Data

Smallpdf and the GDPR: AI training, data location and DPA

Team: Doesn't train on your data. EU hosting not documented · DPA in the terms.

Vendor: Smallpdf AGDocuments, HR and financeChecked on How we check

Verdict

Is Smallpdf GDPR compliant?

Team

Business

Doesn't train on your data

EU hosting not documented · DPA in the terms

Price: See details

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Smallpdf train on your data?

Trains on your data by default?

Checked

Doesn't train on your data.

No. Smallpdf says it does not use customer data to train the machine learning models behind its AI products.

Vendor's wording: “Smallpdf does not use your Customer Data or permit others to use your Customer Data to train the machine learning models used to provide the Smallpdf AI Products.”

Source: smallpdf.comImproving Smallpdf AI ProductsChecked on

Location

Where does Smallpdf store your data?

Where data is stored by default

Checked

Uploaded files are processed on Hetzner servers in the EU (temporary storage only). Where saved files are kept is not stated.

Vendor's wording: “This information may be temporarily stored on Hetzner managed servers located in the European Union. It does not involve permanent storage.”

Source: smallpdf.comSection 4.1.9 HetznerChecked on

Contract

Does Smallpdf sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. A standard Data Processing Agreement covers the Team and Business plans under the Terms of Service.

Vendor's wording: “The Data Processing Agreement DPA reflects our mutual agreement with respect to the Processing of Personal Data by us on behalf of you in connection with the Smallpdf Team Plan and Smallpdf Business Plan”

Source: smallpdf.comSection 16, Data Processing AgreementSecond source: smallpdf.comChecked on

Processors

Who else handles Smallpdf data?

Sub-processors (companies that handle the data for them)

Checked

Not public.

No public list found. The DPA says a list is provided on request; the privacy notice names some providers (Hetzner, AWS Bedrock, Google Looker/Gemini for internal analytics, Cloudflare). AI feature provider named: OpenAI.

Vendor's wording: “Upon request, Processor shall provide a list of sub-Processor involved in data processing under this DPA.”

Source: smallpdf.comSection 7 Sub-ProcessorChecked on

EU–US Data Privacy Framework

Checked

EU or Swiss vendor.

Not applicable (Swiss-based vendor, Smallpdf AG, Zürich)

Vendor's wording: “We are Smallpdf AG, a company incorporated under the laws of Switzerland, with its registered offices at Steinstrasse 21, 8003 Zürich, Switzerland”

Source: smallpdf.comPrivacy Notice, opening paragraphChecked on

Retention

How long does Smallpdf keep your data?

How long data is kept

Checked

Files are deleted within 1 hour for account users unless saved; saved files are deleted generally within 14 days after you delete them. AI usage data is kept 90 days.

Vendor's wording: “If you access our services via a User Account, we delete User Files within one hour unless you save them to your file storage.”

Source: smallpdf.comSection 6 retentionSecond source: smallpdf.comChecked on

Security

Which certifications and admin controls does Smallpdf have?

Security certifications

Checked

ISO/IEC 27001 (1 certification). The trust centre also states compliance with GDPR, CCPA, nFADP and eIDAS, which are not certifications.

Vendor's wording: “Smallpdf is ISO/IEC 27001 certified, and complies with GDPR, CCPA, and nFADP.”

Source: smallpdf.comTrust center headerSecond source: smallpdf.comChecked on

The vendor doesn't say: EU hosting, admin controls, price.

Alternatives

Smallpdf alternatives that don't train on your data

Other documents, hr and finance tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • iLovePDF

    Premium · €5 / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Pleo

    Build · €14 / user / mo

    Says it doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • Teamtailor

    subscription by quote · Quote only

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Tellent Recruitee

    Advance · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Candis

    Basis · From €389 / mo

    Doesn't train on your dataNo EU hosting · DPA in the terms

    ✓✕✓✓✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices