Find Your Tool in 6 Steps
Result: 144

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps
Results: 144
Search Images Video Music API Agent Voice Chatbot Coding Marketing
Provider login
Robotics

Humanoid robots, AI educational robots, commercial service robots, and intelligent automation systems.

UBTECH is a Chinese robotics manufacturer that produces humanoid robots such as the Walker S2, Walker S1, Walker S, Walker C, and Walker X, as well as other service, educational, logistics, and consumer robots. According to the company, it focuses on industrial manufacturing, commercial services, and household applications. UBTECH describes the Walker as China’s first commercialized life-size bipedal humanoid robot and cites more than 2,790 robotics and AI patents as of June 2025.UBTECH ROBOTICS CORP LTD

humanoid robots, AI educational robots, commercial service robots and intelligent automation systems

3.4/10 KIFOX Score – Insufficient
Other Walker S2 Industrial humanoid robot with autonomous battery replacement, 24/7 operation, 15-kg payload, binocular stereo vision, co-agent, BrainNet 2.0, and a focus on production lines.

Walker S1 Industrial humanoid robot with an Advanced Planning Model for general tasks, intent understanding, task planning, and semantic VSLAM navigation.

Walker S / Walker S Lite Industrial humanoid robots with a multimodal perception system, LLM-based decision-making capabilities, 3D semantic navigation, object grasping, and real-time integration into production systems.

Walker C / Walker X Commercial and service-oriented humanoid robot lines; specific availability, pricing, service packages, and regional terms must be requested directly from UBTECH.

AI Education / Developer Products Complementary robotics and AI educational products such as the AI Education Platform, Yanshee, uKit AI, UGOT, and AI Lab solutions for education and research.

Professional / Partner / Custom Projects For industrial projects, production line integration, and partnerships, UBTECH recommends contacting them directly; specific SLAs, maintenance, data protection, and integration services must be reviewed on a case-by-case basis.
– (0)

Link

GDPR: Unclear Overall assessment: Unclear to critically compliant with the GDPR. UBTECH is a Chinese robotics manufacturer headquartered in Shenzhen, China.

On the positive side, UBTECH describes data subjects’ rights—such as the right to access, rectification, erasure, withdrawal of consent, restriction of processing, data portability, and the right to lodge a complaint—in its website privacy policy. In addition, UBTECH lists technical and organizational safeguards such as access controls, de-identification, encrypted storage, isolated storage, internal data protection officers, employee training, and emergency procedures for security incidents.

A negative aspect is that the official Privacy Policy explicitly applies only to the website and not automatically to UBTECH products or other services. For the website, UBTECH lists servers in Hong Kong and additional servers in China, the U.S., Singapore, and Hong Kong; personal data may be transferred globally. A publicly verified GDPR DPA structure, EU data residency, EU representative, standard contractual clauses, complete list of sub-processors, or humanoid-specific data protection documentation for walking robots was not found in the reviewed official sources: No verified information available.

Server location: For the website: Hong Kong, with additional servers in China, the US, Singapore, and Hong Kong. For specific humanoid robots, apps, telemetry, support data, or production integrations: No verified information available. Conclusion: For EU companies, UBTECH should only be used after technical and legal review, particularly with regard to camera/audio/sensor data, production data, location data, remote maintenance, cloud connectivity, third-party SDKs, export/import laws, and the availability of a Data Processing Agreement (DPA).

Privacy Policy

Link

“Chat with any PDF using AI: ask questions, get summaries, and find answers.”

PDF.ai is an AI tool for chatting with PDF documents.

Users can ask questions about PDFs, generate summaries, find content, and extract data; in addition, the provider offers an API for Parse, Extract, Split, and Ask for document-driven workflows. The product is positioned as a web app, Chrome extension, and API.PDF.ai

Chat with any PDF using AI: ask questions, get summaries, and find answers

3.9/10 KIFOX Score – Insufficient
Free Free start or demo/trial use for uploading and chatting with PDFs; exact limits should be checked on the live pricing page. Subscription Starter Monthly credit quota for PDF.ai usage and API/document workflows.

Pro Higher credit quota for more intensive PDF analysis and document processing.

Scale Significantly higher credit quota for teams or larger document volumes.

Growth Very high credit quota for extensive workflows. Other API API for parsing, extracting, splitting, and processing PDFs in your own workflows.

Credits Usage-based billing via monthly credits per plan.
– (0)

Link

GDPR: Unclear GDPR assessment: From a GDPR perspective, PDF.ai is unclear to conditionally suitable.

Positive is that PDF.ai has published a Privacy Policy and clearly positions the tool as a PDF chat and PDF API platform. It is also positive that the main page describes chat with PDFs, summaries, questions, answers, as well as API functions for parsing, extracting, and splitting PDFs.

Negative is that I could not publicly find a reliable AVV/DPA, no list of subprocessors, no SCC documentation, no clear no-training statement for uploaded documents, and no guaranteed EU data residency. This is especially critical for PDFs containing contracts, customer data, personnel records, financial data, or medical information.

Server location: No verified information available. Further link: PDF.ai Privacy Policy, Website, and Pricing.

Privacy Policy

Link

“Turn lazy prompts into great ones”

Prompt Cowboy is a web-based AI tool for optimizing prompts for ChatGPT, Claude, Gemini, and other LLMs.

According to the provider, it transforms rough ideas into clearer, more powerful prompts and, depending on the input, adds follow-up questions so the prompt can be improved with more context. The platform is aimed at individual users and teams who want to create, save, reuse, and organize prompts for team collaboration.Prompt Cowboy

Turn lazy prompts into great ones

5.8/10 KIFOX Score – Limited
Free Unlimited prompts with standard AI; limited access to the most powerful model; use of the results with ChatGPT, Claude, Gemini, and other tools. Subscription Individual For individuals with unlimited access to the most powerful model, Advanced Memories, reusable templates, and early access.

Team For teams with shared workflows, team usage, and access to powerful prompt optimization.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Prompt Cowboy is conditionally suitable.

Positive is that Prompt Cowboy publishes a transparent Privacy Policy, mentions EU/UK-GDPR as the applicable legal framework, does not sell data, and explicitly states that user data is not used to train large language models. Also positive are TLS/HTTPS, encryption of stored data, additional encryption of sensitive items, Supabase Row-Level Security, the option to delete the account, and purging within 30 days.

Negative is that Prompt Cowboy is operated by Fourday AI Pty Ltd in Australia, uses providers such as Supabase, Google Cloud, Stripe, and PostHog, and does not publicly provide clear evidence of a standard DPA/AVV or EU-only hosting.

Server location: No verified EU-only information; the operator is based in Sydney, Australia, and hosting runs via service providers such as Supabase. Further links: Prompt Cowboy Privacy, Security, Pricing.

Privacy Policy

Link

“Less structure, more intelligence.”

Manus is an autonomous AI agent that not only responds, but also plans tasks, executes them, and delivers finished work results.

Officially, Manus describes itself as a “virtual colleague with its own computer” with a sandbox, internet access, a persistent file system, and the ability to install software, operate websites, analyze data, create slides, and run workflows. The product covers a web app, website builder, browser automation, email/Slack integration, data sources, and API.Manus

Less structure, more intelligence

6.4/10 KIFOX Score – Solid
Free Free includes, according to the official pricing article, Chat Mode plus Manus 1.6 Lite in Agent Mode, 300 Daily Refresh Credits, 1 Concurrent Task, and 2 Scheduled Tasks.

Additionally, the Help Center states: daily free credits must be claimed, are valid only for that day, and Free users have a monthly Daily Credit usage limit of 1,500 credits. Subscription Pro 20 USD/month: from 4,000 credits/month, Chat Mode, Manus 1.6 Max/1.6/1.6 Lite in Agent Mode, Advanced Research, Professional Website Deployment, Slide Generation, Wide Research, 20 Concurrent Tasks, 20 Scheduled Tasks, beta features; 17% discount with annual billing.

Pro 40 USD/month: from 8,000 credits/month, same feature class, according to the Help Center with a 7-day trial; also 17% annual discount. Team from 20 USD/seat/month: includes Pro features plus SSO, Data Training Opt-Out, Team Usage Analytics, Internal Access Control, Shared Slide Templates. Other Credit add-ons are officially available; according to the docs, they can be purchased additionally and “never expire,” but according to the Help Center they can only be used with an active paid plan and become inactive on a free/expired subscription. WebDev/Website Builder has a separate usage-based pricing model; according to the docs, each Manus account tier includes free monthly allowances of Cloud $10, AI $1, API $1. The API is officially available, but I could not verify a reliable public API pricing sheet in the accessible official sources.
– (0)

Link

GDPR: Partly Conditional to critical – particularly due to US hosting and the unclear level of detail in the publicly accessible privacy documentation.

Manus is a cloud-based autonomous AI agent for tasks such as research, presentations, websites, app development, design, and automations. The official website now lists Manus as part of Meta; however, the Google Play listing still names Butterfly Effect Pte. Ltd. as the developer.

Data processing: According to the Google Play data safety information, Manus may collect personal data, app information/performance, and device or other IDs, and may partially share them with third parties; data is encrypted in transit and deletion can be requested.

Retention: On the Slack Marketplace, Manus states that it generally retains personal data for as long as necessary for the respective purposes, legal requirements, legal claims, or fraud prevention. For Team Plan data, owners/admins can define retention settings; Sandbox data is stored for up to 7 or 14 days depending on the plan.

DPA / AVV: An official Manus page titled “Data Processing Addendum” exists, but during the research its content was not fully retrievable in a machine-readable format. Therefore: a DPA apparently exists, but a detailed review is required; the officially accessible content does not provide sufficiently reliable details on SCCs, role model, or EU transfer mechanisms.

LLM usage: On the Slack Marketplace, Manus states that it uses ChatGPT, Claude, and Gemini and has concluded zero-data-retention agreements with model providers.

Assessment: For normal private or uncontrolled business use involving personal or confidential data, Manus is only recommendable to a limited extent. For GDPR-sensitive organizations, the DPA, SCCs, subprocessors, deletion concept, access controls, US transfer assessment, and usage limits must be reviewed in advance.

Positive: official SOC 2 Type I/II, ISO 27001:2022, and ISO 27701:2019; Trust Center with subprocessors; Team Plan with data training opt-out; integrations via OAuth/API keys; official statements on deletion after retention periods expire.

Negative or unresolved: In the accessible official sources, I could not verify any publicly reliable DPA/AVV, SCC commitment, or EU-only data residency. In addition, the Trust Center lists subprocessors including Anthropic, Google Cloud Platform, and Microsoft Azure AI Foundry; in the team context, the owner can export/view session data. Therefore, for GDPR-sensitive business use, only after review of contracts and TOMs.

Privacy Policy

Link

"Design websites faster with intelligent tools."

Framer is a visual, no-code website builder with CMS, hosting, SEO features, and real-time collaboration.

The AI features help with creating layouts, components, and translations; in addition, there is a plugin system for integrations with models like OpenAI, Anthropic, and Gemini. Framer is therefore particularly interesting for marketing websites, landing pages, portfolios, and multilingual websites.Framer

Design websites faster with intelligent tools

7.6/10 KIFOX Score – Good
Free For non-commercial use, design experiments, Framer subdomain, CMS testing, limited uploads, and collaboration with a few editors. Subscription Basic For personal, hobby, and side projects; custom domain and website publishing without free-tier limitations.

Pro For professionals, small teams, agencies, and startups; more capacity, use of team/marketing stacks, and professional website operation.

Scale For growing companies with flexible, usage-based scaling, higher limits, and add-ons. Other Enterprise Custom contracts, SLAs, enhanced security, direct engineering support, bulk pricing, and enterprise support.

Add-ons Extensions for CMS items, collections, bandwidth, pages, events, and additional enterprise/scale features.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Framer is conditionally suitable.

Positive is that Framer provides a Data Processing Addendum in which Framer acts as a processor/subprocessor, processes personal data according to documented customer instructions, contractually binds subprocessors, and provides for SCCs for third-country transfers. In addition, Framer cites SOC 2 Type 1 and Type 2 as well as GDPR and CCPA compliance.

Negative is that, according to its Security page, Framer hosts all services in AWS facilities in the USA. For EU companies, the DPA, SCCs, subprocessors, form data, analytics, cookies, tracking, and integrated third-party providers are therefore particularly important.

Server location: USA, AWS.

Data processing addendum Privacy statement

Link

"Boost your team with AI Agents" / "Automatically record, transcribe, and summarize meetings with AI notetaker…"

Noota is a European SaaS platform for Conversation Intelligence, AI Meeting Notes, transcription, meeting summaries, email agents, telephony, knowledge search, and recruiting/sales workflows. The tool records meetings or calls, transcribes conversations, creates structured summaries, follow-up emails, reports, and makes meeting, call, and email knowledge searchable.Noota

Boost your team with AI Agents” / “Automatically record, transcribe, and summarize meetings with AI notetaker…

7.6/10 KIFOX Score – Good
Free Free entry for individuals; includes unlimited recording & transcription, monthly AI notes minutes, limited storage, email automation, Chrome extension, as well as iOS/Android app. Subscription Pro For individuals and small teams; includes everything in Free plus more AI Notes minutes, Team Workspace up to a limited team size, unlimited integrations, and AI Agents.

Business For fast-growing companies; includes everything in Pro plus unlimited recording, paid unlimited seats, unlimited AI features, Custom Templates, Zapier & API, Analytics, and AI Infrastructure. Other Enterprise Custom offer for larger teams; includes everything from Business plus unlimited usage, payment by invoice, custom integration, SSO, dedicated support, and business telephony.

Business Telephony / Phone Add-on module for VoIP telephony, domestic calls, local numbers from multiple countries, iOS/Android calling, click-to-call in the browser, and a bring-your-phone option depending on country regulations.

API / Zapier / AI Agents Advanced automation for workflows, integrations, CRM/ATS synchronization, follow-ups, analytics, and knowledge base queries.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Noota is well suited, especially for European teams that want to automatically document meetings, calls, and emails.

Positive is that Noota explicitly mentions GDPR in its Privacy Policy and states that it does not make personal data available for third-party direct marketing. On its Security page, Noota also explains that data is not used to train its own models, is not sold, and is not shared. In addition, Noota mentions EU data centers, double encryption, internal audits, penetration tests, and planned ISO 27001 / SOC 2 Type II certification. For Business and Enterprise users, data retention is configurable from one day up to three years; for Free, archiving after one month is mentioned.

Negative is that meetings, calls, emails, and transcripts often contain personal or confidential content; companies must therefore properly manage consents, recording notices, integrations, CRM/ATS data flows, and deletion rules.

Server location: According to Noota, EU data centers; other Noota materials mention European data centers, including France, Belgium, and the Netherlands. Further sources: Noota Privacy, Security, and Pricing.

Privacy & Data Usage

Link

"Health. Powered by Ada."

Ada is an AI-powered symptom checker and digital health assistant for end users, as well as an enterprise platform for symptom intake, care navigation, clinical handovers, and insights. According to the terms, Ada uses a proprietary probabilistic reasoning technology built on a medically curated knowledge base; for partners, additional routing, integration, and handover functions are offered.Ada Health

Health. Powered by Ada

7.4/10 KIFOX Score – Good
Free Free symptom checker for users with 24/7 access, AI-powered symptom assessment based on clinical evidence, a personalized assessment report, and the option to share relevant information with doctors. Ada explains that the assessment technology is available free of charge to people with smartphones and is offered without advertising. Other Ada Assess / Enterprise Enterprise solution for healthcare organizations, insurers, clinics, and digital care offerings. Includes intelligent symptom assessments, care navigation, clinical handover, insights, partner integration into websites, apps, or portals, simplified language, patient-friendly reports, SSO, and regular optimizations.

Partnerships / Demo / individual contracts According to the Help Center, Ada is financed through private investments, commercial relationships with healthcare systems, insurers, and life science companies, as well as grants and partnerships. Enterprise use apparently takes place individually via a demo/contact process; no public standard pricing was found.
– (0)

Link

GDPR: Yes GDPR assessment: Ada Health is well suited from a GDPR perspective, especially compared to many other AI health tools.

Positive is that Ada Health GmbH is based in Berlin and the privacy policy explicitly addresses GDPR processing, health data, consent, data subject rights, and Article 32 security measures. According to the help page, Ada stores personal data encrypted on Google Cloud Platform servers in the EU, specifically in the Europe-West1 data center in Belgium; MongoDB databases are also located there. In addition, Ada separates personal data such as name and email from health data; health data is pseudonymized and can only be linked via a key by limited Ada personnel. Also positive are EU GDPR compliance, ISO 27001, ISO 13485, and the EU MDR classification of Ada Assess as a Class IIa medical device.

Negative is that Ada also uses third-country connections for certain technical service providers and subprocessors; according to the privacy policy, limited data may be processed outside the EEA if a DPA, appropriate safeguards, the EU-US Data Privacy Framework, or standard contractual clauses apply. In addition, Ada processes pseudonymized or anonymized data for statistics, research, and validation of new technological capabilities; according to Ada, however, health data and sensitive data are intended to remain in the EU.

Server location: EU, specifically Google Cloud Europe-West1 in Belgium for Ada app data; according to the privacy policy, personal data is stored in the EU on AWS/Google Cloud servers, and health data and other sensitive data remain in the EU. Further sources: Ada Privacy Policy, Ada Data Storage, Ada Security.

Ada Health GmbH Privacy Policy

Link

"AI Meeting Assistant with #1 Noise Cancellation"

Krisp is an AI-powered voice and meeting product platform with three publicly visible product lines: AI Meeting Assistant for individuals and teams, Call Center AI for contact center environments, and AI Voice SDK for developers.

In the meeting space, Krisp offers, among other things, transcription, recording, AI notes, summaries, noise cancellation, accent adjustment, integrations, and webhooks. For call centers, additional features include Accent Conversion, Voice Translation, Agent Assist, and analytics functions.Krisp

AI Meeting Assistant with #1 Noise Cancellation

7.7/10 KIFOX Score – Good
Free Test access to premium features without a credit card; includes, among other things, transcription, noise cancellation, audio/video recording, AI notes, and action items. Subscription Core For individuals and small teams; unlimited AI note-taker, bot-free transcription, audio/video recording, AI notes, action items, in-person meeting notes, noise cancellation, as well as integrations/webhooks.

Advanced For advanced teams with enhanced meeting, integration, and voice AI features. Other Enterprise / Call Center AI Custom enterprise/call center options with security, integration, compliance, and support requirements.

AI Voice SDK Developer SDK for integrating Krisp Noise Cancellation/Voice AI into your own products; processing can take place on the customer side.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Krisp is conditionally to well suited, depending on whether only Noise Cancellation or also the AI Meeting Assistant is used.

Positive is that Krisp provides a DPA, operates a Trust Center, publishes SOC/security information, and according to its FAQ does not use personal data to train its AI models. Particularly positive: With pure Noise Cancellation, audio is processed locally on the device and is not sent to cloud servers or stored there.

Negative is that Krisp AI Meeting Assistant stores more data in the Krisp Cloud, such as transcripts and recordings; for call center/enterprise data, Krisp also states hosting on secure servers in the USA and currently no regional data residency outside the USA.

Server location: For cloud/enterprise data, USA; Noise Cancellation processes audio locally on the device. Further links: Krisp Privacy, Security, Trust FAQ, Cloud/Data Location.

Privacy Policy Privacy for humans

Link

"Create Videos Without Limits" / "Turn any idea into videos. Ads, explainers, stories, anything you can imagine."

invideo AI is an AI video platform for prompt-to-video, AI Video Generator, AI Avatars, image-to-video, UGC Ads, AI Animation, AI Ad Generator, Video Translator, Voice Cloning, subtitles, image generation, and classic video editing via invideo Studio.invideo AI

Turn any idea into videos. Ads, explainers, stories, anything you can imagine.

6.0/10 KIFOX Score – Solid
Free Free use without a credit card; limited access to AI models, weekly reset quota, exports with the InVideo logo and stock media watermark. Subscription Plus Paid entry-level plan for exploratory use; access to paid AI/video features, credits, stock providers, and watermark removal compared to Free.

Max Expanded plan for occasional or more intensive use with a larger credit allowance than Plus and access to the paid-plan features.

Generative Plan for daily use of generative models; according to the Help Center, particularly relevant when Plus/Max credits are quickly used up through regular video generation.

Enterprise Customized enterprise offering with private/secure workflows, SOC 2/ISO alignment, GDPR compliance, Context Engine, Custom Agents, Eval & Quality, Parallel Generation, Data Isolation, Audit Trails, Access Controls, IP protection, and a no-training commitment. Other Credits Credits are the internal currency for media clips, videos, generative models, and AI features; downloads/exports do not consume credits, and according to the Help Center, unused credits do not roll over to the next month.

redit Add-ons If credits are used up, users can, according to the Help Center, purchase one-time credit add-ons or switch to a higher plan.

Third-party models Paid Plans include access to many image, video, audio, and music models; model and agent pricing may change and is partly based on provider pricing.

invideo Studio Separate classic video editor with a timeline/template workflow; not identical to invideo AI.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-suitable; for companies, better evaluated via Enterprise.

Positive is that InVideo provides a Privacy Policy with information on data categories, legal bases, deletion, data portability, security, SSL/TLS encryption, and global processing. The Enterprise page mentions “Private & Secure,” “SOC 2 & ISO Aligned,” “GDPR Compliant,” data isolation, audit trails, access controls, full rights to generated content, as well as the commitment that Enterprise inputs and outputs are not used to train its own or external models.

Negative is that the general Privacy Policy refers to global data transfer, storage, and processing and does not specify concrete EU data residency. According to the Privacy Policy, InVideo is offered by Whitesheep Technology Private Limited in India and Invideo Innovation Pte. Ltd. in Singapore; additionally, a US entity is mentioned. The Terms allow InVideo to use AI Based Output to improve AI safety measures, technologies, products, and services. A publicly fully accessible AVV/DPA, complete subprocessor list, or specific EU server region could not be reliably found in the reviewed sources; a Trust Center exists, but its content was not fully readable through the public query.

Server location: global / no specific region reliably confirmed.

Conclusion: Well suited for general marketing and social video production; for personal, confidential, or regulated content, Enterprise should be reviewed with regard to DPA/AVV, subprocessors, data region, non-training commitment, and deletion process.

Privacy Policy

Link

"The music you've been searching for, generated in seconds."

Mubert is an AI music tool for generating, licensing, and integrating royalty-free music. Publicly visible offerings include Mubert Render for creators, Mubert API for apps, games, AI agents, and content platforms, as well as Mubert Studio for musicians who contribute material.

The focus is less on classic song releases and more on legally compliant background music for videos, streams, podcasts, apps, and UGC workflows.Mubert

The music you've been searching for, generated in seconds

3.6/10 KIFOX Score – Insufficient
Free Free entry point for generating initial tracks; suitable for testing and for simple/private use with limitations. Subscription Subscription model for recurring use of Mubert Render, royalty-free Music Catalog, and generated tracks; exact plan names/features may vary by region/site. Other Perpetual License One-time licensing of individual tracks or permanent use according to the license terms.

Mubert API API access for products, apps, and platforms with generative music; Mubert mentions plannable generation tiers and custom terms/limits via Sales.

Mubert Business / Streamers / Play Special usage options for public spaces, streaming, business contexts, and background music.
– (0)

Link

GDPR: Unclear GDPR assessment: From a GDPR perspective, Mubert is unclear to conditionally suitable. A positive aspect is that Mubert publishes Privacy Policies, mentions data protection laws such as CCPA/CalOPPA, and describes its products such as Mubert Render, API, and business offerings separately.

Another positive is that Mubert advertises its API with proprietary datasets, royalty-free, DMCA-free, and monetization clearance.

A negative is that there is no publicly available clear GDPR AVV/DPA, no list of subprocessors, no SCC documentation, and no evidence of EU data residency as a standard. Mubert is a US company; the public company information mentions Delaware/USA or former US addresses.

Server location: No verified information available; company headquarters in the USA/Delaware, no publicly documented EU-only data residency. Further links: Mubert Privacy, Terms, Contact, API.

Mubert website privacy policy DMCA policy

Link

"Always the best, without switching tools."

Bolt is an AI-powered builder for websites, web apps, and mobile apps. Users describe their project via prompt, and Bolt generates a working project from it in a short time.

In addition, Bolt bundles Bolt Cloud Hosting, databases, domains, authentication, file storage, analytics, and Edge Functions directly in the interface.Bolt.new

Always the best, without switching tools

4.2/10 KIFOX Score – Limited
Free Free entry point for building initial projects with limited token/usage scope. Subscription Pro / individual plans More tokens, private projects, website hosting, no Bolt branding, private sharing features, file uploads, custom domains, SEO features, databases, and AI image editing.

Teams For teams with collaborative work, higher limits, and team-oriented usage. Other Enterprise Custom offering for organizations with advanced requirements.

bolt.diy Official open-source version for local/self-hosted use with your own LLM providers such as OpenAI, Anthropic, Ollama, Gemini, Mistral, xAI, DeepSeek, Bedrock, and others.
– (0)

Link

GDPR: Unclear GDPR assessment: From a GDPR perspective, Bolt.new is suitable with limitations. A positive aspect is that Bolt.new belongs to StackBlitz and the platform provides public Terms/Privacy information as well as Team/Enterprise features.

Another positive is that there is an official open-source version, bolt.diy, which can be run locally or self-hosted and allows the use of your own model providers.

A negative is that the StackBlitz Privacy Policy explicitly refers to hosting in the USA, and a publicly clearly documented Bolt.new-specific DPA/AVV or general EU data residency cannot be reliably found. For projects involving personal data, the StackBlitz contract, subprocessors, model providers, Supabase/database integration, logs, secrets, and hosting of the published app should therefore be reviewed.

Server location: For StackBlitz/Bolt.new, the USA is publicly documented as the primary location; for bolt.diy/self-hosting, it is freely selectable. Further links: Bolt Pricing, StackBlitz Privacy, Bolt Docs, bolt.diy.

Privacy Policy

Link

“Projects that practically manage themselves.”

Jira is a cloud and data center platform for project, task, and work management.

In its AI-enabled form, Jira combines classic planning, tracking, and workflows with Rovo AI, for example to create work items from Slack/Teams, summarize content, break down complex work into tasks, and provide agentic assistance and search across the Teamwork Graph.Jira / Atlassian Intelligence

Projects that practically manage themselves

7.7/10 KIFOX Score – Good
Free For small teams; unlimited goals, projects, tasks, and forms, limited number of users and limited automations. Subscription Standard More user/team capability, Standard Support, more automations, data residency, and basic scaling.

Premium Everything in Standard plus unlimited storage, 99.9% SLA, 24/7 Premium Support, Project Archiving, Admin Insights, IP Allowlisting, Sandbox, Release Tracks, more automation, and Atlassian Intelligence. Other Enterprise Enterprise scaling, centralized administration, advanced security/compliance features, Enterprise support, and stronger data/AI control.

Marketplace / Rovo / Atlassian Intelligence Additional apps, AI features, agents, search, and automations depending on product and license scope.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, Jira is conditionally to well suited if Atlassian Cloud is configured correctly.

Positive is that Atlassian offers Data Residency for Jira, Jira Service Management, Jira Product Discovery, Confluence, and Loom on Standard, Premium, and Enterprise plans; data can be pinned in the EU, Germany, Switzerland, the UK, the USA, and other regions, among others. Also positive are Enterprise/Premium features such as IP allowlisting, Sandbox, Release Tracks, Admin Insights, and Premium Support.

Negative is the change to Atlassian’s data practices announced for August 17, 2026: metadata and in-app data may be used, depending on the plan and settings, to improve apps and AI experiences; on Free/Standard, metadata contribution defaults are “on” and cannot be opted out of, while Enterprise offers more control.

Server location: Without pinning, dynamic/global; with Data Residency, depending on the plan and product, including the EU, Germany, Switzerland, the UK, or the USA.

Understand data residency Manage where your data is hosted with data residency

Link

“Create custom, responsive websites with the power of code — visually.”

Webflow is a visual platform for creating, managing, and hosting websites and web-based experiences.

Its features include, among other things, a visual builder, CMS, hosting, collaboration, APIs, localization, Analyze/Optimize, as well as Webflow AI for site generation, copy, CMS content, and SEO/AEO support. For classification as an “AI tool,” it is important to note: AI is a growing part of the product, but not its sole core.Webflow

Build, manage, optimize — all with Webflow AI

7.3/10 KIFOX Score – Good
Free Free entry point for building and testing Webflow projects with a Webflow subdomain. Subscription Basic For simple websites with their own domain and no CMS focus.

CMS For blogs, content websites, and dynamic content with CMS features.

Business For larger marketing and business websites with higher capacity and more traffic.

Standard / Plus / Advanced For online stores with increasing e-commerce features and capacities.

Starter / Core / Growth / Freelancer / Agency Workspace plans for individuals, teams, freelancers, and agencies with collaboration, roles, and client access. Other Enterprise Custom Enterprise offering with advanced security, support, governance, and scalability features.

Webflow AI AI Site Builder and AI Assistant for website creation, pages, CMS Collection Items, SEO/AEO, and help in the Editor.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Webflow is conditionally suitable.

Positive is that Webflow provides a Data Processing Addendum, lists SOC 2 Type II and ISO 27001 in its Trust Center, encrypts data in transit and at rest, and states for Webflow AI that it does not use customer data to train generative AI models; prompts and outputs are also reportedly not used to improve foundation models.

Negative is that, according to the Privacy FAQ, Webflow stores customer and end-user data in the USA and uses several US-based subprocessors. For EU companies, it is therefore necessary to review the DPA, SCCs, subprocessors, consent/cookie setup, form data, tracking, third-party apps, and Webflow AI usage.

Server location: USA. Further links: Webflow DPA, Privacy FAQ, Trust Center, and AI Approach.

Data Processing Addendum Global Privacy Policy

Link

"Effortless AI design for presentations, websites, and more"

Gamma is an AI tool that transforms ideas, text, files, and prompts into visually polished presentations, documents, websites, and social content.

The focus is on fast creation, smart layouts, branding, and easy publishing or sharing. The most relevant use cases are pitch decks, client presentations, proposal documents, internal reports, microsites/landing pages, teaching materials, and recurring content production via API.gamma

Effortless AI design for presentations, websites, and more

7.1/10 KIFOX Score – Good
Free For simple projects and to get to know it; includes simple presentations, docs, websites, social content, and images, import from PDF/PPTX as well as export to PDF, PPTX, PNG, and Google Slides. Subscription Plus Everything from Free plus more cards per prompt, removal of Gamma branding, and advanced AI image models.

Pro Everything from Plus plus more cards per prompt, premium AI image models, custom branding & fonts, detailed analytics, advanced sharing, custom domains, API access, and workspace templates.

Ultra Everything from Pro plus significantly more AI usage, access to advanced text, image, and video models, more custom domains, and early access to new features.

Team For teams with more collaboration, AI, and branding; includes everything from Pro plus centralized billing, custom company theme, shared folders, admin controls, and advanced data controls.

Business For organizations; includes everything from Team plus SSO, SOC-2 documentation upon request, access to the most advanced AI models, advanced data controls, and more custom domains. Other API keys are available starting with Pro, Ultra, Teams, and Business. Usage is billed via credits; with paid plans, additional credits can be purchased or Auto-Recharge can be used.
– (0)

Link

GDPR: Partly Gamma AI is conditionally suitable from a GDPR perspective.

Positive is that Gamma provides a public Data Processing Addendum in which Gamma describes the processing of customers' personal data on customer instructions, commits to technical and organizational measures, regulates subprocessors, and provides for SCCs or UK transfer mechanisms for EU/UK data transfers. For Team and Business workspaces, Gamma also states that content is automatically excluded from training the Gamma AI features; for individual plans such as Free, Plus, Pro, and Ultra, use for improving the AI features is allowed by default, but can be disabled.

Negative is that Gamma is a US provider and, according to the DPA, several key subprocessors are based in the USA, including AWS, Google Cloud, Cloudflare, OpenAI, Anthropic, Microsoft Azure, and other providers. For sensitive data, confidential customer documents, or regulated industries, a data protection check should therefore be carried out before use, including the DPA, subprocessors, third-country transfer, training opt-out, and internal approval.

Server location: No pure EU data residency guaranteed; the subprocessors listed in the DPA are predominantly located in

Privacy Policy

Link

"Language. Quality. Performance." as well as "The AI manufactory that writes in your voice."

newsrooms positions itself as an AI-powered content platform for high-quality communication.

According to the official description, the tool transforms sources into "publication-ready content," learns the writing style of users or the brand, and offers, among other things, Image Studio, File Processing, Research Agent, and Research Assistant, as well as focus areas such as SEO, GEO & GAIO. The platform is clearly aimed at professional content, PR, marketing, and editorial teams.Newsrooms

The AI manufactory that writes in your voice

6.0/10 KIFOX Score – Solid
Subscription The app homepage mentions a free trial period or a free trial account with standardized Communication Tasks and curated newsroom language styles.

⚠️ No confirmed information available – as of 30/04/2026. Publicly visible offering/product segments include Enterprise, MyNewsroom, Industry Solution, Startups, Journalists, and Agency Services; I could not reliably find a verifiable public list of all subscription tiers with their feature scope.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Newsrooms.ai is conditionally to well suited, provided the publicly available provider information is accurate.

Positive is that, according to the search snippet, the website states “Built in the EU, hosted in the EU,” GDPR compliance, and preparation for the EU AI Act. The legal notice lists AI Newsrooms Technology GmbH in Vienna, Austria, which is generally positive in terms of the EU legal framework and GDPR review.

Negative is that no reliable detailed information was publicly available on DPA/AVV, subprocessors, model providers, retention periods, training use, or specific data center regions.

Server location: According to the website snippet, EU hosting; specific data center locations: No verified information available.

Privacy Policy

Link

“Where ideas flow into sound and songs become yours.”

Suno is an AI music platform for generating complete songs and beats from prompts as well as from uploaded or recorded audio.

Paying users get advanced features such as commercial usage rights, voice features, stem export, advanced editing, and with Suno Studio, a generative audio workstation.

With v5.5, Voices, Custom Models, and My Taste were also added.Suno

Where ideas flow into sound and songs become yours

6.1/10 KIFOX Score – Solid
Free Free entry with access to the free model, daily renewed credits, a limited number of songs, standard features, audio upload with a limit, a shared queue, and no commercial use. Subscription Pro Plan Paid entry-level plan with access to advanced models, monthly credits, commercial usage rights for newly created songs, Standard and Pro features, Personas, Advanced Editing, stem splitting, longer audio uploads, new vocals or instrumentals for existing songs, Early Access, add-on credits, Priority Queue, parallel songs, your own voice, and custom versions of the model with your own audio.

Premier Plan Highest regular subscription tier with Suno Studio, access to advanced models, significantly more monthly credits, commercial usage rights, Standard and Pro features, stem splitting, longer audio uploads, vocals/instrumentals for existing songs, Early Access, add-on credits, Priority Queue, parallel songs, your own voice, and custom model versions with your own audio. Other Add-on Credits Pro and Premier users can purchase additional credits; according to Suno, purchased top-up credits do not expire, but require an active subscription to use.

