Find Your Tool in 6 Steps
Result: 144

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps
Results: 144
Search Images Video Music API Agent Voice Chatbot Coding Marketing
Provider login

“Leading partner for AI assistants for Swiss network operators and fiduciary firms”

Connect AI develops and operates tailor-made AI assistants for companies, primarily for customer service, internal knowledge work, sales, and industry-specific scenarios such as fiduciary services. The core product, Employee GPT, is marketed as a secure alternative to ChatGPT/Copilot for companies that can be operated in Switzerland or the EU. The offering is complemented by AI rollout programs for executives, teams, and companies.Connect AI

AI assistants for businesses, especially for customer service, internal knowledge work, sales, and industry-specific scenarios such as fiduciary services

7.4/10 KIFOX Score – Good
Subscription Employee GPT / Employee GPT Secure private ChatGPT alternative for companies; according to the provider, with internal knowledge sources, Swiss hosting, no training on customer data, role-based permissions, private container environments, and customer ownership of data, knowledge bases, and chat logs. The pricing logic is described in a blog post as a monthly fee per employee plus a one-time onboarding fee.

AI Customer Support AI agents, help center, personalized responses, knowledge library, analytics and reports, service quality, and multilingual 24/7 support.

Sales Agent Personal sales agent for customers, lead qualification, product recommendations, upselling/cross-selling, audience insights, analytics, and reduction of cart abandonment.

Event Agent / TreuhandGPT / AI Strategy Listed on the website as additional solutions; specific public details on plans and features are not fully verifiably available. Other Customer-specific implementation & operation The Terms and Conditions describe Connect-AI Services as the customer-specific implementation and operation of the Connect-AI platform; fees, packages, usage volume, and term are defined in the respective Agreement.

Onboarding / Consulting / Integrations According to the Employee-GPT blog, the pricing framework includes not only the platform and secure hosting but also training and personal support; specific terms are clarified on a project-by-project basis.
– (0)

Link

GDPR: Yes GDPR assessment: From a data protection perspective, Connect AI is well suited to very well suited, especially for Swiss and European companies with high requirements for data sovereignty.

Positive is that Connect AI Group GmbH is based in Zurich, Switzerland, and in its privacy policy describes processing in accordance with applicable Swiss and European data protection requirements, including reference to GDPR/DSGVO. For Employee GPT, Connect AI highlights particularly strong data protection features: models hosted in Switzerland, no data transfer abroad, no sharing of data with third parties, no use of customer data for model training, role-based access rights, private container environments, and hosting with FINMA-certified partners such as Swisscom. In addition, according to the Employee GPT page, customers retain ownership of data, knowledge bases, and chat logs.

Negative is that the general privacy policy also mentions Google Cloud and HubSpot; electronic customer data is described there as being stored with Google Cloud, and HubSpot may store data, among other places, in the USA. In addition, the terms and conditions state that Connect AI may use third parties/subcontractors and that, unless otherwise agreed, the agents are operated using OpenAI technology via Microsoft Azure. For a robust GDPR/FADP assessment, the AVV/DPA, subprocessors, specifically selected hosting, model providers, deletion periods, and data flows should therefore be contractually reviewed for each project.

Server location: For Employee GPT, according to the provider, Switzerland; in general, the privacy policy mentions physical data in Switzerland & Europe as well as electronic data with Google Cloud.

Privacy Policy

Link

"AI-Powered Professional Document Translation Tool"

Doclingo is an AI tool for translating PDF, Office, and scanned documents, with a focus on preserving layout, OCR, bilingual output, and post-editing.

Supported formats include PDF, Word, PPT, Excel, images, and others; there are also features such as a glossary, online editing, document chat, highlight-to-translate, and API integration.Doclingo

AI-Powered Professional Document Translation Tool

3.7/10 KIFOX Score – Insufficient
Free On the pricing page, visitors and registered users are listed as usage tiers; included are document-related translation features with restrictions. Specific limits are not always displayed cleanly on the rendered page. Subscription Premium Includes extended premium benefits such as more download/translation usage, batch upload, history, engine selection, online editing, document conversation, glossary, image translation, OCR, premium customer service, watermark removal, PDF tool usage, and AI proofreading.

