GDPR and form, research and storage tools: 22 checked
22 tools, 4 of which don't train on your data, keep it in the EU and include a DPA. From the vendors' own pages.
Checked on
Which form and storage tools are GDPR compliant?
Each tool's business plan where there is one, against your five rules. 11 tools without a page of their own open their answers with “Show answers”.
The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.
- Cal.com
Teams · $12 / user / mo
Doesn't train on your dataNo EU hosting · DPA on request
✓✕✓✓✓
- Comet
Perplexity Enterprise Pro · See details
Doesn't train on your dataEU hosting not documented · DPA in the terms
✓?✓?✓
- Consensus
Team · See details
Doesn't train on your dataEU hosting not documented · DPA not stated
✓???✕
Show answers
- Trains on your data by default?
Doesn't train on your data.
No. The privacy policy says queries, content and personal information are never used to train AI models, Consensus's own or third parties'. The policy covers all users; no plan-specific statement.
“We do not use your data to train large language models. Your queries, content, and personal information are never used to train AI models”
Source: consensus.app · Checked on
- How to switch training off
Nothing to switch off: this plan doesn't train on your data.
Nothing to do: the privacy policy states user content is never used to train AI models, ours or third parties'.
“Your queries, content, and personal information are never used to train AI models — neither our own nor those of any third party.”
Source: consensus.app · Checked on
- Where data is stored by default
United States: the privacy policy says all Consensus servers are located in the United States.
“We are headquartered in the United States of America and all our servers are located in the United States.”
Source: consensus.app · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Consensus NLP'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Kept as long as reasonably necessary, with no fixed period. Users can delete: Settings > 'Clear thread history' removes searches and conversations; 'Delete account' closes the account. Providers can keep content briefly under their own terms.
“Clear your search history. In Settings, “Clear thread history” deletes your searches and their associated conversations from Consensus.”
Source: consensus.app · Checked on
- Dia
Better Answers · $10 / mo
Trains on your data unless you switch it offEU hosting not documented · DPA not stated
✕???✕
- Doodle
Team · See details
Doesn't say whether it trains on your dataNo EU hosting · DPA in the terms
?✕✓✓✓
Show answers
- Where data is stored by default
EU: cloud hosting (AWS) and database (MongoDB Atlas) in Germany and Ireland.
“Amazon Web Services, Inc | Cloud Hosting Provider | Germany, Ireland”
Source: doodle.com · Checked on
- EU hosting on this plan
No EU hosting.
Not a setting: default hosting is already in Germany and Ireland (EU). No region choice is described.
“MongoDB Atlas | Cloud Database | Germany, Ireland”
Source: doodle.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The General Data Processing Terms apply automatically on top of the Terms of Service; a fuller DPA with SCCs is part of the Master Services Agreement for contracted orders.
“these General Terms and Conditions of the Processing of Personal Data apply in addition to the applicable general Terms of Service”
Source: doodle.com · Checked on
- Sub-processors (companies that handle the data for them)
Published.
Yes, public: https://doodle.com/en/data-subprocessors/ (dated 23 September 2026). 12 entries. No AI or model provider is listed.
“Following is Doodle's current list of Subprocessors authorized to process customer data for Doodle's services:”
Source: doodle.com · Checked on
- EU–US Data Privacy Framework
EU or Swiss vendor.
Not applicable (Swiss-based vendor, Doodle AG, Zurich)
“Doodle AG with the business address of Werdstrasse 21, 8004 Zurich, Switzerland”
Source: doodle.com · Checked on
- How long data is kept
After the contract ends Doodle deletes personal data as soon as possible and at the latest within 180 days; users can also delete polls manually any time.
“Doodle will delete the personal data upon termination of the contractual relationship with you as soon as possible and at the latest within a maximum period of 180 days”
Source: doodle.com · Checked on
- Security certifications
2 named: SOC 2 Type II and Cyber Verify Level 3 (MSP Verify); the page also claims GDPR, CCPA and HIPAA compliance.
“Doodle has successfully completed its SOC 2 Type II examination and the MSP Verify Program.”
Source: doodle.com · Checked on
- Elicit
Scale · $89 / user / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓?✕
Show answers
- Where data is stored by default
United States: the privacy policy says Elicit's servers are located in the United States.
“Our servers are located in the United States.”
Source: elicit.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. Elicit's Data Processing Addendum, with EU Standard Contractual Clauses, is public and the team subscription agreement incorporates it.