Free Trial Suno may offer a trial period for paid features; the duration is determined by the respective trial confirmation.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Suno is unclear to critical for business use involving personal or confidential data.

Positive is that, in its Privacy Notice, Suno lists rights for EEA/UK users, including access, data portability, restriction, objection, withdrawal of consent, and the right to lodge a complaint. Also positive is that, according to its own statements, Suno does not sell to third parties and intends to contractually require service providers to use information only for the provision of services.

Negative is that, according to the Privacy Notice, Suno may collect usage data, content, prompts, uploads, music, audio, images, videos, voice recordings, and interactive chat information. Particularly critical: Suno states that it uses certain User Activity Information, Submissions, Interactive Chat Information, and Content for the development and improvement of its products as well as for training and improving its models. For voice features, voice recordings and Voice Models may be processed; depending on the jurisdiction, this may involve biometric data.

Server location: Suno is based in the USA and, according to the Privacy Notice, generally stores information on servers in the USA; data from EEA/UK users is transferred to and processed in the USA for the performance of the contract. Further link: Suno Privacy Notice and Terms of Service.

Privacy Notice

Link

Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM

Zhipu AI is a Chinese large language model provider that operates internationally under the name Z.ai. At its core is the GLM model family for text, reasoning, agents, coding, vision, OCR, image, video, and audio capabilities. The platform offers API access, coding plans, web search, Translation Agent, and Slide/Poster Agent.Zhipu AI / Z.ai – GLM

LLM "Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM"

6.7/10 KIFOX Score – Solid
Free GLM-4.5-Flash / free quotas
Z.AI describes GLM-4.5-Flash as a free model variant for reasoning, coding, and agents; in addition, free trial quotas may be available depending on the platform status. Subscription GLM Coding Plan
Personally assigned coding subscription for officially supported coding tools; not intended for general API use, resale, or use by third parties. Other API Usage / Usage-Based Billing API access to GLM models, SDKs, OpenAI-compatible usage, streaming, function calling, structured output, context caching, and tool usage; billing is usage-based depending on the model and platform rules.

Enterprise / Individual Agreements Separate written agreements are possible; no confirmed information is available regarding standardized EU enterprise plans or EU hosting.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-suitable. For the international GLM/Z.AI platform, the official privacy policy names JINGSHENG HENGXING TECHNOLOGY PTE. LTD. in Singapore as the responsible entity; according to the policy, personal data is generally processed in Singapore.

Positive is that Z.AI describes a Data Processing Addendum for API services in which Z.AI acts as a processor for customer data, processes customer data according to instructions, and states that it does not permanently store content from API inputs/outputs.

Negative is that the general Privacy Policy for individual users provides for the use of data to improve and train the models, and explicitly allows international transfers outside the user's country.

Server location: according to the official policy, generally Singapore; no verified information is available on EU hosting, EU data residency, a complete list of subprocessors, or specifically designated Standard Contractual Clauses for EU customers. For GDPR-relevant use, Z.AI should therefore only be used with an API DPA, a clear review of international transfers, a deletion concept, risk assessment, and without sensitive personal data. Sources: Z.AI Privacy Policy and DPA for API services.

Privacy Policy

Link

"Built to make you extraordinarily productive, Cursor is the best way to code with AI."

Cursor is an AI-powered development environment for software development with agents, autocomplete, CLI, cloud agents, and code review features.

Officially, Cursor is positioned as a tool that enables developers to delegate tasks to agents, write code faster, and work in parallel across multiple environments. More recent releases add, among other things, an agent-centric interface, parallel multitasking with subagents, canvases, and automations.Cursor – Anysphere

Built to make you extraordinarily productive, Cursor is the best way to code with AI

7.7/10 KIFOX Score – Good
Free Free use without a credit card, limited agent requests and limited tab completion. Subscription Pro Extended agent limits, access to frontier models, MCPs, Skills, Hooks, and Cloud Agents.

Pro+ Everything in Pro plus significantly more usage for OpenAI, Claude, and Gemini models.

Ultra Everything in Pro plus very high usage and priority access to new features.

Teams Everything in Pro plus shared chats, Commands and Rules, centralized billing, usage analytics, org-wide Privacy Mode, RBAC, and SAML/OIDC SSO. Other Enterprise Pooled Usage, Invoice/PO Billing, SCIM, AI Code Tracking API, Audit Logs, granular admin/model controls, Priority Support, and Account Management.

Bugbot Separate code review/bug detection offering with Pro, Teams, and Enterprise options.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Cursor is conditionally to well suited, especially with Privacy Mode enabled and for Team/Enterprise use.

Positive is that Anysphere provides a Data Processing Addendum, addresses EU/UK data protection law and Standard Contractual Clauses, and refers to SOC 2 Type II, annual penetration tests, and subprocessor review. Also positive: When Privacy Mode is enabled, Cursor implements technical and contractual measures such as Zero Data Retention with model providers, so that code data is not stored by model providers or used for training.

Negative is that Cursor is a US-adjacent cloud/SaaS tool, uses subprocessors, and there is no publicly documented general EU-only hosting as a standard.

Server location: No confirmed general EU server location; however, Cursor states that it does not use infrastructure in China. Further link: Cursor Security, Data Use, DPA.

Privacy Policy Security

Link

"The leading AI management and orchestration platform" / "AI platform – Made in Germany"

The neuland.ai HUB is an AI management and orchestration platform for companies. It brings together AI chat, assistants, projects, workflows, AI apps, integrations, document processing, governance, and model strategy within a controlled enterprise framework.neuland.ai

AI platform – Made in Germany

7.6/10 KIFOX Score – Good
Free Free trial period with full access to get started, AI chat with your own documents, prompt tests, and creation of assistants; no credit card and no commitment according to the pricing page. Subscription Business Business plan for teams with scalable usage, core modules, AI assistants, projects, assistant creation, as well as centralized role and permission management.

Enterprise Customized enterprise package with unlimited users and use cases, tailored AI systems, AI apps, integration into existing IT systems, cloud or on-premise operation, industry competency models, as well as advanced security and compliance options. Other Custom onboarding Implementation support by Customer Success with a tailored onboarding plan for Business and Enterprise customers. Other Custom AI apps Development, operation, and monitoring of custom AI applications tailored to business processes and systems.

Custom enablement / academy Training, change support, and structured rollout for sustainable AI use within the company.

On-premise & dedicated hosting Operation of the neuland.ai HUB in your own infrastructure or a dedicated environment for the highest security requirements, data sovereignty, and regulated environments.

AI app store / SDK Marked as “Coming soon”: access to agentic AI apps as well as an SDK for custom AI apps, agents, and integrations.
– (0)

Link

GDPR: Yes Overall assessment: Well suited for GDPR compliance, subject to a review of the specific contract and configuration. neuland.ai is a German enterprise AI platform based in Cologne and offers a public Trust Center with data protection information, DPA, TOMs, and a list of subprocessors.

Positive is that, according to the pricing page, neuland.ai operates and processes the entire HUB and all deployed models exclusively in the EU, provides a DPA pursuant to Art. 28 GDPR, and explicitly assures that customer data is not used to train language models. The DPA also excludes the use of customer data for the further development, optimization, or training of AI systems outside the specific contractual relationship and requires isolated processing. The Trust Center lists technical and organizational measures such as MFA, RBAC, logging, TLS 1.3, secure API communication, tenant separation, and backup/disaster recovery measures.

Negative is: The list of subprocessors predominantly names EU providers or EU entities, but also includes Perplexity AI, Inc. in the USA for optional processing of current events; depending on usage, this requires a review of transfers and subprocessors.

Server location: neuland.ai states EU operation and EU processing; for Enterprise, cloud or on-premise operation is also possible. Conclusion: For companies, law firms, financial institutions, public administration, and regulated organizations, neuland.ai appears significantly better positioned from a data protection perspective than many public AI services; however, when using optional US services, integrations, and customer-specific workflows, the DPA, subprocessors, data flows, and configuration should still be reviewed. Sources: neuland.ai pricing, Trust Center, DPA, TOMs, and subprocessors.

Data protection information

Link

"AI-first coding in your natural language"

Gemini Code Assist is Google's AI-powered coding assistant for the entire software development lifecycle. It supports code completion, generation, chat, testing, debugging, and documentation in IDEs and—in the Business editions—additionally in various Google Cloud interfaces such as BigQuery, Cloud Run, Firebase, or Apigee.Gemini Code Assist

AI-first coding in your natural language

7.3/10 KIFOX Score – Good
Free No-cost tier for individual developers; suitable for code completion, chat, and coding assistance in supported development environments. Subscription Gemini Code Assist Standard Monthly or annual user licenses; includes professional coding assistance, IDE support, Gemini CLI, code completion, chat, smart actions, and enterprise data privacy framework.

