WellSaid Business and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No: WellSaid states it does not use customer inputs and outputs to train its models (own closed model)

Vendor's wording: “we do not use your inputs and outputs to train our models and do not claim ownership of your content.”

Source: wellsaidlabs.comFAQ: How does WellSaid use customer data?Checked on 19 October 2026

United States: customer data is processed and stored on Google Cloud Platform hosted in the US

Vendor's wording: “Customer data is processed and stored in the Google Cloud Platform, which is hosted in the US.”

Source: wellsaidlabs.comFAQ: Where is customer data processed and stored?Checked on 19 October 2026

No EU hosting.

No: the service is hosted in the United States and EU users are described as transmitting data to the US; no EU region offered

Vendor's wording: “The Service is hosted in the United States and all Users of the Service acknowledge”

Source: wellsaidlabs.comInternational VisitorsChecked on 19 October 2026

DPA on request.

Yes: a published Data Processing Agreement forms part of the WellSaid Services Agreement, with EU Standard Contractual Clauses deemed signed by entering the agreement

Vendor's wording: “This Data Processing Agreement (“DPA”) forms part of and is incorporated into the WellSaid Services Agreement”

Source: wellsaidlabs.comIntro and section 7 Data TransfersChecked on 19 October 2026

Published.

Yes: Schedule 3 of the DPA at https://wellsaidlabs.com/dpa lists 7 sub-processors (Google Cloud, Azure, Mixpanel, Verisoul, PerspectiveAI, Hive, MongoDB); AI-related: Azure (language mechanics), PerspectiveAI and Hive (content moderation)

Vendor's wording: “A list of WellSaid’s Subprocessors is available at Schedule 3.”

Source: wellsaidlabs.comSchedule 3 / Section 6 SubprocessorsChecked on 19 October 2026

Not listed.

No listing found for search term 'WellSaid'

Source: dataprivacyframework.govSearch 'WellSaid' returned 'Query returned no results'Checked on 19 October 2026

No fixed period for content: kept as long as needed to provide the service; on written request WellSaid returns or destroys all personal data within 90 days

Vendor's wording: “WellSaid will, at the choice of Customer and upon Customer’s written request return to Customer and/or securely destroy all Personal Data within 90 days of such request”

Source: wellsaidlabs.comSection 8 Return or Destruction of Personal DataChecked on 19 October 2026

2 named: SOC 2 Type I and SOC 2 Type II (plus a GDPR compliance claim); ISO is mentioned only for the hosting services

Vendor's wording: “upholding compliance standards for personal data under General Data Protection Regulation (GDPR), SOC2 Type I and SOC2 Type II certification.”

Source: wellsaidlabs.comCompliance frameworksChecked on 19 October 2026