🔒
Privacy
GDPR Compliant
Strictly complies with the European Union GDPR regulations for data protection and user privacy rights.
Which AI has GDPR Compliant?
47 of 108 tools in the CanIUse matrix support GDPR Compliant. Open a tool-by-feature answer for the exact plan and source.
Which AI tools support this?
| Tool | Status | Notes | Link |
|---|---|---|---|
| 🤖 ChatGPT | Yes | — | Try ChatGPT (opens in a new tab) |
| 🧠 Claude | Yes | — | Try Claude (opens in a new tab) |
| ✨ Google Gemini | Yes | — | Try Google Gemini (opens in a new tab) |
| 🐋 DeepSeek | No | — | Try DeepSeek (opens in a new tab) |
| 🎨 Midjourney | No | Auto populated | Try Midjourney (opens in a new tab) |
| ✏️ Recraft | Unknown | Needs a read of the current policy before we assert this. | Try Recraft (opens in a new tab) |
| 🖌️ Canva Magic Studio | Yes | Canva operates under GDPR and publishes a DPA. | Try Canva Magic Studio (opens in a new tab) |
| 🔥 Adobe Firefly | Yes | Adobe operates under GDPR across its Creative Cloud products. | Try Adobe Firefly (opens in a new tab) |
| 🎥 HeyGen | Yes | HeyGen publishes a DPA and serves EU customers. | Try HeyGen (opens in a new tab) |
| 🎬 Runway | Yes | Runway publishes a DPA and serves EU customers. | Try Runway (opens in a new tab) |
| ⚡ Pika | Unknown | Needs a read of the current policy before we assert this. | Try Pika (opens in a new tab) |
| 🎙️ ElevenLabs | Yes | — | Try ElevenLabs (opens in a new tab) |
| 🎧 Descript | Yes | — | Try Descript (opens in a new tab) |
| 🎵 Suno | Unknown | Needs a read of the current policy before we assert this. | Try Suno (opens in a new tab) |
| 🎼 Udio | Unknown | Needs a read of the current policy before we assert this. | Try Udio (opens in a new tab) |
| 🕸️ Graphify | Unknown | Needs a read of the current policy before we assert this. | Try Graphify (opens in a new tab) |
| 📊 Napkin AI | Unknown | Needs a read of the current policy before we assert this. | Try Napkin AI (opens in a new tab) |
| 📐 Eraser | Yes | Eraser publishes a DPA and serves EU teams. | Try Eraser (opens in a new tab) |
| 💡 Whimsical | Yes | Whimsical publishes a DPA and serves EU teams. | Try Whimsical (opens in a new tab) |
| 📌 Miro AI | Yes | Miro operates under GDPR and publishes a DPA. | Try Miro AI (opens in a new tab) |
| 🔮 Gamma | Yes | — | Try Gamma (opens in a new tab) |
| 📝 Notion AI | Yes | — | Try Notion AI (opens in a new tab) |
| 📈 Julius AI | Unknown | Needs a read of the current policy before we assert this. | Try Julius AI (opens in a new tab) |
| 💻 Cursor | Yes | Enterprise docs link a GDPR-compliant DPA and state Cursor maintains GDPR compliance alongside SOC 2 Type II. Individual plans follow the Privacy Policy, not the DPA. | Try Cursor (opens in a new tab) |
| ⚡ v0 | Yes | Auto populated | Try v0 (opens in a new tab) |
| 🐙 GitHub Copilot | Yes | — | Try GitHub Copilot (opens in a new tab) |
| 🏄 Windsurf | Yes | Codeium publishes a DPA and serves EU customers. | Try Windsurf (opens in a new tab) |
| 🤖 Microsoft Copilot | Yes | — | Try Microsoft Copilot (opens in a new tab) |
| 🧠 Grok | Yes | — | Try Grok (opens in a new tab) |
| 🔍 Perplexity AI | Yes | — | Try Perplexity AI (opens in a new tab) |
| 🌬️ Mistral AI | Yes | — | Try Mistral AI (opens in a new tab) |
| 🦙 Meta AI | Yes | — | Try Meta AI (opens in a new tab) |
| 🦙 Llama | Yes | — | Try Llama (opens in a new tab) |
| 🥧 Pi by Inflection | Yes | — | Try Pi by Inflection (opens in a new tab) |
| 🎯 Cohere | Yes | — | Try Cohere (opens in a new tab) |
| 🤗 HuggingChat | Yes | — | Try HuggingChat (opens in a new tab) |
| ❓ Poe by Quora | Yes | — | Try Poe by Quora (opens in a new tab) |
| 👤 Character.AI | Yes | — | Try Character.AI (opens in a new tab) |
| ✍️ Jasper | Yes | — | Try Jasper (opens in a new tab) |
| 🖊️ Writesonic | Yes | — | Try Writesonic (opens in a new tab) |
| 📝 Copy.ai | Yes | Auto populated | Try Copy.ai (opens in a new tab) |