“Elicit's Data Protection Agreement, which can be found at elicit.com/operations/dpa, and which is hereby incorporated into this Agreement”
Source: elicit.com · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Elicit'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Personal data is kept only as long as necessary; uploaded PDFs stay until the user deletes them; on Scale cancellation team accounts are closed and locked; under the DPA data is kept for the term of the agreement. No fixed number of days is given.
“PDFs you upload are encrypted and remain private to your account only, until you choose to delete them.”
Source: support.elicit.com · Checked on
- Fillout
Business · $75 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✓✕
Show answers
- Where data is stored by default
United States by default for form submission data (hosted on AWS via Render).
“By default, form submission data is stored and processed in the United States.”
Source: fillout.com · Checked on
- EU hosting on this plan
EU hosting not documented.
Only on the Team and Enterprise plans, on request by email or chat; the pricing page does not list a Team plan and does not name Business, so EU hosting for Business is not confirmed.
“After upgrading to the Team or Enterprise plan (if you aren’t already on one), email support@fillout.com or start a chat on our website to request EU hosting.”
Source: fillout.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The standard DPA is available to any customer on any plan at main.fillout.com/dpa, and includes the EU Standard Contractual Clauses.
“our standard DPA is available to any customer, on any plan, at main.fillout.com/dpa”
Source: fillout.com · Checked on
- Sub-processors (companies that handle the data for them)
Published.
Yes, public: https://www.fillout.com/help/subprocessors. 18 rows for Fillout. AI providers: OpenAI (US) and Microsoft Azure (EU) for transcription, opt-in only.
“OpenAI AI + transcription US (does not apply for EU submission hosting customers)”
Source: fillout.com · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Fillout', 'Restly', 'Zite'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Customer can delete forms, responses or the account at any time; Fillout deletes them from servers and backups within 45 days of deletion or a request.
“Fillout will permanently delete forms, individual form responses, or your user data from our servers and backups, if deleted in Fillout or requested from privacy@fillout.com, within 45 days.”
Source: fillout.com · Checked on
- Security certifications
1 named: SOC 2 Type 2.
“are SOC 2 Type 2 compliant”
Source: fillout.com · Checked on
- Admin controls for AI
Not on this plan. An admin can switch off all AI features organisation-wide (Settings > Security), but only on the Enterprise plan.
“Admins can turn off AI features for everyone in the organization from Settings → Security.”
Source: fillout.com · Checked on
- Formstack Forms
$83 / mo
Doesn't train on your dataEU hosting not documented · DPA on request
✓?✓✕✓
- Google Drive
Google Workspace Business Standard · €13.60 / user / mo
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓✓✓
- Google Forms
Google Workspace Business Standard · €13.60 / user / mo
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓✓✓
- Jotform
Silver · See details
Doesn't train on your dataEU hosting available · DPA on request
✓✓✓✓✓
- Microsoft Bookings
included in Microsoft 365 Business Standard · See details
Doesn't say whether it trains on your dataEU hosting available · DPA in the terms
?✓✓✓✓
Show answers
- Where data is stored by default
Inside the customer's Microsoft 365 tenant: Bookings data sits in Exchange Online shared mailboxes, like other Microsoft 365 data. For EU customers the EU Data Boundary keeps storage in the EU or EFTA.
“All Bookings data is stored within the Microsoft 365 platform and in Exchange Online.”
Source: learn.microsoft.com · Checked on
- EU hosting on this plan
EU hosting available.
Yes for EU customers through the EU Data Boundary, which keeps Customer Data in EU or EFTA datacentres; Bookings itself has no region setting.
“The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data”
Source: learn.microsoft.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The Microsoft Data Protection Addendum covers processing of Customer Data and personal data in Microsoft products and takes precedence over other licensing terms; it applies through the licence terms.
“The Data Protection Addendum, or DPA (defined in the Glossary) sets forth the parties obligations with respect to the processing and security of Customer Data, Professional Services Data, and Personal Data by the Products.”
Source: microsoft.com · Checked on
- Sub-processors (companies that handle the data for them)
Published.
Yes, public as a downloadable Microsoft Online Services Subprocessor List; entry count not captured. It covers all Microsoft Online Services under the DPA.
“The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services.”
Source: microsoft.com · Checked on
- EU–US Data Privacy Framework
On the list.
Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)
Source: dataprivacyframework.gov · Checked on
- How long data is kept
After a subscription ends, Microsoft keeps customer data for 90 days in a limited-function account, then deletes it, including backups, within a further 90 days. A Bookings calendar is deleted by deleting its Exchange mailbox.
