Free
FreeTrains on your data unless you switch it off
EU hosting not documented · no DPA
Price: Free
Data
GDPR-compliant AI writing and email tools: 30 checked
30 tools, 6 of which don't train on your data, keep it in the EU and include a DPA. From the vendors' own pages.
Checked on
Tools
Which AI writing tool is GDPR compliant?
Each tool's business plan where there is one, against your five rules. 10 tools without a page of their own open their answers with “Show answers”.
The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.
Tool · PlanVerdictYour five rules
- Azure Translator
S1 pay as you go · See details
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓?✓
- DeepL
Pro Team · €24.99 / user / mo
Doesn't train on your dataLimited EU hosting · DPA on request
✓–✓✕✓
- Front
Professional · $65 / user / mo
Trains on your data unless you switch it offEU hosting available · DPA on request
✕✓✓✓✓
- Fyxer
Team · $64 / user / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✕✓
Show answers
- Data processing agreement (DPA)
DPA in the terms.
Yes. A Data Processing Agreement is Schedule 1 of Fyxer's Terms of Use, with Fyxer AI Limited as processor
Source: app.fyxer.com · Checked on
- EU–US Data Privacy Framework
UK (EU adequacy).
Not applicable (UK vendor, Fyxer AI Limited; the DPF covers US organisations). Search 'Fyxer' returned no results
Source: dataprivacyframework.gov · Checked on
- Security certifications
SOC 2 Type II and ISO 27001 (vendor statement); HIPAA and GDPR compliance claimed
Source: fyxer.com · Checked on
- Gmail with Gemini
Google Workspace Business Standard · See details
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓✓✓
- Google Translate in Google Workspace
Business Standard · €13.60 / user / mo
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓✓✓
- Grammarly
Pro (team, bought online) (+1) · €12 / mo
Trains on your data unless you switch it offEU hosting not documented · DPA in the terms
✕?✓✓✓
- Help Scout
Plus · $45 / user / mo
Trains on your data unless you switch it offEU hosting not documented · DPA in the terms
✕?✓✓✓
- Hunter
Growth · See details
Doesn't train on your dataData in the EU by default · DPA in the terms
✓✓✓✓✕
- Hypotenuse AI
Basic · Quote only
Says it doesn't train on your dataEU hosting not documented · DPA not stated
✓???✕
Show answers
- Trains on your data by default?
Says it doesn't train on your data.
No, per the pricing page only: data is never used to train public AI models. The terms of service let Hypotenuse use content data to improve its services; neither policy mentions training.
“Your data remains your own and is used only to power your workflows in Hypotenuse AI. It is never shared with third parties or used to train public AI models.”
Source: hypotenuse.ai · Checked on
- Where data is stored by default
United States: data from users outside the US is transferred to and processed in the US.
“If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to United States and process it there.”
Source: hypotenuse.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Hypotenuse'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
No fixed period: personal data is kept as long as necessary for the policy's purposes and legal duties; deletion by account request.
“We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.”
Source: hypotenuse.ai · Checked on
- Security certifications
1 named: SOC 2 Type II (security, availability, confidentiality), stated on the pricing page only.
“Hypotenuse AI is SOC 2 Type II compliant, with controls covering security, availability, and confidentiality.”
Source: hypotenuse.ai · Checked on
- Instantly
Starter bundle · $94 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✕✕
Show answers
- Trains on your data by default?
Doesn't say whether it trains on your data.
Not stated for Instantly; terms disclaim responsibility for what its third-party AI providers do with your inputs, 'including for use in their model training'
“Instantly is not responsible for the Third-Party Services' handling of your Inputs or Outputs, including for use in their model training.”
Source: instantly.ai · Checked on
- Where data is stored by default
United States: Instantly generally stores the information used in its services in the United States
“We generally store the Information used in our Services in the United States.”
Source: instantly.ai · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes: the Data Processing Addendum is incorporated into the Terms whenever Instantly processes personal data covered by data protection law; published at instantly.ai/dpa
“Subscriber agrees that the terms and conditions of the Data Processing Addendum, applies and is hereby incorporated into this Agreement.”
Source: instantly.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Foo Monk', 'Instantly'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
After termination Instantly returns, deletes or anonymises personal data within 30 days (legal-retention exceptions); the terms say Instantly may delete other account data under its retention policies
“Within 30 days after the expiration or earlier termination of the Agreement, Service Provider shall, to the fullest extent technically possible in the circumstances”
Source: instantly.ai · Checked on
- LanguageTool
Team · €56.90 / user / yr
Doesn't train on your dataData in the EU by default · DPA on request
✓✓✓✓✓
- Lavender
Team Plan · $89 / user / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA not stated
???✕✕
Show answers
- Trains on your data by default?
Doesn't say whether it trains on your data.
Not stated for Lavender's own models; the privacy policy says raw email content sent to the LLM is not used to train it or to improve the AI model externally
“The raw email content is not used for the training of the LLM or for improving the AI model externally”
Source: lavender.ai · Checked on
- Sub-processors (companies that handle the data for them)
Not public.
No public list shown; the privacy policy says you may ask for a list of third parties including LLM providers, and lavender.ai/dpa offers email notice of sub-processor changes 10 days ahead
“You may ask us for a list of third-parties with whom we share your personal information (including LLM service providers)”
Source: lavender.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Sorter'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
The Terms say Lavender does not retain copies of your emails; account data can be deleted in the dashboard settings. No fixed retention period is stated in the Terms.
“Lavender does not retain copies of your emails”
Source: lavender.ai · Checked on
- Security certifications
SOC 2 (type not stated) and GDPR compliance, claimed on the marketing site only; no report or audit page
“We are SOC2-certified and GDPR-compliant.”
Source: lavender.ai · Checked on
- lemlist
Email · $55 / mo
Doesn't say whether it trains on your dataEU hosting available · DPA on request
?✓✓?✓
Show answers
- Where data is stored by default
European Union: lemlist's host servers are located exclusively in the EU (DPA: hosting by OVH and backups by Scaleway, France). Some processing tools may transfer data outside the EU
“All servers are located in the EU in order to be fully GDPR compliant.”
Source: docdroid.net · Checked on
- EU hosting on this plan
EU hosting available.
Yes, by default: all lemlist servers are in the EU. Optional AI providers (OpenAI, Anthropic, Google Gemini, Perplexity) and Intercom support are USA-based with SCCs
“All servers are located in the EU in order to be fully GDPR compliant.”
Source: docdroid.net · Checked on
- Data processing agreement (DPA)
DPA on request.
Yes: the DPA is incorporated into the Terms and accepted by signing them; an e-signed copy is sent on request
“These terms and conditions incorporate the Data Processing Agreement (DPA). By signing these terms and conditions, the Customer accepts the DPA.”
Source: lemlist.com · Checked on
- Sub-processors (companies that handle the data for them)
See details.
Listed in Annex I.C of the downloadable standard DPA (not a separate web page): 13 entries, 13 companies (5 standard, 5 optional AI/voice, 3 for Lead Finder). AI providers: OpenAI, Anthropic, Google Gemini, Perplexity AI, ElevenLabs
“Some of the Service’s features and integrations require the use of additional Sub-Processors.”
Source: docdroid.net · Checked on
- EU–US Data Privacy Framework
EU or Swiss vendor.
Not applicable (EU-based vendor, lempire SAS, Paris, France)
“a company registered under France law number 823 475082 with the Paris Trade & Companies Register”
Source: lemlist.com · Checked on
- How long data is kept
Account and usage personal data: no longer than 3 years after the account is closed; at termination lemlist destroys or returns the customer's personal data at the customer's choice (DPA 13.2); Confidential Information destroyed within 30 days on a reasonable-efforts basis. No period stated for AI prompts
“The time needed to provide to you our services, and in no event no longer than 3 years after closing your account”
Source: lemlist.com · Checked on
- Security certifications
SOC 2 Type II (1 certification); report shown on the trust centre
“Compliance SOC2 type 2 report View all”
Source: trust.lemlist.com · Checked on
- Lokalise
Explorer · $149 / mo
Trains on your data unless you switch it offEU hosting not documented · DPA on request
✕?✓✓✓
- Missive
Productive · $24 / user / mo
Says it doesn't train on your dataEU hosting not documented · DPA on request
✓?✓✓✕
- Outlook with Copilot
Microsoft 365 Business Standard with Copilot · See details
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓–✓
- Outreach
Amplify Essentials · Quote only
Trains on your data, with no documented way to stop itEU hosting available · DPA in the terms
✕✓✓✓✓
- Phrase Language Intelligence Platform
Software UI/UX · See details
Trains on your data, with no documented way to stop itEU hosting not documented · DPA on request
✕?✓✓✓
- Proton Mail with Scribe
Workspace Premium · $19.99 / user / mo
Doesn't train on your dataNo EU hosting · DPA on request
✓✕✓✓✓
- ProWritingAid
Premium · €10.00 / user / mo
Doesn't train on your dataEU hosting not documented · DPA not stated
✓???✓
- Rytr
Pro · $49 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA not stated
????✕
Show answers
- Where data is stored by default
United States: servers and central databases are located there.
“please be mindful that such information may be transferred, stored or processed in the United States where our servers or central databases are located.”
Source: rytr.me · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Rytr'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
No fixed period: kept as long as necessary for the policy's purposes and legal duties; you can request deletion in account settings. Teams page mentions 'retention choices' without detail.
“The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.”
Source: rytr.me · Checked on
- Salesloft
Cadence, quote-based · See details
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓–✓
Show answers
- Where data is stored by default
The Salesloft platform is hosted on AWS and Google Cloud in the US and the EU; the Drift product runs on AWS in the US. Which region a given customer gets is not stated.
“The Salesloft platform is hosted at Amazon and Google data centers, running on Amazon Web Service (AWS) and Google Cloud Platform (GCP) technology, in the US and the EU.”
Source: salesloft.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The MSA says each party agrees to comply with the DPA, which is incorporated into the agreement; the DPA includes Standard Contractual Clauses.
“Each party agrees to comply with the DPA, which is incorporated into this Agreement.”
Source: salesloft.com · Checked on
- Sub-processors (companies that handle the data for them)
Behind sign-in.
Partly public: Clari's list at https://www.salesloft.com/legal/clari-subprocessors has 22 entries incl. AWS, Google Cloud, Microsoft Azure (AI analysis), 1Mind and Ada (AI). The Salesloft/Drift list is only in the trust portal (needs browser).
“Microsoft Azure USA Service provider Artificial Intelligence analysis and insights”
Source: salesloft.com · Checked on
- EU–US Data Privacy Framework
On the list.
Active (Salesloft; EU-US DPF, Swiss-US DPF, UK Extension)
Source: dataprivacyframework.gov · Checked on
- How long data is kept
On request within 90 days after the subscription ends, Salesloft returns or deletes personal data; after 90 days it has no obligation to keep it. No in-product retention setting described.
“Upon request made by Customer within ninety (90) days following the expiration or termination of the Subscription Term, Salesloft will return or delete the Personal Data”
Source: salesloft.com · Checked on
- Security certifications
3 named on the security page: SOC 2 Type 2, ISO 27001, ISO 27701. The trust centre also shows a CSA badge plus GDPR, CCPA and DPF badges.
“The Salesloft and Drift platform services undergo SOC 2 Type 2 examinations”
Source: salesloft.com · Checked on
- Shortwave
Business · $30 / user / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA not stated
???✕✕
Show answers
- Trains on your data by default?
Doesn't say whether it trains on your data.
Not stated for Shortwave itself; it says your data will never be used to train third-party LLMs
“Your data will never be used to train third-party LLMs.”
Source: shortwave.com · Checked on
- Where data is stored by default
United States: Shortwave stores all data in Google Cloud and transfers it to servers in the US
“your Personal Data will be transferred from your location to our facilities and servers in the United States.”
Source: shortwave.com · Checked on
- Sub-processors (companies that handle the data for them)
Not public.
No separate list; the security page names 4 providers: Google Cloud, OpenAI, Anthropic, Pinecone
“Currently, besides Google Cloud, we only use OpenAI, Anthropic, and Pinecone.”
Source: shortwave.com · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Shortwave'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
No fixed period: personal data is kept as long as reasonably necessary; you can delete your account and all associated data
“We keep Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy”
Source: shortwave.com · Checked on
- Security certifications
CASA Tier 2 (annual third-party security audit). For SOC 2 Type II or GDPR compliance the security page only says to contact support; no report or certificate is published
“To maintain this verification, Shortwave undergoes an annual security audit.”
Source: shortwave.com · Checked on
- Smartcat
Adapt · $1,200 / yr
Trains on your data in partEU hosting available · DPA on request
–✓✓✓✕
- Smartlead
Pro · $94 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✕✕
Show answers
- Where data is stored by default
Amazon Web Services, Sydney region (Australia). Other User Data may also be processed in Singapore, India, Japan, US, Canada, Germany, Ireland and Sweden.
“securely storing data in a certified data repository, specifically one located in the Sydney Region of Amazon Web Services;”
Source: smartlead.ai · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. The DPA is part of the Terms and is accepted automatically when the user buys a subscription; no signature needed.
“THIS DPA IS ACCEPTED BY THE USER BY VIRTUE OF THE USER ACCEPTING THE TERMS UPON BUYING A SUBCRIPTION FROM SMARTLEAD. THIS DPA CONSTITUTES PART OF THE TERMS.”
Source: smartlead.ai · Checked on
- Sub-processors (companies that handle the data for them)
Not public.
No public list. DPA Annex III names one sub-processor (AWS for hosting) and says the remainder is available on request. 1 entry listed; no AI or model providers named.
“AWS for hosting Remainder available on request”
Source: smartlead.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Smartlead', '521 Products'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
After deactivation, personal data is deleted within 90 days once invoices are paid (backups excepted). The terms allow removal of user data one month after termination. No customer-set retention period found.
“Upon deactivation of the Service, all Personal Data shall be deleted within 90 days subject to full User payment of any outstanding invoices”
Source: smartlead.ai · Checked on
- Spark Mail
Pro · €22 / user / mo
Doesn't train on your dataEU hosting not documented · DPA in the terms
✓?✓✕✓
- Superhuman Mail
Business · $33 / user / mo
Trains on your data unless you switch it offEU hosting not documented · DPA on request
✕?✓✓✓
- Wordtune
Unlimited · $6.99 / user / mo
Trains on your data in partEU hosting not documented · DPA not stated
–???✕
Show answers
- Trains on your data by default?
Trains on your data in part.
Yes, in part: the Business privacy policy says that in certain cases anonymised data is used to train its AI algorithm, and the terms of use license your content to improve the algorithms behind Wordtune. No stop setting is described.
“In certain cases, we may or will anonymize or de-identify your Personal Data and further use it (for internal and external purposes, including, without limitation, to improve the services, to train our AI algorithm, for research purposes”
Source: wordtune.com · Checked on
- Where data is stored by default
United States: the privacy policy says personal data is processed and stored on AI21's servers there.
“This includes processing and storing your Personal Data in our facilities and servers in the United States.”
Source: wordtune.com · Checked on
- Data processing agreement (DPA)
DPA not stated.
Business accounts: request a data processing agreement through the sales contact form. Not stated for the Unlimited plan.
“To the extent that Client needs to execute a data processing agreement,please request it at https://www.wordtune.com/business/contact-sales.”
Source: wordtune.com · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'AI21 Labs'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Kept until AI21 deletes it or you send a valid deletion request (email privacy@wordtune.com); no fixed period; longer where law or disputes require.
“Your Personal Data will be stored until we proactively delete it or you send a valid deletion request.”
Source: wordtune.com · Checked on
- Security certifications
1 named: SOC 2 (stated as 'SOC2 compliant' in the Business privacy policy; no report type or ISO certification named).
“We have implemented appropriate technical, organizational and security measures designed to protect your Personal Data. Wordtune is SOC2 compliant.”
Source: wordtune.com · Checked on
- WRITER
Starter · See details
Doesn't train on your dataEU hosting not documented · DPA on request
✓?✓✓✓
Example
Grammarly, plan by plan
Pro (team, bought online)
BusinessTrains on your data unless you switch it off
EU hosting not documented · DPA in the terms
Price: €12 / mo
Shortlist
Which writing tools keep data in the EU?
- Azure Translator · EU available
- Front · EU available
- Gmail with Gemini · EU available
- Google Translate in Google Workspace · EU available
- Hunter · EU by default
- LanguageTool · EU by default
- lemlist · EU available
- Outlook with Copilot · EU available
- Outreach · EU available
- Smartcat · EU available
- All tools
Shortlist
Which writing and email tools train on your data?
- Front · Trains on your data unless you switch it off
- Grammarly · Free: Trains
- Help Scout · Trains on your data unless you switch it off
- Lokalise · Trains on your data unless you switch it off
- Outreach · Trains on your data, with no documented way to stop it
- Phrase Language Intelligence Platform · Trains on your data, with no documented way to stop it
- Superhuman Mail · Trains on your data unless you switch it off
- All tools
Browse
Other questions and types of tool
Which tools train on your dataWhich keep data in the EUWhich include a DPAWho else handles your dataWho is on the Data Privacy Framework
AssistantsMeetings and notesPhone and voiceWorkspace and projectsAutomationSales, marketing and supportCode and app buildersDesign, images and videoDocuments, HR and financeResearch, forms and storage
No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.
Need something your tools can't do?
We design and build what your team is missing, around the way you already work and the data rules you set.
FAQ
Frequently asked questions
7 of 30 train on your data on the plan shown, unless someone switches it off: Front, Grammarly, Help Scout, Lokalise, Outreach ….