GDPR-compliant CRM, email marketing and support tools: 44 checked

Trains on your data, with no documented way to stop it.

Yes: ActiveCampaign may view, copy and internally use marketing content to train and improve its services, and uses contact data to train as part of the services; no opt-out is described

Source: activecampaign.com · Checked on 17 October 2026

DPA on request.

Yes, by signature: the client signs ActiveCampaign's DPA (updated 10 Apr 2026), which supplements the terms; ActiveCampaign notes not all customers need to sign one

Source: activecampaign.com · Checked on 17 October 2026

8 listed.

Public. 8 entries: AWS (storage; US, EU, Australia), Cloudflare, Snowflake, Zendesk, Zight, Twilio, AWS Bedrock and OpenAI for AI features; plus affiliates

Source: activecampaign.com · Checked on 17 October 2026

On the list.

Active (ActiveCampaign, LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 17 October 2026

No certificate named; ActiveCampaign says it is 'heavily focused on GDPR, SOC 2, and HIPAA compliance'

Source: activecampaign.com · Checked on 17 October 2026

United States: Buffer is US-based and its listed hosting and database providers (AWS, MongoDB Atlas) are in the USA.

“Amazon Web Services (AWS), Inc Cloud (hosting) service USA”

Source: buffer.com · Checked on 19 October 2026

DPA in the terms.

Yes: buffer.com/legal says users and external parties can receive a data protection agreement, linked as "Buffer Data Processing Addendum" on DocHub; the terms inside it could not be read.

“We have created a legal agreement that users and external parties can receive from us”

Source: buffer.com · Checked on 19 October 2026

Published.

Yes, public at buffer.com/legal (Our list of sub-processors): 26 entries; AI providers listed are OpenAI and Anthropic.

“OpenAI Artificial Intelligence USA Plain”

Source: buffer.com · Checked on 19 October 2026

On the list.

Active (Buffer; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Content you upload is stored indefinitely until you delete it or your account; invoice data is kept up to 7 years after last payment.

“We store User Content indefinitely.”

Source: buffer.com · Checked on 19 October 2026

The Services Privacy Notice says the services can be provided, supported and hosted in the United States; processing can also occur in the UK, EU and Australia, depending on the customer's setup. No fixed region promised.

“the Services may be provided, supported, and hosted in the United States.”

Source: campaignmonitor.com · Checked on 19 October 2026

DPA on request.

Yes, on request: email privacy contact with your legal entity name and the Marigold entity you contract with to execute a DPA.

“To execute a Data Protection Agreement (often referred to as a “Data Processing Agreement” or “DPA”), please submit a request to”

Source: campaignmonitor.com · Checked on 19 October 2026

Parent company listed.

Not listed under its own name (Campaign Monitor Pty Ltd); its parent Marigold Group Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Campaign Monitor can delete Customer Content within 30 days after the agreement ends; during the term it is kept until the customer requests deletion. AI input retention not stated.

“Company may delete Customer Content and/or any archived data within 30 days after the date of expiration or any termination of this Agreement.”

Source: campaignmonitor.com · Checked on 19 October 2026

1 certification listed on the trust centre: SOC 2 Type 1. GDPR is also listed as a compliance badge.

“Certifications GDPR SOC 2 Type 1”

Source: campaignmonitor.com · Checked on 19 October 2026

United States: the sub-processor list places Amazon Web Services (cloud service provider) in the USA; the terms, privacy policy and DPA name no storage region for customer content.

“Clay Subprocessors Subprocessors Purpose Location Additional Information Amazon Web Services Cloud service provider USA”

Source: docs.google.com · Checked on 19 October 2026

DPA on request.

Yes. A public DPA is incorporated by reference into the customer agreement; the privacy policy also says DPAs are given on request, and a custom DPA is listed as an Enterprise feature.

“is incorporated by reference into the applicable agreement governing Customer’s use of Clay’s services”

Source: clay.com · Checked on 19 October 2026

Published.

Yes, public Google Doc linked from the DPA: 32 sub-processors plus a second table of 164 third-party data providers. AI providers listed: Anthropic, Cohere, Fireworks, Google Gemini, Mistral, OpenAI.

“Clay Subprocessors Subprocessors Purpose Location Additional Information Amazon Web Services Cloud service provider USA”

Source: docs.google.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Clay Labs'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept while the account is active; deleting the account deletes the data, and users can request deletion by email. After termination the customer may ask for its data to be returned, then Clay deletes remaining copies.

“Clay Labs retains user data as long as your user account is active. If your account is deleted, your data is deleted with it.”

Source: clay.com · Checked on 19 October 2026

Germany and the EU: servers exclusively in Germany and the EU; data centres are in the European region.

“CleverReach guarantees top data security thanks to its servers, which are exclusively located in Germany and the EU.”

Source: cleverreach.com · Checked on 19 October 2026

No EU hosting.

Not a setting: all customer data is stored only in Germany/the EU by default.

“All data is stored in our secure data centers exclusively in the European region.”

Source: cleverreach.com · Checked on 19 October 2026

DPA on request.

Yes, but not automatic: the terms say a DPA must be concluded separately, and customers sign it online in their account.

“Our customers can easily sign this contract with us online in their account.”

Source: cleverreach.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, CleverReach GmbH & Co. KG, Rastede, Germany)

“CleverReach GmbH & Co. KG”

Source: cleverreach.com · Checked on 19 October 2026

Not stated for stored data during the contract. After termination the customer may demand in writing that stored order data be deleted without delay; no fixed deletion period given.

“After termination of the cooperation in the sense of this contract, the Client may demand that the order data stored in the database during the cooperation be deleted by the Provider without delay.”

Source: cleverreach.com · Checked on 19 October 2026

2 certifications named for its data centres (DIN ISO/IEC 27001, PCI DSS Level 1 service provider), plus annual SOC 1 tests; not CleverReach's own certificates.

“They have also received DIN ISO/IEC 27001 certification and have been confirmed as Level 1 service providers for the data security standard of the credit card industry (DSS/PCI).”

Source: cleverreach.com · Checked on 19 October 2026

See details.

18 € per month for the Pro plan at 500 recipients (default tier shown), plus statutory VAT; payment is made annually in advance and the monthly price is the annual price divided by 12.

“Payment is made annually in advance. The monthly price is merely a mathematical representation of the annual price.”

Source: cleverreach.com · Checked on 19 October 2026

United States, on Amazon Web Services (the privacy policy gives the place of processing for AWS hosting as the US).

“hosting and backend service provided by Amazon Web Services, Inc. Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States”

Source: close.com · Checked on 19 October 2026

DPA on request.

Yes, provided to any customer who needs one: Close's DPA includes Standard Contractual Clauses; the GDPR page offers it for e-signing or as a PDF (dated 7 Feb 2023).

“Close provides Data Processing Agreements to any customer who may need them.”

Source: close.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Close'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept while the account is active or a limited time needed for the purpose. Deleting a lead removes it from all systems within 30 days; full removal on email request to support@close.com. No fixed period after cancellation stated.

“simply delete the lead within Close and within 30 days that information will be completely removed from our systems”

Source: close.com · Checked on 19 October 2026

1 named: SOC 2 Type 2. GDPR and CCPA compliance statements; no ISO 27001 named.

“As a SOC 2 Type 2 certified SaaS provider, Close securely manages your data to protect the interests and privacy of your organization.”

Source: close.com · Checked on 19 October 2026

Mainly Ireland: the DPA says Cognism's production infrastructure is on AWS, primarily in the eu-west-1 region (Ireland). Cognism also says it generally keeps collected data inside the EEA.

“Infrastructure is primarily deployed in eu-west-1 region (Ireland)”

Source: cognism.com · Checked on 19 October 2026

DPA in the terms.

Yes. A public Data Processing Addendum (v2, July 2026) applies to the services agreement between Cognism and the customer.

“This Data Processing Addendum (“DPA”) sets forth the terms and conditions relating to the privacy, confidentiality”

Source: cognism.com · Checked on 19 October 2026

UK (EU adequacy).

Not applicable (UK-based vendor, Cognism Limited, London)

“Cognism Limited, C/O Worldwide Corporate Advisors, 30–34 New Bridge Street, London EC4V 6BJ, United Kingdom”

Source: cognism.com · Checked on 19 October 2026

No fixed retention period: customer data is kept only as long as necessary. Under the DPA, within 30 days after the agreement ends Cognism stops processing and, on the customer's written request, deletes or returns it.

“Within thirty (30) days following the termination or expiry of the Agreement, Cognism shall cease”

Source: cognism.com · Checked on 19 October 2026

ISO 27001, ISO 27701 and SOC 2 Type II (security and availability): 3.

“Cognism holds the following certifications and attestations: ISO 27001 ISO 27701 SOC 2 Type II (Security and Availability)”

Source: cognism.com · Checked on 19 October 2026

United States.

“The servers used to provide these hosting services are located in the United States.”

Source: copper.com · Checked on 19 October 2026

No EU hosting.

No. Copper says it cannot store data in other locations.

“Copper is unable to accommodate requests to store data in other locations.”

Source: copper.com · Checked on 19 October 2026

DPA on request.

Yes. The Data Protection Addendum is incorporated by reference into the terms and applies where customer content includes personal information.

“The terms of the Data Protection Addendum (link) are incorporated by reference into this TOS and shall apply to the extent any Customer Content includes Personal Information”

Source: copper.com · Checked on 19 October 2026

Published.

Yes: the Copper help article 'Copper Sub-Processors' (last updated May 2026) lists 23 providers, including OpenAI, L.L.C. (USA) for generative AI services.

“Loggly USA Product OpenAI, L.L.C. USA Generative AI services”

Source: support.copper.com · Checked on 20 October 2026

On the list.

Active (Copper; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Doesn't say whether it trains on your data.

Not stated for Customer.io itself. Its terms say its third-party AI providers are contractually prohibited from using inputs or outputs to train their foundation models, and that data is processed solely to deliver the requested AI feature.

“Customer.io's third-party AI providers are contractually prohibited from using your inputs or outputs to train their foundation models.”

Source: customer.io · Checked on 19 October 2026

Nothing to do for providers (they may not train). Separately, an admin can switch off Customer.io AI under Privacy, Data, & AI settings, after which no data goes to AI providers.

“you may disable AI Features for your account at any time through your Privacy, Data, & AI settings.”

Source: customer.io · Checked on 19 October 2026

EU hosting available.

Yes: EU data centres are available; data can be ingested, processed and stored in the chosen region. Plan eligibility is not stated.

“With our US and EU data centers, you can ingest, process, and store your data in the region that meets all your business and legal requirements.”

Source: customer.io · Checked on 19 October 2026

DPA in the terms.

Yes, published DPA is part of the agreement and applies to personal data processing; it can be downloaded and co-executed, and includes the EU Standard Contractual Clauses.

“Customer.io's Data Processing Addendum, solely with respect to the processing of Personal Data”

Source: customer.io · Checked on 19 October 2026

Published.

Yes, https://customer.io/legal/sub-processors (revised October 2026): 9 entries. AI providers: OpenAI, Google Cloud (Vertex AI), Anthropic (Claude).

“Below is a list of subprocessors we work with and the purpose for why we use their services.”

Source: customer.io · Checked on 19 October 2026

On the list.

Active (Peaberry Software Inc; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Personal data kept for the duration of the agreement; at the end the customer elects deletion after a chance to download, except data the law requires to be kept. No fixed day count and no AI-prompt retention period stated.

“Upon termination or expiration of the Agreement, Customer.io will (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data”

Source: customer.io · Checked on 19 October 2026

1 certification stated: SOC 2 Type II. HIPAA compliance is claimed; ISO 27001 appears as a badge and FAQ heading but its status is not spelled out in the page text.

“Our platform is HIPAA compliant and SOC 2 Type II certified.”

Source: customer.io · Checked on 19 October 2026

Yes: AI Features are on by default and can be disabled for the whole account at any time in Privacy, Data, & AI settings. Plan restrictions not stated.

“While AI Features are enabled by default within the CIO Platform, you may disable AI Features for your account at any time”

Source: customer.io · Checked on 19 October 2026

Doesn't train on your data.

No for generalized AI/ML models: Frase says it does not use Customer Data to train generalized models that learn from you for other customers; it does use anonymised, aggregated data to improve its services and for industry benchmarks.

“Frase does not use Customer Data to develop or train generalized artificial intelligence or machine learning models”

Source: frase.io · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do for generalized model training, which the terms say Frase does not do. To stop your data feeding anonymised industry benchmarks, email support@frase.io (takes effect within 24 hours).

“You can opt your account out of benchmark contribution at any time by emailing support@frase.io”

Source: frase.io · Checked on 19 October 2026

Not listed.

No listing found for search term 'Copysmith', 'Frase'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Account information is kept while the account is active and a reasonable period afterwards; team-managed accounts keep content as the organisation's administrator requires. No fixed number of days.

“We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services.”

Source: frase.io · Checked on 19 October 2026

1 named: SOC 2 Type II (attested); GDPR compliance is claimed but is not a certificate.

“Frase is SOC 2 Type II attested and GDPR compliant.”

Source: frase.io · Checked on 19 October 2026

United States: Kit says it stores data on servers located in the United States and other countries; hosting is with AWS.

“Kit is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries.”

Source: kit.com · Checked on 19 October 2026

DPA on request.

Yes, a DPA is published and covers the Terms; it terminates when the Terms end. No separate signing described.

“This Data Processing Addendum (“DPA”) sets forth the terms under which Kit processes Personal Data concerning Subscribers of creators’ newsletters”

Source: kit.com · Checked on 19 October 2026

Published.

Yes, Attachment 3 of the DPA (https://kit.com/dpa), updated Oct 9, 2026: 13 entries. AI providers: OpenAI OpCo, LLC (application AI functionality) and AskElephant AI (support).

“You specifically consent to Kit’s appointment of the Subprocessors identified on Attachment 3”

Source: kit.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'ConvertKit'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept until the Terms end. At the customer's choice Kit then deletes or returns the subscriber data, except copies on backups, which are isolated. No fixed number of days.

“At Your choice, Kit will delete or return all Subscriber Personal Data upon the end of the provision of Services”

Source: kit.com · Checked on 19 October 2026

Kit names none of its own; it relies on AWS (SOC 2 Type II, ISO 27001) and Cloudflare (ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II).

“AWS’s infrastructure security protections have been independently validated as part of its SOC 2 Type II and ISO 27001 certifications”

Source: kit.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes: the privacy notice says Later can use your uploaded content, engagement data and platform interactions to train and improve its own AI models; no opt-out is described.

“We may use your content, engagement data, and platform interactions to train and improve our AI models”

Source: later.com · Checked on 19 October 2026

United States.

“We store personal information in the USA.”

Source: later.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Mavrck', 'Later'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept for as long as necessary for the purpose collected, at least while the account exists; no fixed number of days; Later reserves the right to keep anonymised or aggregated data indefinitely.

“We only retain personal information for as long as necessary for the purpose for which it was collected.”

Source: later.com · Checked on 19 October 2026

You can switch the training off.

Each member turns off the 'Data for Generative AI Improvement' setting in their own LinkedIn settings; objections for other models use a Data Processing Objection form. No organisation-wide admin switch is stated, and the FAQ describes members' data, not the company subscription.

“To opt out, use the Data for Generative AI Improvement member setting.”

Source: linkedin.com · Checked on 19 October 2026

United States: the DPA says customer personal data goes to LinkedIn's data centres in the United States.

“Customer Personal Data as defined in the Data Processing Agreement is transferred across public networks to the Data Importer’s data centres in the United States”

Source: linkedin.com · Checked on 19 October 2026

DPA in the terms.

Yes. The LinkedIn Data Processing Agreement is incorporated into the subscription agreement (LSA) and applies automatically.

“the terms of which are incorporated into this LSA”

Source: linkedin.com · Checked on 19 October 2026

Published.

Yes, public list at legal.linkedin.com/customer-subprocessors (25 August 2026): 43 rows (12 infrastructure + 31 service providers; Microsoft appears in both). Microsoft is the only major AI or cloud model provider named.

“The following describes the legal entities engaged in the storage and content delivery of Customer Personal Data by LinkedIn for the Services”

Source: legal.linkedin.com · Checked on 19 October 2026

On the list.

Active (LinkedIn Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Customer personal data is kept for the term of the services; at termination or on request LinkedIn returns or destroys it at the customer's choice. AI conversations are stored until the member deletes them.

“LinkedIn shall, and shall cause any Subprocessors to, at the choice of Customer, return all the Customer Personal Data”

Source: linkedin.com · Checked on 19 October 2026

ISO 27001, ISO 27018 (both cover Sales Solutions), ISO 22301, SOC 2 and PCI DSS: 5 listed on the trust page.

“ISO 22301 ISO 27001 ISO 27018 SOC 2”

Source: security.linkedin.com · Checked on 19 October 2026

€148.21 / user / mo.

Advanced plan: €148.21 per licence per month, or €1,693.88 per licence per year; described as estimates that may exclude VAT.