| 📄 Rytr | No | — | Try Rytr (opens in a new tab) |
| 🌍 DeepL | No | Auto populated | Try DeepL (opens in a new tab) |
| 🎨 Krea | Unknown | Needs a read of the current policy before we assert this. | Try Krea (opens in a new tab) |
| 🖼️ Leonardo.Ai | Unknown | Needs a read of the current policy before we assert this. | Try Leonardo.Ai (opens in a new tab) |
| 📢 AdCreative.ai | Yes | — | Try AdCreative.ai (opens in a new tab) |
| 🎥 Sora | Yes | OpenAI operates under GDPR and publishes a DPA. | Try Sora (opens in a new tab) |
| 👨🎤 Synthesia | No | Auto populated | Try Synthesia (opens in a new tab) |
| 🎙️ Murf AI | Yes | — | Try Murf AI (opens in a new tab) |
| 📹 Fliki | No | — | Try Fliki (opens in a new tab) |
| ✨ Luma Dream Machine | Unknown | Needs a read of the current policy before we assert this. | Try Luma Dream Machine (opens in a new tab) |
| ⚡ Bolt New | Yes | Auto populated | Try Bolt New (opens in a new tab) |
| 💖 Lovable | Yes | Auto populated | Try Lovable (opens in a new tab) |
| 🔎 You.com | Yes | — | Try You.com (opens in a new tab) |
| ⬆️ HighLevel | Yes | — | Try HighLevel (opens in a new tab) |
| ⌨️ Claude Code | Unknown | Needs a read of Anthropic’s current DPA before we assert GDPR. | Try Claude Code (opens in a new tab) |
| ☄️ Comet | Unknown | Needs a read of Perplexity’s current DPA before we assert GDPR for Comet. | Try Comet (opens in a new tab) |
| 🎞️ Veo 3 | Unknown | Needs a current Google DPA read for Flow/Gemini video, not a guess from the model page. | Try Veo 3 (opens in a new tab) |
| 🎥 Kling AI | Unknown | Needs a current DPA/privacy-policy read, not a guess from the model pages. | Try Kling AI (opens in a new tab) |
| 📓 NotebookLM | Unknown | Needs a current Google DPA read for Gemini Notebook specifically. | Try NotebookLM (opens in a new tab) |
| 🛸 Google Antigravity | Unknown | Needs a current Google DPA read for Antigravity specifically. | Try Google Antigravity (opens in a new tab) |
| 🧭 Kiro | Unknown | Needs an AWS DPA read for Kiro specifically. | Try Kiro (opens in a new tab) |
| ⬛ FLUX | Partial | api.eu.bfl.ai is documented as the EU/GDPR regional endpoint. That is data routing, not a published DPA we read here. | Try FLUX (opens in a new tab) |
| 🌀 Stable Diffusion | Unknown | Needs a current Stability DPA read. | Try Stable Diffusion (opens in a new tab) |
| 🔤 Ideogram | Unknown | Needs a current Ideogram DPA read. | Try Ideogram (opens in a new tab) |
| 🐰 CodeRabbit | Partial | Enterprise lists an EU SaaS deployment. That is data residency, not a DPA we read here. | Try CodeRabbit (opens in a new tab) |
| 🧃 Replit | Unknown | Needs a current Replit DPA read. | Try Replit (opens in a new tab) |
| 🤝 Aider | Unknown | You send code to whichever LLM you configure. No Aider DPA was read. | Try Aider (opens in a new tab) |
| 🚀 Warp | Unknown | SOC 2 is documented. A GDPR DPA was not read. | Try Warp (opens in a new tab) |
| 🔷 Tabnine | Yes, requires plus plan | Pricing lists GDPR, SOC 2, and ISO 27001 among enterprise-grade compliance. | Try Tabnine (opens in a new tab) |
| 📝 Grammarly | Unknown | SOC 2 Type 2 is documented. A GDPR DPA was not read. | Try Grammarly (opens in a new tab) |
| 🔗 n8n | Partial | Hosted plans store data in Frankfurt, Germany. Self-host wherever you choose. A DPA was not read. | Try n8n (opens in a new tab) |
| ⚡ Groq | Unknown | Needs a current Groq DPA read. | Try Groq (opens in a new tab) |
| 🔀 OpenRouter | Unknown | Needs a DPA read. Data policies exist but are not GDPR certification. | Try OpenRouter (opens in a new tab) |
| 🤗 Hugging Face | Unknown | Needs a current Hugging Face DPA read. | Try Hugging Face (opens in a new tab) |
| 🎙️ Whisper | Unknown | Local runs stay on your machine. Hosted APIs need that vendor’s DPA. | Try Whisper (opens in a new tab) |
