Smartcat and the GDPR: AI training, data location and DPA

Trains on your data in part.

Marketing claim only: the pricing-page FAQ says content is never used to train public AI models. The terms, DPA and privacy policy say nothing on training; Smartcat's own models are not addressed.

Vendor's wording: “Your content is never used to train public AI models.”

Source: smartcat.comPricing page, FAQ "What security and compliance standards does Smartcat meet?"Checked on 19 October 2026

Europe-based customers: AWS EU data centre (also stores registration data of all users). Americas customers: USA data centre; Asia-Pacific customers: China data centre.

Vendor's wording: “EU data center – Personal Data of all Smartcat Users provided to Smartcat upon registration on the Platform and Content uploaded by Customers residing in Europe (including EEA), Australia and Africa.”

Source: smartcat.com9.2 Subprocessors table, Amazon hosting rowChecked on 19 October 2026

EU hosting available.

Yes, by customer location: content from customers residing in Europe (incl. EEA), Australia and Africa is stored in the EU data centre; it is not a setting you choose.

Vendor's wording: “EU data center – Personal Data of all Smartcat Users provided to Smartcat upon registration on the Platform and Content uploaded by Customers residing in Europe (including EEA), Australia and Africa.”

Source: smartcat.com9.2 Subprocessors table, Amazon hosting rowChecked on 19 October 2026

DPA on request.

Yes: the Smartcat Data Processing Agreement is part of the Terms of Service by reference; no separate signing described.

Vendor's wording: “The Parties of this Agreement shall be bound to Smartcat Data Processing Agreement”

Source: smartcat.comVII. Data Protection, CChecked on 19 October 2026

Published.

Yes: listed in the DPA (https://www.smartcat.com/legal/dpa/), 13 rows, 11 companies plus marketplace subcontractors. AI/model providers: Google, Amazon, OpenAI, Microsoft, DeepL, ModernMT, Anthropic Claude, ElevenLabs, HeyGen.

Vendor's wording: “You hereby authorize Smartcat to engage with the following Subprocessors”

Source: smartcat.com9.2 Subprocessors tableChecked on 19 October 2026

Not listed.

No listing found for search term 'Smartcat'

Source: dataprivacyframework.govSearch 'Smartcat' returned 'Query returned no results'Checked on 19 October 2026

You can delete content yourself during the term. After termination, Smartcat destroys or returns your data within 30 days of a written request; backups are deleted in due course. No default period without a request.

Vendor's wording: “Upon your written request Smartcat shall securely destroy or return such Personal Data or Content, provided to Smartcat, to you within a maximum period of 30 days.”

Source: smartcat.com14. Data return or deletion, 14.2Checked on 19 October 2026

SOC 2 Type II and ISO/IEC 27001 (2 certifications). Hosting data centres are SOC 1/2/3 compliant.

Vendor's wording: “Smartcat is SOC 2 Type II certified; Smartcat is ISO/IEC 27001 certified;”

Source: smartcat.com7.1 Smartcat Security MeasuresChecked on 19 October 2026