“If you terminate a cloud subscription or it expires (except for free trials), Microsoft will store your customer data in a limited-function account for 90 days”
Source: microsoft.com · Checked on
- Security certifications
Microsoft 365 lists ISO 27001, ISO 27018, ISO 27701, SOC 2 and C5 (5); Bookings is not named in the scope lists, but its data is held in Exchange Online, which is.
“Exchange Online, Exchange Online Protection, Forms”
Source: learn.microsoft.com · Checked on
- Microsoft Copilot Chat in Microsoft Edge
work account, included with Microsoft 365 · See details
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓✓✓
- Microsoft Forms
Microsoft 365 Business Standard · See details
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✕✓
Show answers
- Where data is stored by default
Follows the tenant's home region: EU or EFTA tenants get the EU/EFTA geography; other European tenants get Europe; Australian tenants that set up Forms before 12 Oct 2022 get Australia; all other locations get the United States.
“Countries or regions in the European Union (EU) or European Free Trade Association (EFTA) Macro Region Geography 4 - European Union/EFTA”
Source: learn.microsoft.com · Checked on
- EU hosting on this plan
EU hosting not documented.
Default placement only: for EU or EFTA tenants Forms data is stored in the EU/EFTA geography, but Microsoft states these services carry no specific data-residency commitment unless the Product Terms say so. No setting to choose.
“Unless otherwise stated in the Microsoft Product Terms, the following Microsoft 365 services don't have specific commitments for Data Residency.”
Source: learn.microsoft.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The Microsoft Products and Services Data Protection Addendum sets the data processing and security terms for products bought under the Product Terms, which includes Microsoft 365.
“the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site”
Source: microsoft.com · Checked on
- EU–US Data Privacy Framework
On the list.
Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)
Source: dataprivacyframework.gov · Checked on
- How long data is kept
While the subscription is active the customer can access, extract or delete data. After the subscription ends Microsoft keeps data 90 days in a limited-function account, then deletes it, and in any case within 180 days. A deleted Entra user's Forms data is deleted 30 days later.
“If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data.”
Source: learn.microsoft.com · Checked on
- Security certifications
4 named with Forms in scope: ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27018 and SOC 2 (commercial cloud). ISO 42001 and C5 pages do not list Forms.
“Access Online, Azure Communications Service, Compliance Manager, Customer Lockbox, Delve, Exchange Online, Exchange Online Protection, Forms, Griffin”
Source: learn.microsoft.com · Checked on
- Motion
Business AI · $29 / user / mo
Trains on your data, with no documented way to stop itNo EU hosting · DPA not stated
✕✕?✓✕
- OneDrive for Business
Plan 1 · See details
Doesn't say whether it trains on your dataEU hosting available · DPA in the terms
?✓✓–✓
Show answers
- Where data is stored by default
No fixed country: Microsoft ties data-at-rest commitments to the tenant's sign-up country or region (EU, US or a local-region country); the admin centre shows the actual location under Settings > Org Settings > Organization Profile > Data Location.
“Tenant has a sign-up country/region included in Local Region Geography, the European Union or the United States.”
Source: learn.microsoft.com · Checked on
- EU hosting on this plan
EU hosting available.
Yes. The Product Terms data-residency commitment is open to tenants whose sign-up country is in the EU; country-level residency (e.g. Germany) needs the paid Advanced Data Residency add-on.
“Tenant has a sign-up country/region included in Local Region Geography, the European Union or the United States.”
Source: learn.microsoft.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. OneDrive is a Microsoft Online Service governed by the Microsoft Products and Services Data Protection Addendum, part of Microsoft's standard commercial contract.
“This list is applicable for all Microsoft Online Services governed by the Microsoft Data Protection Addendum.”
Source: microsoft.com · Checked on
- Sub-processors (companies that handle the data for them)
Behind sign-in.
Yes: the Microsoft Online Services Subprocessor List, downloadable via the Trust Center and Service Trust Portal. Entries not counted (document download); AI providers not read.
“The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services.”
Source: microsoft.com · Checked on
- EU–US Data Privacy Framework
On the list.
Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)
Source: dataprivacyframework.gov · Checked on
- How long data is kept
After a subscription ends, Microsoft keeps data in a limited-function account for 90 days, then deletes it within a further 90 days. A deleted user's OneDrive is kept 30 days by default (admins can change this).
“Microsoft will store your customer data in a limited-function account for 90 days (the “retention period”) to give you time to extract the data or renew your subscription.”
Source: microsoft.com · Checked on
- Security certifications
Microsoft lists ISO 27001, 27017, 27018, 27701, 42001, 9001 and SOC 1/2/3 (9 standards) among its Microsoft 365 compliance offerings; the page does not say which apply to OneDrive specifically.