| 🦞 OpenClaw | Unknown | Local-first helps, but a GDPR statement was not on the homepage. | Try OpenClaw (opens in a new tab) |
| 🦦 Otter.ai | Unknown | Needs a current DPA read. Not asserted from the marketing homepage. | Try Otter.ai (opens in a new tab) |
| ⚡ Zapier | Yes, requires free plan | Zapier help states it complies with GDPR, UK GDPR, and CCPA, and points to the Data Privacy Overview, DTIA, and Legal pages. A DPA is published at zapier.com/legal/data-processing-addendum. | Try Zapier (opens in a new tab) |
| ✨ Genspark | Partial | Genspark lists GDPR compliance as a program in progress for both Team and Enterprise. SOC 2 Type II and ISO 27001:2022 are already certified; a custom DPA is Enterprise-only. | Try Genspark (opens in a new tab) |
| 🔥 Fireflies.ai | Yes, requires free plan | Pricing page lists GDPR (and SOC 2 Type II, HIPAA). | Try Fireflies.ai (opens in a new tab) |
| 🌊 Fathom | Yes, requires free plan | Homepage lists GDPR (plus SOC 2 Type II and HIPAA). | Try Fathom (opens in a new tab) |
| 🖼️ Photoroom | Yes, requires free plan | Homepage claims GDPR. | Try Photoroom (opens in a new tab) |
| 🦜 LangChain | Unknown | SaaS vs self-host. A DPA was not read this round. | Try LangChain (opens in a new tab) |
| ♻️ Replicate | Unknown | Needs a current DPA read. | Try Replicate (opens in a new tab) |
| 🤝 Together AI | Unknown | Needs a current DPA read. | Try Together AI (opens in a new tab) |
| 📐 Linear | Unknown | Needs a current DPA read. | Try Linear (opens in a new tab) |
| ✅ ClickUp | Unknown | SOC 2 Type II is claimed. A GDPR statement was not isolated on the homepage. | Try ClickUp (opens in a new tab) |
| 🌸 Asana | Unknown | Needs a current DPA read. | Try Asana (opens in a new tab) |
| 🔗 Make | Unknown | Needs a current DPA read. Homepage timed out. | Try Make (opens in a new tab) |
| 🎨 Figma | Unknown | Security page exists; a GDPR assertion was not copied from marketing. | Try Figma (opens in a new tab) |
| ✨ Adobe Express | Unknown | Adobe privacy exists; not re-read this round. | Try Adobe Express (opens in a new tab) |
| 🪶 QuillBot | Unknown | Not checked. | Try QuillBot (opens in a new tab) |
| 📝 Wordtune | Unknown | Needs a DPA read. | Try Wordtune (opens in a new tab) |
| 📊 Beautiful.ai | Unknown | Enterprise security is mentioned; a DPA was not read. | Try Beautiful.ai (opens in a new tab) |
| 📕 Tome | Unknown | No live privacy statement at tome.app (404). | Try Tome (opens in a new tab) |
| 🪨 Amazon Bedrock | Yes, requires enterprise plan | AWS lists GDPR, HIPAA, and FedRAMP coverage for Bedrock. | Try Amazon Bedrock (opens in a new tab) |
| ☁️ Azure OpenAI Service | Yes, requires plus plan | Azure OpenAI is an Azure service under the Microsoft Products and Services DPA; Trust Center documents GDPR for Azure. | Try Azure OpenAI Service (opens in a new tab) |
| 🔺 Vertex AI | Partial | Google Cloud compliance offerings. Specific Vertex DPA not re-read. | Try Vertex AI (opens in a new tab) |
| 🌲 Pinecone | Unknown | Enterprise compliance docs were not re-read. | Try Pinecone (opens in a new tab) |
| 🗣️ D-ID | Unknown | Privacy policy was not re-read this round. | Try D-ID (opens in a new tab) |
| 🎙️ Deepgram | Unknown | Compliance docs were not re-read. | Try Deepgram (opens in a new tab) |
| 🎧 AssemblyAI | Unknown | Compliance docs were not re-read. | Try AssemblyAI (opens in a new tab) |
| 📻 Adobe Podcast | Unknown | Adobe privacy docs were not re-read. | Try Adobe Podcast (opens in a new tab) |
| 🎵 Stable Audio | Unknown | Privacy policy was not re-read. | Try Stable Audio (opens in a new tab) |
| 🎬 InVideo | Yes, requires plus plan | SOC2, GDPR, and ISO certifications are advertised. | Try InVideo (opens in a new tab) |
| ⌨️ Raycast AI | Unknown | Privacy policy was not re-read. | Try Raycast AI (opens in a new tab) |
| ⚡ Superhuman | Unknown | Compliance docs were not re-read. | Try Superhuman (opens in a new tab) |