profile settings.”

Source: recraft.aiSection 7.7 Licenses to RecraftChecked on

Contract

Does Recraft sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes: a Data Processing Addendum is published at recraft.ai/legal/dpa and forms part of the customer agreement; entering it also signs the EU Standard Contractual Clauses.

Vendor's wording: “By entering into this DPA, the Parties are deemed to be signing the 2021 Standard Contractual Clauses and their applicable Appendices.”

Source: recraft.aiOpening paragraph and international transfersChecked on

Processors

Who else handles Recraft data?

Sub-processors (companies that handle the data for them)

Checked

Published.

Yes: https://www.recraft.ai/subprocessors lists 35 sub-processors plus 8 external model providers (43 rows). AI providers include Anthropic, OpenAI, Google, Black Forest Labs, Ideogram AI, Fal, OpenRouter and Runware.

Vendor's wording: “Recraft, Inc. engages the following external model providers to enable image generation”

Source: recraft.aiRecraft Subprocessors; External model providersChecked on

EU–US Data Privacy Framework

Checked

Not listed.

No listing found for search term 'Recraft'

Source: dataprivacyframework.govSearch 'Recraft' returned 'Query returned no results'Checked on

Retention

How long does Recraft keep your data?

How long data is kept

Checked

No fixed period for content. Deleting an account permanently erases personal data; images made on a paid plan stay private and yours. API results are deleted within 24 hours. Deleting a Teams workspace removes all its data.

Vendor's wording: “If a user deletes their account, all personal data is permanently erased.”

Source: recraft.aiDeletion; FAQChecked on

Security

Which certifications and admin controls does Recraft have?

Security certifications

Checked

Two named: SOC 2 Type 2 and AIUC-1 (AI agent safety). PCI DSS is held by its payment processors, not by Recraft. GDPR alignment is stated, not a certificate.

Vendor's wording: “Recraft is AIUC-1 certified by the Artificial Intelligence Underwriting Company.”

Source: recraft.aiSOC 2 certification; AIUC-1 certification; PCI DSS complianceChecked on

The vendor doesn't say: data location, EU hosting, admin controls, price.

Alternatives

Recraft alternatives that don't train on your data

Other design, images and video tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Canva

    Business · €170 / user / yr

    Doesn't train on your dataEU hosting only on higher plans · DPA on request

    ✓✕✓✓✓

  • remove.bg

    monthly subscription · See details

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✓

  • Synthesia

    Pro · $89 / mo

    Doesn't train on your dataNo EU hosting · DPA on request

    ✓✕✓✓✓

  • VEED

    Business · See details

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓?✓

  • Gamma

    Business · €35 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✕

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices