Tidio with Lyro AI Agent and the GDPR: AI training, data location and DPA

Trains on your data in part.

Yes, in aggregated, anonymised form, unless you opt out through Tidio support. Input and Output are not used to train models exposed to other customers except in irreversibly aggregated form; its AI providers are barred from training.

Vendor's wording: “Input and Output are not used to train foundation models exposed to other customers, except in irreversibly aggregated form. Customers may opt-out of improvement training via support.”

Source: tidio.comSection 20 AI Terms, Licence to InputChecked on 19 October 2026

You can switch the training off.

Contact Tidio support to opt out of improvement training.

Vendor's wording: “Customers may opt-out of improvement training via support.”

Source: tidio.comSection 20 AI Terms, Licence to InputChecked on 19 October 2026

Mainly the EEA (servers located there); the US entity Tidio LLC may transfer some data to the US. Security page names AWS.

Vendor's wording: “We mainly process the data you submit within the EEA and the servers located there.”

Source: tidio.comSection on transfersSecond source: tidio.comChecked on 19 October 2026

No EU hosting.

No EU-only setting or plan is described. Data is mainly processed in the EEA on servers there, but the US entity Tidio LLC may transfer some data to the US.

Vendor's wording: “We mainly process the data you submit within the EEA and the servers located there.”

Source: tidio.comSection on transfersChecked on 19 October 2026

DPA on request.

Yes. For users in the EU, UK or Switzerland the Terms contain a DPA incorporated by reference (no separate signature).

Vendor's wording: “OUR TERMS CONTAIN AN ADDITIONAL DATA PROCESSING AGREEMENT (“DPA”), WHICH SHALL BE INCORPORATED HEREIN BY REFERENCE”

Source: tidio.comPreamble of TermsChecked on 19 October 2026

On the list.

Active (Tidio LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Tidio'Checked on 19 October 2026

Chat and AI content retention periods are not stated. When you delete the account in-app, undelivered messages and other information no longer needed are deleted; if you only unsubscribe on a device, data can be kept up to 6 months.

Vendor's wording: “your information may be stored with us for a longer period (but only up to 6 months)”

Source: tidio.comSuspending Your Tidio AccountChecked on 19 October 2026

1 named: SOC 2 report completed (also claims GDPR and CCPA compliance; PCI-DSS is for payments via Stripe). No ISO 27001 named.

Vendor's wording: “We have successfully completed our SOC 2® examination, reinforcing our focus on protecting customer data.”

Source: tidio.comOther tools that help us keep your data secureChecked on 19 October 2026