Gemini Code Assist Enterprise Advanced enterprise version with enterprise features such as code customization, metrics/observability, private codebase contexts, enterprise access controls, and stronger governance. Other Google Developer Program Gemini Code Assist is also available through the Google Developer Program; exact features depend on the respective program status.

Custom Quote / Google Cloud For larger organizations, individual Google Cloud offers, billing via Google Cloud, and the Pricing Calculator may be relevant.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Gemini Code Assist is conditionally to well suited, especially in the Standard and Enterprise editions.

Positive is that Google Cloud states for Standard and Enterprise that prompts are processed in accordance with the Cloud Terms and the Cloud Data Processing Addendum; prompts and responses are not used to train the Gemini Code Assist Standard and Enterprise models. Prompts are transmitted in encrypted form. In addition, Google Cloud cites security and compliance controls such as IAM, Private Google Access, VPC Service Controls, Enterprise Access Controls, as well as certifications such as SOC 1/2/3, ISO 27001, 27017, 27018, and 27701.

Negative is that the free Individual version must be assessed under a separate Privacy Notice and does not offer the same enterprise data protection framework as Standard/Enterprise. In addition, Google Cloud remains a shared responsibility model: customers must correctly configure projects, access, repositories, logs, extensions, and data sharing.

Server location: For Standard/Enterprise, data residency depends on Google Cloud configuration, service terms, and regional settings; a blanket local or on-prem deployment is not substantiated.

Data Governance Privacy Privacy Notice for Individuals

Link

Robotics

“The world’s leading robotics company” / Product positioning: “Robots for the Real World”.

Boston Dynamics is a U.S. robotics manufacturer with products including Spot, Stretch, Atlas, and Orbit. Spot is a mobile four-legged inspection robot, Stretch is a mobile warehouse robot for case handling, Atlas is an electric humanoid robot for industrial material handling applications, and Orbit is software for fleet management and data analysis.Boston Dynamics

Robotic "The world’s leading robotics company"

7.9/10 KIFOX Score – Good
Other Atlas Humanoid enterprise robot for industrial work, material handling, workflow integration, autonomous tasks, fleet skill rollout, MES/WMS integration, and early customer deployments. Public pricing not available; contact/qualification required.

Spot Commercially available four-legged mobile robot for inspection, security, digital twin, construction sites, energy, research, and hazardous environments; includes SDK, payloads, arm, tablet, and support options.

Stretch Commercial warehouse robot for trailer unloading, container unloading, and case handling; operates within existing warehouse infrastructure and is designed for continuous package/case handling processes.

Orbit Robotics fleet and data platform for managing robot deployments, inspection data, site maps, metrics, missions, and integrations with enterprise systems.

Spot Care / Stretch Care Support and service offerings for long-term operation, maintenance, training, and reliable use of robot fleets.

Developer Documentation / SDK Development documentation and SDKs, particularly for Spot, for integrating custom applications, payloads, data flows, and robotics workflows.

Early Adopter / Enterprise Deployment Atlas is currently being rolled out through qualified enterprise inquiries and early deployments; there is no standard public purchasing channel for private individuals. (bostondynamics.com) Spot: CE conformity publicly documented.

Stretch: EU conformity officially stated in the brochure.

Atlas: No public record of CE conformity found; verify separately before use in the EU.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-compliant, depending on the product, contract, region, and operating mode.

On the positive side, Boston Dynamics provides a detailed privacy policy, identifies categories of personal and non-personal data, does not sell personal data or share it for third-party marketing, and describes the rights of data subjects. The Privacy Policy also outlines technical, administrative, and physical security measures, as well as restricting access to individuals with a business need to know. (bostondynamics.com)

On the negative side, Boston Dynamics is based in the U.S. and explicitly describes international data transfers. For Spot and Stretch, service logs and performance metrics are processed in the U.S. Depending on the configuration or upload, service logs may also contain raw sensor data, images, and audio data; Boston Dynamics explicitly states that only image and audio data should be sent if you agree to have Boston Dynamics engineers view or listen to them. For Spot, performance metrics can be disabled on Enterprise robots; for Stretch, robots must have regular internet access to transmit diagnostic data. (bostondynamics.com)

Server location: For general personal data, Boston Dynamics lists its own offices as well as third-party providers worldwide. For Spot/Stretch service logs and performance metrics, processing in the U.S. is specified. According to the Spot Privacy Notice, Orbit Cloud data is stored in the region selected at the time of purchase; this does not automatically guarantee EU data residency. No publicly available EU DPA or complete list of subprocessors was found in the official sources reviewed: No verified information available. (bostondynamics.com)

Conclusion:
Boston Dynamics is better documented in terms of data protection for businesses than many robotics manufacturers, but a contract review is mandatory for GDPR-critical EU deployments: DPA/AVV, transfer mechanism, region for Orbit, deactivation/control of logs, image/audio sensor data, remote maintenance, retention, role-based access rights, and deployment context must be clarified prior to commissioning.

PRIVACY POLICY

Boston Dynamics Expands Global Sales of Spot® Robot

Link

Intelligent Automation & AI Agents Platform

Mazaal AI combines AI agents with workflow automation. Users can train agents using their own documents, websites, Q&A pairs, and data sources, deploy them as a website widget, in messaging channels, or via API, and connect them to automations that perform actions in third-party systems.

The current website also highlights a browser-based assistant that executes commands directly in any tab.Mazaal

Your Browser, Now on Autopilot

3.2/10 KIFOX Score – Insufficient
Free Includes monthly AI credits and task credits; according to the homepage, no credit card required. Suitable for testing initial agents, workflows, and integrations. Subscription Basic For individuals who want to automate everyday work; includes AI Credits, Task Credits, all integrations, email support, unlimited workflows, and unlimited AI agents.

Team / Pro The official pages are inconsistent here: the homepage calls it Team, the pricing page calls it Pro. In terms of content, the middle plan is intended for teams that want to scale workflows across multiple tools; it mentions more AI Credits, more Task Credits, all integrations, Priority Support, unlimited workflows, and unlimited AI agents.

Business For organizations with Custom AI and admin control; includes more AI Credits and Task Credits, all integrations plus Custom Integrations, Dedicated Support, unlimited workflows, and unlimited AI agents. Other Enterprise Custom offer for larger requirements; according to the pricing page with unlimited messages/credits, Dedicated Account Manager, and Premium Support.

Additional credits / API / AppSumo special models Mazaal uses AI Credits for model calls and Task Credits for integration runs. According to the documentation, additional credits can be purchased in the dashboard, but only on paid plans. AppSumo-specific plans and special conditions are also mentioned.
– (0)

Link

GDPR: Unclear GDPR assessment: From a GDPR perspective, Mazaal AI is unclear to only conditionally suitable.

Positive is that Mazaal mentions technical and organizational security measures in its Privacy Policy, such as encryption, access controls, audits, and training. In addition, Mazaal explicitly states for Google Workspace API data that it does not use this data for the development, improvement, or training of AI/ML models and processes data only for the purposes authorized by the user.

Negative is that the Privacy Policy primarily refers to the Australian Privacy Principles and the Australian Privacy Act; I could not reliably find any explicit GDPR-compliant DPA/AVV, SCCs, EU representative, subprocessor list, or robust EU data residency information publicly available. In the Terms, the user also grants Mazaal a license to use, store, and process User Data in order to provide and improve the solution.

Server location: No verified information available; Mazaal describes itself in the Terms as an Australian company, but does not specify any reliable data center or data residency location.

Privacy Policy

Link

“A suite of free AI-powered features …”

Shopify Magic is Shopify’s integrated AI suite for e-commerce workflows.

It supports, among other things, writing product descriptions, blog posts, emails, theme content, suggested replies in customer support, customer segment descriptions, as well as AI-powered image editing in the file editor. The features are generally available for free within Shopify, but the specific availability of individual features may vary depending on the functional area.Shopify Magic

A suite of free AI-powered features …

7.7/10 KIFOX Score – Good
Subscription Shopify offers testing options; Shopify Magic can be used in the Shopify admin as an integrated AI feature as soon as a suitable Shopify store is being used. Other Basic For small shops; online store, product management, checkout, payment processing, basic commerce features, and access to relevant Shopify features including AI features where available.

Grow For growing merchants; more features, better scalability, and enhanced commerce/reporting options compared to Basic.

Advanced For larger teams and shops; advanced reports, higher scalability, stronger commerce features, and more operational control. Other Shopify Plus Enterprise commerce with individual contracts, greater scalability, enhanced customization, automation, and support features.

Retail / Starter / Agentic / Enterprise / Apps Additional Shopify offerings for POS/retail, simple sales channels, agentic commerce features, enterprise scenarios, and app extensions.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, Shopify Magic/Sidekick is conditionally to well suited, provided Shopify is configured correctly.

Positive is that Shopify provides a Data Processing Addendum and explains in the Help Center that, in the context of data processing on behalf of a controller, Shopify follows the merchant’s instructions and takes European data protection laws into account. Shopify also offers customer privacy settings such as a privacy policy, cookie banner, data sales opt-out, and privacy apps. Another positive aspect is that Shopify Magic is integrated directly into the admin and supports functions such as product descriptions, blog posts, pages, messaging, theme editor, media editing, and Sidekick analytics.

Negative is that Shopify explicitly points out that using Shopify alone does not guarantee GDPR compliance; merchants remain responsible for the legal basis, cookie/consent configuration, apps, tracking, payment services, marketing, and Enhanced Services.

Server location: No blanket EU-only guarantee; Shopify can be used globally and processes data internationally depending on the service, app, payment provider, and Enhanced Services.

Shopify Magic Using Shopify to help comply with GDPR Shopify Data Processing Addendum

Link

"Bitrix24 is a free online workspace for your company: CRM, tasks, online appointments, and much more."

Bitrix24 is a cloud-based and optionally self-hosted business platform with CRM, task and project management, team communication, contact center, websites, online store, HR functions, document management, automation, and an AI assistant. The AI assistant CoPilot supports, among other things, writing, summarizing, translating, creating tasks, checklists, CRM call transcription, CRM field population, and website text/image generation.Bitrix24

Bitrix24 is a free online workspace for your company: CRM, tasks, online appointments, and much more.

8.2/10 KIFOX Score – Very good
Free Free entry with unlimited users, limited storage, as well as core features for collaboration, tasks & projects, CRM, Bitrix24 Sign, Drive, Contact Center, and website builder. Subscription Basic Entry-level plan for smaller teams with more storage, user quota, collaboration, tasks & projects, CRM, Bitrix24 Sign, Drive, Contact Center, website builder, online store, and support.

Standard Advanced plan for teams with more users and storage, plus marketing, online documents, administration, and advanced business features.

Professional Comprehensive business plan with greater user and storage capacity, X5 CRM, marketing, online documents, electronic HR signature, Sales Intelligence, automation, HR management, support, and administration.

Enterprise Scalable enterprise plan for larger organizations with many users, large storage capacity, Enterprise package, multiple branches, centralized management, optimized multiuser infrastructure, complete data isolation, advanced backups, and support features. Other Bitrix24 On-Premise Edition Self-hosted version for your own servers with full access to source code and API; according to Bitrix24, intended for large companies and corporate groups.

CoPilot / AI Features AI features for CRM, tasks, chat, feed, websites, email, flows, website images, prompt library, and CoPilot roles; availability depends on the plan and the specific feature.

Marketplace / Apps / Integrations Hundreds of apps and integrations via the Bitrix24 Marketplace; third-party apps may involve their own contracts, privacy policies, and data processing.

MCP Server Connection of external AI systems with Bitrix24 to perform actions in CRM, tasks, and other tools; disabled by default and controllable by administrators.
– (0)

Link

GDPR: Yes Overall assessment: Conditionally to well suited for GDPR compliance, depending on the domain, plan, AI usage, and integrations.

Positive is that Bitrix24 provides a data processing agreement for users from the EU, and according to Bitrix24 this is part of the terms of use. For accounts in the bitrix24.de and bitrix24.eu domain zones, Bitrix24 states that user data is hosted in AWS data centers in Frankfurt am Main, Germany. The infrastructure/subprocessor overview lists, among others for Europe, AWS Frankfurt for data, file, real-time communication, mail, document preview, and Bitrix24.Sites servers, as well as AWS Dublin for certain customer data/network components. Also positive are GDPR features such as data anonymization and data portability via Marketplace apps, as well as security measures such as TLS access, access restrictions, OTP for server access, daily backups, and tenant separation.

Negative is that Bitrix24 includes numerous modules and integrations, and depending on usage, additional third parties may be involved. The official subprocessor/infrastructure overview lists, among others, Voximplant/Zingaya for telephony, Google/Firebase/GCP for analytics/marketing, Mailchimp, Servers.com, MF Management, and OpenAI OpCo, LLC for CRM functions and speech transcription. For CoPilot, Bitrix24 states that third-party AI models such as OpenAI are used; according to the CoPilot FAQ, Bitrix24 stores data for technical reasons for up to 14 days and then deletes it. At the same time, the CoPilot product page states that data is not used for training and is deleted from the provider server after the CoPilot dialog is closed. These statements should be reviewed contractually and technically before productive processing of sensitive data.

Server location: For bitrix24.de/bitrix24.eu: predominantly Germany/Frankfurt, partly Ireland/Dublin and Amsterdam according to the infrastructure overview. For other domain zones, data may be hosted outside the EU, especially in the USA. For EU customers, choosing the correct domain/region is therefore essential. Conclusion: Bitrix24 is generally well usable for GDPR-oriented companies if bitrix24.de or bitrix24.eu is used, the DPA is accepted, subprocessors are reviewed, AI/MCP functions are controlled, and third-party integrations are deliberately enabled. For particularly sensitive data, CoPilot should only be used after an additional AI data protection review.

Privacy Policy GDPR

Link

“Open-source orchestration for zero-human companies”

Paperclip is a self-hosted open-source platform for orchestrating teams of AI agents. The tool organizes agents as “employees” with an org chart, roles, budgets, governance, tasks/tickets, heartbeats, and audit trails.

Paperclip is explicitly a Control Plane, not an Execution Plane: the agents run externally via adapters such as Claude Code, Codex, Gemini, Cursor, OpenClaw, shell processes, or HTTP webhooks.Paperclip AI

The human control plane for AI labor

6.0/10 KIFOX Score – Solid
Free According to the official website, Paperclip is MIT-licensed, self-hosted, and usable without a Paperclip account. It includes agent orchestration, org chart, tickets, governance, cost control, and local/remote deployments. Other possible, but unclear The Terms mention services from Paperclip Labs, including a hosted platform, APIs, telemetry backend, and proprietary features; I could not reliably substantiate any specific public pricing models.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Paperclip AI is unclear to critical when using hosted services, but potentially well controllable with consistent self-hosting.

Positive is that, according to the official website, Paperclip is open source, MIT-licensed, and can be used self-hosted; it can be run locally with embedded Postgres or with your own Postgres database, without a Paperclip account. This is fundamentally advantageous for data protection, data residency, and auditability.

Negative is that the Terms/Privacy Policy for Paperclip Labs services contains a broad license to use content for operating, improving, and developing the services; in addition, detailed telemetry may also be used for training and improving machine learning models if opted in. I could not publicly verify the existence of an explicit GDPR DPA/AVV, SCCs, or clear EU data residency for hosted Paperclip services.

Server location: Freely selectable with self-hosting; for hosted Paperclip Labs services, no verified information is available, and international transfers including the USA are mentioned in the Privacy Policy. Further links: Paperclip Website, GitHub, Terms & Privacy.

Privacy Policy

Link

Chat with Grok — the truth-seeking AI chatbot

Grok is a generative AI assistant from xAI, available on grok.com, iOS, Android, and on X.

It supports text and voice chat, coding and reasoning tasks, image/video generation, as well as document analysis. In addition, Grok can search the web and public X content in real time to provide more up-to-date answers.Grok

Chat with Grok — the truth-seeking AI chatbot

6.3/10 KIFOX Score – Solid
Free xAI has officially rolled out Grok 4.1 to all users on grok.com, X, iOS, and Android. The consumer FAQs describe, among other things, text/voice interaction, photo uploads/editing, and document analysis, but exact free limits are not publicly specified numerically. Subscription X Premium: from USD 8/month or USD 84/year on web; according to X, includes increased usage limits on Grok. X Premium+: from USD 40/month or USD 395/year on web; includes higher limits on Grok.

SuperGrok: officially exists; confirmed on grok.com and in xAI/X sources, but no reliably extractable public price figure is verifiable in the official sources accessible here – as of 16.04.2026.

SuperGrok Heavy: officially exists; provides access to Grok Heavy; likewise without a reliably extractable official price figure here.

Grok Business / Grok Enterprise: officially available; team workspace, secure sharing, enterprise privacy, and for Enterprise also custom retention; specific public standard prices could not be reliably verified in the accessible official sources. Other API / token-based: e.g. grok-4.20-reasoning at 2.00 USD / 1 million input tokens and 6.00 USD / 1 million output tokens; grok-4-1-fast-reasoning at 0.20 / 0.50 USD. According to the xAI Docs, server-side tools cost, among other things, Web Search 5 USD / 1,000 calls, X Search 5 USD / 1,000 calls, Code Execution 5 USD / 1,000 calls, Collections Search 2.50 USD / 1,000 calls; in addition, there are storage costs. X Premium Business: Basic 200 USD/month or 2,000 USD/year; Full Access 1,000 USD/month or 10,000 USD/year plus affiliate fees; includes Premium+ benefits and explicitly mentions SuperGrok. X Premium Organizations: Full Access 1,000 USD/month or 10,000 USD/year plus affiliate fees; includes Premium+ benefits including access to SuperGrok.
– (0)

Link

GDPR: Partly Positive: xAI has a Europe Privacy Addendum, designates X.AI LLC as the controller for Europe, offers data protection rights, a Privacy Portal, opt-out for model training, Private Chat, a Business DPA, SCCs, and a subprocessors list. For Business/API, xAI states that it does not use business data for model training; according to the Enterprise FAQ, inputs/outputs are automatically deleted unless an exception applies.

Negative: According to the Europe Addendum, xAI processes all personal data in the USA, where its primary data centers are operated. Consumer content may be used for training unless disabled. Grok on X is subject to X’s terms. In addition, DPC investigations are underway into X/Grok training with EU/EEA data and into sexualized AI content.

Server location: according to xAI’s Europe Addendum: USA; the subprocessors list shows predominantly US locations, and one xAI subsidiary in the UK. AVV/DPA: available for Enterprise/API; not usable as a classic data processing agreement for pure consumer use. SCCs: provided for international transfers in the DPA.

xAI’s Europe Privacy Policy Addendum

Link

The frontier AI research lab for visual intelligence.

Black Forest Labs is the company behind the FLUX models for AI-based image generation and image editing. The platform includes Playground, API, open-weights/self-hosting licenses, and enterprise offerings for visual AI workflows. FLUX.2 is officially described as a production model for image generation and image editing with multi-reference control and up to 4MP output.Black Forest Labs / FLUX

The frontier AI research lab for visual intelligence.

7.9/10 KIFOX Score – Good
Free Free or trial-based entry via the Playground; suitable for trying out FLUX.2 and image generation without your own integration. Other FLUX API / Pay-as-you-go API access to FLUX models; according to the pricing page for FLUX.2, FLUX Kontext, and additional image models with usage-based billing.

FLUX.2 [small] Fastest model variant for real-time use, prototyping, rapid iteration, and high speed; according to the model page also runnable locally and fine-tuning-ready.

FLUX.2 [pro] Production-oriented image generation and image editing with high quality and scalability.

FLUX.2 [flex] Variant for precise control, typography, small details, and finer visual control.

FLUX.2 [max] Highest-quality variant with particularly strong prompt adherence, editing consistency, professional output, and grounding features.

Self-Hosted Commercial License License for downloading, hosting, and using certain FLUX-[dev] models in your own applications; API resale or third-party API access is excluded without the corresponding rights.

Enterprise / Custom Deployment Custom enterprise options with dedicated infrastructure, custom fine-tuning, and integration support.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Black Forest Labs is conditionally suitable.

Positive is that the official German company BFL GmbH, based in Freiburg im Breisgau, is listed in the legal notice and that Black Forest Labs states ISO 27001 in the official footer. Another positive aspect is that there is a self-hosting path with FLUX-[dev] models, under which certain models can be downloaded under a commercial license, hosted, and integrated into your own applications.

Negative is that the Privacy Policy refers to the services of Black Forest Labs Inc. and, according to the Privacy Policy, prompts, image files, and outputs may be used for the provision, development, training, and improvement of the services or AI models. In addition, the FLUX API Service Terms expressly state that inputs and outputs may be used to improve the products and to train the AI models. I was unable to verify a publicly and clearly accessible AVV/DPA for standard API usage or a guaranteed EU-only data residency.

Server location: No guaranteed EU-only information is available for the Managed API / Playground; with self-hosting, the server location depends on your own infrastructure. Further sources: BFL legal notice, Privacy Policy, FLUX API Terms, Self-Hosted Terms.

Privacy Polic Usage Policy

Link

“Automate AI Workflows, Agents, and Apps”

Zapier is a no-code/low-code automation platform that enables workflows (“Zaps”) to be connected between SaaS tools, forms, spreadsheets, chatbots, and AI functions.

Zapier currently brings together Zaps, Tables, Forms, and Zapier MCP in a shared AI orchestration platform, positioning itself not only as a traditional integration service but also as a platform for AI workflows, agents, and chatbots.Zapier

Automate AI Workflows, Agents, and Apps

7.8/10 KIFOX Score – Good
Free Zaps, Tables, and Forms, limited Tasks, Two-Step Zaps, and Zapier Copilot with daily limits. Subscription Professional Multi-step Zaps, Premium Apps, Webhooks, Support, AI Fields, and Conditional Form Logic. Team Multi-user plan with Shared Zaps, folders, Shared App Connections, SAML SSO, and Premier Support. Other Enterprise Unlimited Users, advanced admin rights, App Controls, VPC Peering, annual task limits, Observability, and Technical Account Manager.

Task Tiers / Pay-as-you-go / Agents Billing based on task quotas; additional AI-/Agents-/MCP usage depending on plan and consumption.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Zapier is conditionally suitable. A positive aspect is that Zapier offers a Data Processing Addendum, and Enterprise customers can use governance features such as app controls and AI app restrictions.

Another positive is a model training opt-out, which applies automatically to Enterprise customers and is available to other customers.

Negative is that, according to its own privacy overview, Zapier hosts data on AWS servers in the USA, including customer data and data processed on behalf of customers. In addition, every connected third-party app creates additional data flows, for which the customer must review the respective legal basis and DPAs.

Server location: USA on AWS. Further link: Zapier Data Privacy, DPA and Security/Compliance.

Data Privacy Overview

Link

"Where AI agents share, discuss, and upvote. Humans welcome to observe."

Moltbook is a public social platform where AI agents can post, comment, vote, and organize themselves into communities ("Submolts").

Humans are primarily intended as observers. In addition, Moltbook positions itself as an identity layer for agents: developers can build apps in which bots authenticate with their Moltbook identity and bring their reputation with them.Moltbook

A Social Network for AI Agents

5.2/10 KIFOX Score – Limited
Free The website is publicly accessible; people can observe agent activity. For active use, X/Twitter login or developer access is currently relevant. Other Developer Early Access
Early Access for developers who want to build apps for AI agents; mentioned are agent authentication, identity verification, agent marketplace, customer support bots, AI assistant platform, developer tools, and social platform for agents.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Moltbook is unclear to critical.

Positive is that Moltbook publishes a Privacy Policy, mentions UK/EEA rights, allows privacy inquiries, and describes security measures as well as data deletion or anonymization when the purpose of processing no longer applies.

Negative is that Moltbook may collect very extensive data, including X/Twitter login data, email, usage data, IP address, device information, agent names, content, API keys, or authentication tokens. Particularly critical is that Moltbook may use personal information and platform data for the development and improvement of services as well as for improving AI models. In the Terms, the user also grants Moltbook very broad, worldwide, and perpetual usage rights to content and data. I was also unable to reliably find a publicly documented DPA/AVV, SCC agreement for customers, or clear EU data residency.

Server location: No verified information available; the Privacy Policy mentions possible transfers and storage outside the EEA/UK, including in the USA and Canada.

Moltbook Privacy Policy Moltbook Terms of Service

Link

"Track & Boost Your Brand's Visibility in both AI Search (…) and Traditional Search"

Writesonic is an AI marketing platform for SEO, Generative Engine Optimization (GEO), AI search visibility, and content creation.

The tool monitors how brands appear in AI responses and search systems, provides recommendations for action, and supports the creation, updating, and optimization of content. According to the official documentation, Writesonic combines traditional search such as Google/Bing with AI search such as ChatGPT, Claude, Perplexity, Gemini, and Grok.Writesonic

Track & Boost Your Brand's Visibility in both AI Search (…) and Traditional Search

7.2/10 KIFOX Score – Good
Free Start without a credit card for SEO and AI content tools; no permanently fully featured free version recognizable as a guaranteed standard plan. Subscription Starter For early-stage brands with AI Search Tracking, GEO, AI Article Writer, Content Optimization, SEO & Content AI Agent, Chatsonic, and basic project/team features.

Basic For growing brands with more GEO tracking, more AI content, Site Audits, Premium SEO Data, integrations, and additional team/project limits.

Growth For scaling teams with more AI Search Tracking, content generation, SEO Audits, Sentiment Analysis, AI Search Volume Data, integrations, and enhanced support. Other Enterprise Custom solution for large brands and agencies with custom AI Search Tracking, custom limits, SSO/SAML, dedicated GEO strategist, account manager, and tailored projects.

Chatsonic / SEO Agents / Integrations Additional AI features for SEO, content, data analysis, web browsing, file uploads, image generation, and marketing workflows.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Writesonic is conditionally suitable.

Positive is that Writesonic provides a Data Processing Agreement in which Writesonic is described as the Processor, processes Controller Data according to customer instructions, and regulates confidentiality, security measures, audit rights, subprocessors, and international transfers with SCCs or recognized transfer mechanisms.

Negative is that Writesonic is a Delaware Corporation with an address in San Francisco and therefore remains a US provider. I could not publicly verify a blanket EU-only data residency.

Server location: No verified EU-only region publicly documented; US provider with international transfers and subprocessors. Further link: Writesonic DPA, Privacy Policy, Subprocessors, and Pricing.

Data Processing Agreement

Link