“ISO 27017 ISO 27018 ISO 27701 ISO 42001 ISO 9001 SOC 1 SOC 2 SOC 3”
Source: learn.microsoft.com · Checked on
- pCloud Business
See details
Doesn't say whether it trains on your dataEU hosting available · DPA not stated
?✓??✓
Show answers
- Where data is stored by default
No default: the customer chooses EU (Luxembourg) or US (Dallas, Texas) before signing up.
“pCloud offers two options: the United States (Dallas, Texas) and the European Union (Luxembourg).”
Source: pcloud.com · Checked on
- EU hosting on this plan
EU hosting available.
Yes. Choose the European Union (Luxembourg) at sign-up; files, account metadata and backups stay in that region. A later change costs a one-time $19.99 and only the account owner can request it on Business accounts.
“All your files, account metadata, and backups are stored exclusively in the data region you select.”
Source: pcloud.com · Checked on
- EU–US Data Privacy Framework
EU or Swiss vendor.
Not applicable (Swiss-based vendor, pCloud International AG, Baar)
“This Business Agreement (the "Agreement") is between pCloud International AG, a Swiss corporation ("pCloud") with principal place of business 74 Zugerstrasse at Str, 6340 Baar, Switzerland”
Source: pcloud.com · Checked on
- How long data is kept
Deleting an account removes files and personal data from pCloud's servers after 30 days. The Business Agreement says only that pCloud may delete data 'after a commercially reasonable period' once the agreement ends. Business plans keep file history up to 180 days.
“If you delete your pCloud account, your files and personal data will be permanently removed from our servers after 30 days.”
Source: pcloud.com · Checked on
- Security certifications
ISO 27001:2013 is listed on the security page (shown as two certificates, ISMS and QMS); the Business page also names ISO 9001. 2 standards.
“Certifications ISO 27001:2013 ISMS Helps businesses manage risks, safeguard sensitive information, and comply with global security best practices.”
Source: pcloud.com · Checked on
- Price, as shown in Germany
See details.
9.99 EUR per user on the first plan card (3-user minimum: 29.97 EUR for 3 users, 3 TB storage); the next card shows 14.98 EUR per user (6 TB for 3 users). Card names and the monthly/annual toggle state did not render, so billing basis is unconfirmed.
“3 USERS / 3 TB STORAGE 29.97EURMONTH 9.99 EUR PER USER”
Source: pcloud.com · Checked on
- Reclaim
Starter · $10 / user / mo
Doesn't train on your dataEU hosting not documented · DPA in the terms
✓?✓✓✓
- Scite
Pro, team seats · $40 / user / mo
Doesn't train on your dataEU hosting not documented · DPA not stated
✓???✕
Show answers
- Trains on your data by default?
Doesn't train on your data.
No. Scite's Terms of Service (section 7.3) say its licence to user content does not include any right to use Customer Data for training, fine-tuning or improving large language models or other machine-learning systems; the privacy policy repeats this.
“this license does not include any right to use Customer Data (including Media) for the training, fine-tuning, retraining, or improvement of large language models or other machine learning systems”
Source: scite.ai · Checked on
- How to switch training off
Nothing to switch off: this plan doesn't train on your data.
Nothing to do: Scite's Terms of Service and privacy policy state it does not use Customer Data to train, fine-tune or improve AI models.
“this license does not include any right to use Customer Data (including Media) for the training, fine-tuning, retraining, or improvement of large language models or other machine learning systems”
Source: scite.ai · Checked on
- Where data is stored by default
United States: Scite says most operations are conducted in the United States and personal information is processed there. No hosting provider named.
“most of our operations are conducted in the United States and in order to provide the Service, personal information will be processed in the United States”
Source: scite.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Scite', 'Research Solutions'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Account data is kept while the account exists plus 10 years after that to meet contract obligations; Scite will securely delete it on request. Marketing data is kept up to 10 years from last contact.
“related to your account for as long as you have an account with us in order to meet our contractual obligations to you and for 10 years after that”
Source: scite.ai · Checked on
- SurveyMonkey
Team Advantage · €30 / user / mo
Trains on your data, with no documented way to stop itEU hosting not documented · DPA in the terms
✕?✓✓✓
- Tally
Pro · €20 / mo
Doesn't say whether it trains on your dataNo EU hosting · DPA in the terms
?✕✓✓✓
Show answers
- Where data is stored by default
EU: all form data is stored in Europe; the sub-processor table lists Google Cloud (Belgium) for hosting and storage.
