Resemble AI Team and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes, in a limited form: the Terms let Resemble keep and use non-identifiable "Aggregated Data" derived from your content for "internal learning and training". Detection media is not used for training unless you opt in in writing.

Vendor's wording: “Resemble AI shall retain and own all right, title and interest in and to such Aggregated Data, which may be used for troubleshooting, bug fixes, continuous development and improvement of our services and processes, internal learning and training”

Source: resemble.aiContent section: Aggregated Data; No model training on Detection MediaChecked on 20 October 2026

United States: Google Cloud Platform us-east4 (Virginia), Render (Oregon) and Cerebrium (US)

Vendor's wording: “The Services are hosted and operated in the United States through Resemble AI and its service providers, principally Google Cloud Platform (us-east4, Virginia), Render (Oregon) and Cerebrium (United States).”

Source: resemble.aiTransfers of Personal DataChecked on 19 October 2026

No EU hosting.

No for self-service plans: regional hosting (e.g. UK) is only for enterprise customers under a negotiated agreement; self-service data is processed on the standard US infrastructure

Vendor's wording: “Self-service customers acknowledge and accept that their data will be processed on Resemble AI's standard infrastructure.”

Source: docs.google.comSection 8.6Checked on 19 October 2026

DPA in the terms.

Yes: Resemble AI publishes a Data Processing Agreement (last updated 17 March 2026) for business customers; the Terms incorporate it, and it includes EU SCCs

Vendor's wording: “Our Data Processing Agreement, which governs the processing we carry out on behalf of business customers, is available at”

Source: resemble.aiSection 2 Our role when we serve business customersChecked on 19 October 2026

Not listed.

No listing found for search term 'Resemble AI'

Source: dataprivacyframework.govSearch 'Resemble AI' returned 'Query returned no results'Checked on 19 October 2026

Text sent for speech synthesis and the generated audio are kept in an archive for retrieval and deleted within 30 days of your deletion request (support@resemble.ai). Voice models and training audio stay archived after the contract ends until you ask for deletion.

Vendor's wording: “Input text and generated audio retained for archival retrieval; deleted within 30 days of Controller's deletion request”

Source: docs.google.comAnnex 1 B: Text-to-Speech Inference; Section 11 Data Return and Deletion (DPA, last updated 17 March 2026)Checked on 20 October 2026

2 named: ISO/IEC 27001:2022 certified, and a SOC 2 Type II examination completed (Security, Availability, Confidentiality; 2026 report). The Trust Center also states GDPR and HIPAA compliance.

Vendor's wording: “Resemble AI is ISO/IEC 27001:2022 certified.”

Source: trust.resemble.aiCompliance; Resources (2026 SOC 2 Type 2 Report, ISO 27001:2022 Certificate)Checked on 20 October 2026