“CAD: C$179.99/month or C$2,039.88/year EUR: €148.21/month or €1,693.88/year”

Source: business.linkedin.com · Checked on 19 October 2026

Mostly inside the EEA: Omnisend says it normally processes personal data within the EEA; hosting is on Google Cloud Platform, region not named.

“We normally process Personal Data within the EEA, but in some cases your Personal Data may be transferred outside the EEA.”

Source: omnisend.com · Checked on 19 October 2026

DPA in the terms.

Yes, published DPA is part of the agreement: it is subject to the terms and takes precedence over them on personal data; includes EU Standard Contractual Clauses.

“This Data Processing Agreement (the “DPA”) reflects the Parties’ agreement with respect to the terms governing the Processing of Customer Personal Data”

Source: omnisend.com · Checked on 19 October 2026

Published.

Yes, Annex III of the DPA (https://www.omnisend.com/data-processing-agreement/): 17 entries. No AI model provider is named; Vercel Inc. is listed for development of internal AI-powered analytics tools.

“Omnisend has authorized the use of the following Sub-Processors:”

Source: omnisend.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Omnisend, UAB, Vilnius, Lithuania)

“Omnisend, UAB, legal entity code 302530363, address Verkių g. 25C-1, LT-08223 Vilnius, Republic of Lithuania”

Source: omnisend.com · Checked on 19 October 2026

Personal data is kept no longer than needed for the agreement; at the end of service Omnisend deletes or returns it at the customer's choice and certifies deletion. Accounts inactive for 3 months can be deleted with all data.

“The Customer Personal Data shall be retained for no longer than is necessary to fulfill its obligations under the Agreement”

Source: omnisend.com · Checked on 19 October 2026

Germany: all data is stored on servers in Germany, in a German data centre; backups also in Germany.

“All data is stored on servers in Germany. There is no risk of data being transferred to a third country or reliance on US corporations.”

Source: rapidmail.com · Checked on 19 October 2026

No EU hosting.

Not a setting: everything is stored in Germany by default.

“All data is stored on servers in Germany. There is no risk of data being transferred to a third country or reliance on US corporations.”

Source: rapidmail.com · Checked on 19 October 2026

DPA in the terms.

Yes, a data processing contract is concluded online in the rapidmail account (available once the account is activated); the terms say it applies when the contract takes effect.

“You can conclude a data processing contract (as per Art. 28 of the GDPR) in the rapidmail newsletter software in electronic form.”

Source: rapidmail.de · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Positive Group Deutschland GmbH, Freiburg im Breisgau, Germany)

“Positive Group Deutschland GmbH Ingeborg-Krummer-Schroth-Straße 18a 79106 Freiburg im Breisgau Germany”

Source: rapidmail.com · Checked on 19 October 2026

Not stated for stored content. After termination access is blocked and 'your access shall be completely deleted'; contents can be exported until termination takes effect. No deletion period given.

“Once termination of the contract takes effect, access to our services shall be blocked for you and your users. You can export the contents processed using our services until the termination takes effect.”

Source: rapidmail.com · Checked on 19 October 2026

1 named: ISO 27001 for the German data centre it uses (not for rapidmail itself).

“Our data centre is regularly audited and certified under ISO 27001, confirming full GDPR compliance.”

Source: rapidmail.com · Checked on 19 October 2026

DPA on request.

Yes, on request: the terms say a Data Processing Agreement is available to the customer on request through a form link.

“Further agreements regarding the processing of Personal Data are arranged in a Data Processing Agreement (DPA), which can be requested by the Customer”

Source: salesflare.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Salesflare BVBA, Antwerp, Belgium)

“Provider means Salesflare BVBA, a company incorporated in Belgium having its registered office at Rijnkaai 37 box 4, 2000 Antwerp, Belgium”

Source: salesflare.com · Checked on 19 October 2026

A daily backup copy of customer data is made; no retention period or deletion period after cancellation is stated.

“The Provider shall create a daily backup copy of the Customer Data.”

Source: salesflare.com · Checked on 19 October 2026

€29 / user / mo.

€29 per user per month billed annually (€39 per user per month billed monthly) for Growth; VAT treatment not stated.

“Growth ## €39 /month ## €29 /month (save €10) per user”

Source: salesflare.com · Checked on 19 October 2026

Doesn't say whether it trains on your data.

Not stated for Salesforce's own models. Salesforce says prompts and answers sent through its Trust Layer are never stored or used to train the third-party large language models it connects to.

“prompts and generated responses are never stored or used to train the underlying third-party large language models”

Source: salesforce.com · Checked on 19 October 2026

No single default stated. Salesforce lists regions per service; for the Salesforce Services (incl. Sales Cloud) Germany and France appear as a region. The customer picks the region at set-up or via an account executive.

“the Customer may be able to choose their region during the setup process or by working with an Account Executive”

Source: salesforce.com · Checked on 19 October 2026

EU hosting available.

Yes. A Germany/France region is listed for the Salesforce Services; choose it at set-up or ask your account executive to move data later (subject to availability). AI add-ons may run on separate infrastructure.

“You may also request to have your Customer Data for a Covered Service or feature hosted in a different region, which may be accommodated, subject to availability.”

Source: salesforce.com · Checked on 19 October 2026

DPA on request.

Yes. The Data Processing Addendum is part of the Main Services Agreement by reference; EU/UK/Swiss transfers rely on Salesforce's Binding Corporate Rules and/or Standard Contractual Clauses, treated as signed on accepting the agreement.

“posted as of the Effective Date are hereby incorporated by reference”

Source: salesforce.com · Checked on 19 October 2026

Published.

Yes. Public 'Infrastructure and Sub-processors' document (published 2 Oct 2026) at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf lists sub-processors and countries per service, with a sign-up for change notices. Entries not counted (320,000-character multi-service document). OpenAI, L.L.C. appears as a generative AI provider.

“This documentation describes the infrastructure environment, sub-processors and certain other entities material to the services”

Source: salesforce.com · Checked on 19 October 2026

On the list.

Active (Salesforce; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

After all subscriptions end: data kept inactive for 120 days, then deleted from production within 90 days and from backups within 180 days. Customer can ask for a copy within 30 days of termination. Retention of AI prompts not stated here.

“for 120 days, after which it is securely overwritten or deleted from production within 90 days, and from”

Source: salesforce.com · Checked on 19 October 2026

12 audits/certifications listed for the covered services: ISO 27001/27017/27018, SOC 1/2/3, C5, HITRUST, PCI, ISMAP, ENS High, HDS, Japan CS Gold, plus privacy ones (APEC PRP, EU/UK BCR, DPF). Each applies to one or more services.

“achieved ISO 27001/27017/27018 certification for its ISMS from an independent third party. The”

Source: salesforce.com · Checked on 19 October 2026

€100 / user / mo.

€100 per user/month, billed annually (Pro Suite). VAT treatment not shown on the page.

“Pro Suite The flexible CRM suite with more automation and customisation across sales, service, marketing, and commerce. 100 € EUR/User/Month (Billed annually)”

Source: salesforce.com · Checked on 19 October 2026

Doesn't train on your data.

No for generalized AI/ML models: the Privacy Statement says personal data it covers (including AI prompts and files) is not used to train them. Terms still give SE Ranking a perpetual licence to content within its aggregated statistics.

“SE Ranking does not use any of the personal data processed in accordance with current Privacy Statement for the purposes of developing, improving, or training generalized Artificial Intelligence (AI) and/or Machine Learning (ML) models.”

Source: seranking.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do for generalized AI/ML model training: the Privacy Statement says covered personal data is not used for it. No setting exists or is needed.

“SE Ranking does not use any of the personal data processed in accordance with current Privacy Statement for the purposes of developing, improving, or training generalized Artificial Intelligence (AI) and/or Machine Learning (ML) models.”

Source: seranking.com · Checked on 19 October 2026

Published.

Yes, public at seranking.com/legal/processors.html: 39 entries; AI-related: Anthropic PBC (AI model and generative AI services), Cloudflare (AI agents infrastructure); terms also name OpenRouter for SE Visible.

“Anthropic PBC AI model and generative AI services United States of America”

Source: seranking.com · Checked on 19 October 2026

On the list.

Active (SE Ranking (Wilmington, DE); EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Account data is kept while you have active services; support enquiries 5 calendar years, contract-performance data up to 10 years. Projects can be deleted after 60 days of non-use or 60 days after an overdue payment.

“The Provider reserves the right to delete Projects unilaterally, created by the Customer if the Customer’s account is not used for 60 days.”

Source: seranking.com · Checked on 19 October 2026

€87.20 / mo.

€87.20 per month billed annually (€109.00 per month on monthly billing); VAT not shown.

“SEO + GEO for marketing teams with repeatable delivery €87.20 €109.00 /mo”

Source: seranking.com · Checked on 19 October 2026

United States or any other country where Seamless.AI or its service providers operate; no specific region is named.

“Seamless.AI may store, access, or use your personal data in the United States or in any other country”

Source: seamless.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Seamless'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period: personal data is kept as long as reasonably required for legal obligations and business purposes, including providing services to customers.

“Seamless.AI retains personal data for as long as reasonably required to comply with our legal obligations”

Source: seamless.ai · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, SISTRIX GmbH, Bonn, Germany)

“SISTRIX GmbH Thomas-Mann-Straße 37 53111 Bonn Deutschland”

Source: sistrix.com · Checked on 19 October 2026

After you cancel, your account data is deleted (except what tax and commercial law require you to keep); SISTRIX may irrevocably delete everything stored during the contract, so back up your data before the contract ends.

“Wir sind berechtigt, sämtliche während der Vertragsdauer gespeicherten Daten des Nutzers unwiederbringlich zu löschen.”

Source: sistrix.com · Checked on 19 October 2026

€239 / mo.

€239 per month plus taxes, cancelable monthly (3 users included).

“For small businesses with ambitions of growth €239/ month plus taxes”

Source: sistrix.com · Checked on 19 October 2026

EU or United States: the hosting provider is Google Cloud Platform, with processing location listed as EU / United States.

“Google Cloud Platform Description: Cloud infrastructure provider for hosting, data processing, storage, and backups Processing Location: EU / United States”

Source: surferseo.com · Checked on 19 October 2026

DPA on request.

Yes: customers who enter employee or associate data enter into a data processing agreement by accepting the customer privacy clause; no separate signing.

“by accepting the Clause, you enter into a Data processing agreement”

Source: surferseo.com · Checked on 19 October 2026

Published.

Yes, listed in the customer privacy policy (§5): 24 entries; AI-related ones are Fireflies (AI meeting assistant), bards.ai (AI/ML consultancy) and Grammarly; no large-language-model provider named.

“List of Subprocessors: I. Cloud Infrastructure & Hosting Google Cloud Platform”

Source: surferseo.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Surfer Sp. z o.o., Wrocław, Poland)

“Surfer Sp. z o.o. in Wrocław with registered office at the following address: Pl. Solny 14/3, 50-062 Wrocław, Poland”

Source: surferseo.com · Checked on 19 October 2026

Account data is deleted or returned within 30 days of contract end or on written deletion request; query results stay accessible for the last three months.

“Within 30 (thirty) days from the date of termination of the Contract or receipt of a written request for deletion of the Entrusted Data, at your option, we will delete or return the Entrusted Data to you”

Source: surferseo.com · Checked on 19 October 2026

€99 / mo.

€99 per month, billed yearly (saves €240 a year against monthly); VAT not shown.

“Standard 99 EUR per month Billed yearly”

Source: surferseo.com · Checked on 19 October 2026

Trains on your data in part.

Yes, in limited form. Zoho's privacy policy says it uses anonymised service data sets to improve the accuracy of its AI/ML algorithms, and uses your company's data to build custom models for your company only.

“(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln.”

Source: zoho.com · Checked on 19 October 2026

DPA on request.

Yes, on request: the organisation admin emails legal@zohocorp.com for the Data Processing Addendum and names the data centre the account is in.

“If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com to request a copy of the Data Processing Addendum”

Source: zoho.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Zoho'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept while the account is active. After cancellation, data is deleted from the live database at the next purge (every 6 months) and from backups 3 months later. Customers can access, export or delete their data.

“Nach der Kündigung Ihres Kontos werden Ihre Daten automatisch innerhalb von 6 Monaten aus unserer aktiven Datenbank gelöscht, und 3 Monate später ebenfalls aus unseren Backups.”

Source: zoho.com · Checked on 19 October 2026

7 ISO certifications (27001, 27701, 27017, 27018, 9001, 20000-1, 22301), SOC 1 and SOC 2 Type 2 reports (plus SOC 2+HIPAA), and regional ones such as ENS (Spain), HDS (France), GoBD and Cyber Essentials Plus.

“Zoho has earned ISO/IEC 27001 certification for Applications, Systems, People, Technology, and Processes”

Source: zoho.com · Checked on 19 October 2026