“All Tally form data is encrypted both in transit and at rest, and stored in Europe.”
Source: tally.so · Checked on
- EU hosting on this plan
No EU hosting.
Not needed: data is stored in the EU for every plan by default, with no setting to change.
“Your data is stored on high-security servers within the European Union.”
Source: tally.so · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. A DPA with EU Standard Contractual Clauses is part of the terms: creating an account binds professional users to it on behalf of their company, and no signature is needed.
“professional users also agree, on behalf of their company, to the content of our Data Processing Agreement and accept to be bound by it. It is not necessary to sign this document.”
Source: tally.so · Checked on
- Sub-processors (companies that handle the data for them)
Published.
Yes, public on the GDPR help page: 15 rows, 12 companies (Cloudflare 3 rows, Google 2 rows). AI-related: Google AI Studio (abuse detection and AI assistant, opt-in), plus turbopuffer for search.
“Abuse detection & AI assistant (opt-in)”
Source: tally.so · Checked on
- EU–US Data Privacy Framework
EU or Swiss vendor.
Not applicable (EU-based vendor, Tally BV, Ghent, Belgium)
“with registered office at Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium and registered with the Crossroads Bank for Enterprises”
Source: tally.so · Checked on
- How long data is kept
Form data stays while the account is active and the customer controls it. Deleted submissions are permanently removed from backups within 90 days. Account profile data is kept 90 days after account deletion (some categories 2 or 7 years). Auto-delete after a set period is Business-only.
“all form data which has been deleted by you is permanently deleted from our back-ups within 90 days, unless you empty the Trash manually before that.”
Source: tally.so · Checked on
- Price, as shown in Germany
€20 / mo.
EUR 20 per month as shown on the page; yearly billing is offered with 2 months off. Includes unlimited team members. VAT treatment is not shown.
“Invite unlimited team members to shared workspaces.”
Source: tally.so · Checked on
- Tresorit SecureCloud for Businesses
Business · See details
Doesn't say whether it trains on your dataEU hosting available · DPA in the terms
?✓✓?✓
Show answers
- Where data is stored by default
Ireland, unless the customer uses the data-residency option.
“Customers without Data Residency Options are automatically assigned to Ireland.”
Source: tresorit.com · Checked on
- EU hosting on this plan
EU hosting available.
Yes. The Business plan includes data residency options; admins assign users to a data centre such as France, Germany, Ireland or the Netherlands (also Switzerland, UK, US and others).
“Data Residency Options are available for Business and Enterprise customers.”
Source: tresorit.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. Business Subscriptions subject to EU data protection law agree to the Data Processing Addendum, which is available inside the Tresorit app.
“If Customer has a Business Subscription and is subject to EU Data Protection Laws, Customer agrees to the Data Processing Addendum (available through the Tresorit application).”
Source: tresorit.com · Checked on
- EU–US Data Privacy Framework
EU or Swiss vendor.
Not applicable (Swiss-based vendor, Tresorit AG, Zurich)
“Tresorit services are provided by Tresorit AG (company registration no: CHE-349.825.210; address: Pfingstweidstrasse 60b., 8005 Zurich, Switzerland)”
Source: tresorit.com · Checked on
- How long data is kept
Deleted folders and their encrypted content are removed automatically within 90 days (Tresorit may keep data up to 60 days after deletion). Personal data held for a company follows the data processing agreement.
“Once you delete a Tresorit Folder for any reason, Your Encrypted Content will also be automatically deleted within 90 days.”
Source: tresorit.com · Checked on
- Security certifications
ISO 27001:2022, certified by TÜV Rheinland (1 certification named). The compliance page also lists TISAX and CJIS as frameworks without saying whether they are certified.
“Tresorit has certification for compliance with ISO 27001:2022.”
Source: tresorit.com · Checked on
Which form and storage tools keep data in the EU?
- Google Drive · EU available
- Google Forms · EU available
- Jotform · EU available
- Microsoft Bookings · EU available
- Microsoft Copilot Chat in Microsoft Edge · EU available
- OneDrive for Business · EU available
- pCloud Business · EU available
- Tresorit SecureCloud for Businesses · EU available
- All tools
Which form and storage tools train on your data?
- Dia · Trains on your data unless you switch it off
- Motion · Trains on your data, with no documented way to stop it
- SurveyMonkey · Trains on your data, with no documented way to stop it
- All tools
Other questions and types of tool
No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.
Need something your tools can't do?
We design and build what your team is missing, around the way you already work and the data rules you set.