Premium+ Extended premium tier with higher limits/additional benefits compared to Premium; the page mentions Premium+ and additional booster/discount benefits, but some limit values are publicly displayed as “undefined.” Other Booster Package / Character Pack as a one-time, non-auto-renewing model; according to the Help Center, usable with the same premium benefits and no time limit. For API usage, character-based quotas apply; if the quota is exhausted, you can buy Booster Packages or upgrade to higher memberships. For larger volumes, a Bulk Purchase / Discount Quote is offered via Sales contact. According to the official help, payments are processed via PayPal and Stripe; invoices are issued through Stripe.
– (0)

Link

GDPR: Unclear GDPR assessment: From a GDPR perspective, Doclingo is unclear to critical.

Positive is that Doclingo describes security measures, account deletion, data subject/user rights, and third-party SDKs in its Privacy Policy. It is also positive that the platform is functionally clearly documented for document translation, OCR, layout preservation, and bilingual output.

Negative is that I could not publicly find a verified GDPR data processing agreement (DPA/AVV), no SCCs, no clear EU data residency, and no reliable list of subprocessors. The Privacy Policy states that the applicable law is the law of the People's Republic of China and names Wuhan Loke Network Technology Co., Ltd. in Wuhan, Hubei, China as the company.

Server location: No verified information available; an EU server location is not publicly documented. Further links: Doclingo website, Pricing/Plan page, Privacy Policy.

Service Agreement Doclingo Privacy Policy

Link

"The leading AI platform"

innoGPT is a German multi-model AI platform for private users, teams, and companies. Officially, it combines language models, image generation, voice integration, file/document work, a prompt library, projects, Code Interpreter, web search, academic search, Deep Research, assistants, integrations, and an API in one interface. It also includes team features, desktop apps, and a clear data protection/compliance focus with EU hosting, DPA, and Trust Center.InnoGPT

All AI models. One tool. Permanent updates. Fully GDPR-compliant

7.7/10 KIFOX Score – Good
Free Free trial period without payment details according to the provider; suitable for evaluation. Subscription Personal According to the public OMR profile for private use with access to all models and functions except team functionality.

Business According to the OMR profile for companies with all functions, all models, no limits, up to 1000 users, as well as SSO/SCIM/SAML. Other Enterprise Custom offer for large organizations; according to the OMR profile for 1000+ users, on-premise possible and individual support.

Shared-/Family models A shared-access/family model with EU hosting was mentioned publicly; specific functional details should be checked directly with the provider.
– (0)

Link

GDPR: Yes GDPR assessment: InnoGPT is well suited from a GDPR perspective, especially for German and European companies.

Positive is that InnoGPT advertises EU/Germany hosting, GDPR compliance, ISO 27001, AES-256 encryption, TLS transmission, row-level security, access controls, a DPA under Art. 28 GDPR, zero training, and configurable automatic deletion periods. According to the security page, data is physically located in Frankfurt am Main with certified EU providers; InnoGPT also describes an encryption layer intended to prevent the infrastructure host from viewing readable content.

Negative is that, according to the provider, AWS Frankfurt is used; therefore, companies should review subprocessors, the DPA, key management, ties to US providers, model providers, and specific data flows.

Server location: Frankfurt am Main / Germany according to the InnoGPT security page. Further link: InnoGPT Privacy & Security, Privacy and Cost/Compliance Blog.

Privacy

Link

"The central AI platform for your company."

Logicc is a central B2B AI platform that bundles several leading models into one interface and offers features such as web search, deep research, document chat, image generation, assistants, and code support.

The platform is clearly geared toward businesses and advertises EU/Germany hosting, "No AI training," and optional hosting on your own servers. Officially, Logicc mentions, among others, ChatGPT/OpenAI, Gemini, Claude, and Mistral models, as well as Smart Select AI for automatic model selection.Logicc

The central AI platform for your company

7.7/10 KIFOX Score – Good
Free Free trial period with no obligation; suitable for trying out in a team. Subscription Business Access to all AI models, Smart Select AI, unlimited document uploads, text/voice/document chat, web search, security standards, EU computing, no AI training, and GDPR compliance.

Secure+ Everything in Business plus team collaboration, custom assistants, shared assistant library, higher usage limit, priority support, and a stronger focus on secure team use.

Max Everything in Secure+ plus very high usage limits, access to powerful models, §203 StGB confidentiality agreement, SSO/Identity Management, end-to-end encryption, and support for security/privacy questions. Other Enterprise Custom offering with many users, individual API integrations, SSO/Identity Management, advanced compliance features, dedicated support, SLA, onboarding workshop, training, possible own server hosting, and model API.

Own API keys / integrations / model API Relevant in higher-tier or Enterprise contexts for individual system connectivity, databases, software integration, and API usage.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, Logicc is well suited, provided the provider’s statements are contractually confirmed.

Positive is that Logicc explicitly promotes GDPR compliance, EU computing for all models, no AI training, and the secure use of leading models in Europe. Logicc states that it does not use data to train language models and provides AI models in Germany or on European servers. Also positive are Secure+ and Max features for professionals bound by confidentiality, a Section 203 German Criminal Code confidentiality agreement, end-to-end encryption, SSO/identity management, and access to certificates/audits in higher-tier plans.

Negative is that, for a reliable assessment, the DPA, subprocessors, specific model providers, the technical implementation of EU computing, deletion periods, and audit evidence should be reviewed directly.

Server location: According to the provider, Germany or European servers / EU computing for all models.

Privacy Policy

Link

“Design anything in seconds with AI” / “the world’s easiest way to design anything with the power of AI”

Playground is an AI design and image editor for logos, social media posts, stickers, T-shirts, mockups, memes, illustrations, and image editing via prompt. The current product is more focused on AI design and templates than on classic pure text-to-image boards.Playground AI

Design anything in seconds with AI

3.5/10 KIFOX Score – Insufficient
Free Free Plan
Limited Playground-v3 edits, very limited monthly edits for certain external/premium models, daily download limit; Background Removal and Upscaling only in the Pro Plan. Subscription Pro: higher limits, background removal, upscaling, more premium model edits.

Pro Plus: significantly higher quotas for premium models and extended usage. Other Day Pass One-time 24-hour access with an additional credit/edit quota.

Credit Purchases Additional credits for certain models such as GPT-4o, Seedream, or Nano Banana; credits can be purchased additionally.

iOS Subscriptions In the App Store, Design Pro and Design Pro Plus are listed as in-app subscriptions; the scope of features may differ from web subscriptions.
– (0)

Link

GDPR: Unclear Overall assessment: Unclear to conditionally GDPR-suitable.

Positive is that Playground AI describes GDPR rights for EEA, UK, and Swiss users in its Privacy Policy and states that it does not sell personal data. According to the Terms, the tool allows personal and commercial use of the created assets; users generally own the assets they create with the service under the Terms.

Negative is: Playground AI collects and stores, among other things, names, email addresses, payment information, content/files, IP addresses, device information, geolocation, and usage data. The Privacy Policy allows the use of personal data to provide, improve, and develop the services. The Terms also indicate that assets may be publicly visible and remixable by default and that users grant Playground AI a broad, worldwide, perpetual, irrevocable, and royalty-free license to inputs/outputs or assets.

Server location: no specific hosting region confirmed; the Privacy Policy states that information may be stored in the normal course of business on computers in other countries outside the home country. A public DPA/AVV, EU data residency, SCC documents, or a complete list of subprocessors could not be clearly found: No confirmed information available.

Conclusion: Well suited for general creative work; only suitable to a limited extent for confidential designs, customer motifs, images of people, or sensitive data. Sources: Playground Privacy, Terms, Help Center.

Privacy

Link

"Your medical AI assistant."

Tandem is an AI-powered medical assistant for doctors, therapists, nurses, and healthcare facilities.

The tool supports the preparation, documentation, and follow-up of treatment appointments, creates medical notes and documents in seconds, suggests suitable diagnosis and procedure codes, and allows editing via voice input. According to the website, Tandem supports over 50 specialties and integrations with more than 100 medical systems.Tandem Health

Your medical AI assistant

7.8/10 KIFOX Score – Good
Free For clinicians who want to integrate Tandem into their workflow without commitment; includes unlimited note generation, limited custom templates, inviting up to two colleagues, and limited daily Pro Actions. Subscription Pro – unlimited note and document generation, unlimited Pro Actions and personalization, 1-click transfer to 100+ medical systems, unlimited templates, clinician-led support.

Enterprise – everything in Pro plus custom integrations, onboarding/training/rollout, prioritized support, enterprise authentication, and detailed usage reports. Other Enterprise For larger practices and care organizations; includes everything in Pro plus custom EHR integrations, full onboarding, training & rollout, priority support, enterprise authentication, and detailed usage reports.

Custom Integrations Custom integrations into medical record systems if a system is not yet supported.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, Tandem Health is well to very well suited for European healthcare contexts.

Positive is that Tandem Health AB is based in Stockholm, Sweden, and the Privacy Policy explicitly addresses GDPR, Art. 13/14 information, roles as controller/processor, and the processing of special categories of data such as health data. When the platform is used by clinics or practices, Tandem acts as a processor and processes patient data on documented instructions under a DPA. Also positive are ISO 27001, ISO 13485, NEN 7510, NHS/Cyber Essentials Plus references, CE/MDR context, EU data hosting, no storage of audio recordings, and no training on patient or personal data.

