Whimsical and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No by default. Whimsical does not use your Customer Data, or let others use it, to train the models behind Whimsical AI. It may improve models with data you voluntarily give as feedback or that you give permission for.

Vendor's wording: “Whimsical does not use your Customer Data or permit others to use your Customer Data to train the machine learning models used to provide Whimsical AI functionality.”

Source: whimsical.comWhimsical AI Terms, data useChecked on 19 October 2026

United States: Whimsical says the website and services are hosted in and provided from the US, on Amazon Web Services.

Vendor's wording: “The Website and our Services are hosted in and provided from the United States”

Source: whimsical.comPrivacy Notice, data locationSecond source: whimsical.comChecked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Addendum is published and referred to in the Privacy Notice; it carries the Standard Contractual Clauses for transfers outside Europe.

Vendor's wording: “The SCCs are part of our Data Processing Addendum located at https://whimsical.com/terms/dpa.”

Source: whimsical.comPrivacy Notice, International Transfer of DataChecked on 19 October 2026

Published.

Yes: https://whimsical.com/terms/privacy/sub-processors lists 19 sub-processors (updated July 2026), including AI providers OpenAI and Anthropic, plus Amazon Web Services, Google Cloud, Google Workspace, Cloudflare, Turbopuffer (Canada), Plausible (Estonia) and Typeform (Spain).

Vendor's wording: “Subprocessor: OpenAI Service(s) provided: AI-enabled functionality Corporate location: USA”

Source: whimsical.comSubprocessor listChecked on 19 October 2026

Not listed.

No listing found for search term 'Whimsical'

Source: dataprivacyframework.govSearch 'Whimsical' returned 'Query returned no results'Checked on 19 October 2026

Whimsical deletes personal information when it no longer needs it for its purposes and is not legally required to keep it; no fixed number of days is stated. Account deletion is possible in settings; deletion requests go to privacy@whimsical.com.

Vendor's wording: “We generally delete information about you when we no longer need the information for the purposes for which we collect and use it”

Source: whimsical.comPrivacy Notice, How Long We Keep Personal InformationChecked on 19 October 2026

1 certification: SOC 2 Type II. No ISO 27001 named.

Vendor's wording: “We are SOC2 Type II compliant, certifying that our security policies and controls continuously meet the highest industry standards.”

Source: whimsical.comSecurity page, complianceChecked on 19 October 2026