AI vendors and your data: training, retention, zero data retention, EU processing

What 35 AI vendors and SaaS tools with AI features say on their own pages about the data you send them: whether it trains their models, how long they keep it, whether zero data retention is offered, whether processing can stay in the EU, and which model providers it goes to. Plan by plan, because the answers differ more between a vendor's plans than between vendors. Last read on 2026-11-09.

Plan by plan

Consumer: Plans sold to individuals: free and paid personal plans. Business: Team, business, enterprise and education plans, and AI features sold inside business tools. API: The developer API or platform. All plans: The page says the statement holds for every plan. "Zero data retention" is the vendor's term: it usually means the model provider keeps nothing after answering, and says nothing about the content you store in the product itself.

General-Purpose AI Code of Practice

The Code of Practice is the European Commission's voluntary route for providers of general-purpose AI models to show they meet the AI Act's obligations on transparency, copyright and, for the most capable models, safety and security. The Commission keeps the list of signatories. 6 of the 35 vendors above are on it: Anthropic, Google Cloud, Google Workspace, Microsoft, Mistral AI, OpenAI. The list names Google once; both Google rows carry it. A signature is the model provider's; it does not describe any one product's data terms, and tools that build on these models are not signatories by using them. List read on 2026-11-09.

Which model providers the data goes to

Where a vendor names the third-party model providers its AI features send your data to:

A provider named here is a subprocessor for the AI feature. Its own terms, and the vendor's agreement with it, decide what it may keep; several vendors state those terms in the zero data retention column above. Counted across every subprocessor list we hold, not only these vendors': which SaaS vendors name OpenAI, Anthropic and other AI providers.

Questions

Which AI vendors train on customer data?

Of the 35 vendors read, 8 state that conversations on their consumer plans are used for training by default or unless the user opts out: ElevenLabs, Figma, GitHub, Grammarly, Lovable, Mistral AI, OpenAI, Perplexity. 32 state that business or API data is not used for training. The table gives each tier separately.

Which AI vendors offer zero data retention?

25 of the 35 vendors read state a zero data retention option or arrangement for business or API use: Anthropic, Asana, Atlassian, Box, Cisco Webex, Cursor, ElevenLabs, Figma, Freshworks, GitHub, Google Cloud, HubSpot, Intercom, Langdock, Microsoft, Mistral AI, monday.com, Notion, OpenAI, Perplexity, Salesforce, Slack, Zapier, Zendesk, Zoom. For Anthropic, Microsoft, Mistral AI, OpenAI, Perplexity it is granted on request or approval only. Zero data retention usually covers what the model provider keeps after answering, not the vendor's own logs or the content you store in the product.

Which AI vendors can process data in the EU?

10 of the 35 vendors read state that AI processing can stay in the EU, usually on particular plans or models: ElevenLabs, Freshworks, HubSpot, Intercom, Langdock, Lovable, Make, Microsoft, OpenAI, Zendesk. Storing data in the EU is a different promise: several vendors keep data at rest in the EU but say processing may happen elsewhere.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “AI vendors and customer data”, https://eucsoft.com/en/ai-vendors/, data read up to 2026-11-09.

How this was read

For each vendor we read up to three of its own public pages (a help article on AI and data, an enterprise privacy page, the API documentation) and record, per plan, what each states about training, retention, zero data retention, EU processing and model providers, quoted as written. Nothing is taken from news, blogs or other trackers. Each page is read again every week; a difference waits for a person's review before it reaches this page. Every vendor's page also lists its subprocessors and itsdata processing agreement. Full method on themethodology page.