Negative is that each institution must still review its own legal basis, patient information, consent/objection processes, EHR integration, retention periods, and clinical responsibility.

Server location: According to Tandem, patient data is processed and stored exclusively in European data centers.

Privacy policy

Link

“Build exactly what you envision with AI + no-code development.”

Bubble is a no-code platform for building web and mobile apps with visual logic, a database, workflows, API integrations, and now also AI-powered app generation.

The tool is aimed at makers, startups, agencies, and companies that want to build and operate applications without traditional full-stack development. In doing so, Bubble covers development, deployment, hosting, and scaling within its own platform ecosystem.Bubble

Build exactly what you envision with AI + no-code development

6.8/10 KIFOX Score – Solid
Free Free entry point for building and testing web/mobile apps; not intended for fully productive use with your own domain. Subscription Starter For initial live apps with web app, live website, custom domain, and basic workload.

Growth For growing apps with more workload, more editor/branching options, and advanced production features.

Team For scaling teams with sub-apps, multiple app editors, more branches, more workload, and longer server logs. Other Enterprise Custom workload, choice of hosting location, customizable server, dedicated support, and individual app/mobile limits.

Add-ons Workload tiers, additional file storage, and plugin subscriptions.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Bubble is conditionally suitable.

Positive is that Bubble offers a GDPR-compliant Data Processing Agreement, acts as a processor, addresses SCCs/transfer mechanisms, and documents security measures such as TLS, AES-256 encryption, AWS infrastructure, SOC 2 Type II, penetration tests, and Privacy Rules. It is also positive that Enterprise customers can purchase a dedicated AWS instance with a choice of hosting region.

Negative is that Bubble is a US provider, apps run by default on the Bubble Cloud/AWS, and Bubble explicitly states in the DPA that sensitive data should not be entered into the service. In addition, plugins, APIs, tracking, payment providers, and external databases create additional data flows.

Server location: By default, Bubble Cloud on AWS; for Enterprise, a dedicated AWS instance with a choice of hosting region can be used. Further link: Bubble Security, DPA and Pricing.

Privacy

Link

"Work AI that Works"

Glean is an enterprise work AI platform that brings together search, assistants, and agents across enterprise data.

The platform connects to business applications, documents, chats, and tickets, respects existing permissions, and supports features such as enterprise search, generative answers, data analysis, deep research, and agentic automation. It is clearly geared toward enterprises rather than consumer self-service.Glean

Work AI that Works

7.8/10 KIFOX Score – Good
Subscription Glean Enterprise Work AI platform with Enterprise Search, Assistant, Agents, Connectors, permissions, company context, and security features.

Glean Enterprise Flex Seat-based licensing combined with pooled FlexCredits for advanced AI features; includes platform capabilities and usage-based premium features. Other FlexCredits / Usage-based Features Advanced features such as Thinking Mode, Deep Research, Data Analysis, Canvas, image understanding, and other features may consume credits.

APIs / Developer Platform / MCP APIs for Search, Chat, and Agents; integrations with Cursor, Claude Code, Copilot, and MCP hosts.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Glean is conditionally to well suited, especially for enterprise customers with a clean contract, DPA, and subprocessors review.

Positive is that Glean promotes enterprise security, GDPR relevance, SOC 2, HIPAA, encryption, zero-trust principles, permission inheritance from connected systems, and sensitive content policies. It is also positive that Glean provides a list of subprocessors and designs its platform around enterprise data, identities, and access controls.

Negative is that, as a global organization, Glean may transfer and process personal data in the USA or other jurisdictions; a blanket EU-only data residency is not publicly documented as a standard.

Server location: No confirmed general EU-only data residency; international transfers, including to the USA, are mentioned in the Privacy Policy.

Glean Privacy Statement

Link

“Turn text into video with AI”

HeyGen is an AI video platform that enables the creation, localization, and personalization of avatar-based videos from text, images, audio, presentations, or templates.

The product includes, among other things, AI Studio, Video Translation, Digital Twins, Voice Cloning, Video Agent, as well as API, CLI, and MCP access. Officially, HeyGen states that it has 100,000+ teams on the web platform and 1,000,000+ developers on the developer platform.HeyGen

Turn text into video with AI

6.9/10 KIFOX Score – Solid
Free Limited number of short videos, custom digital twin, standard processing, stock avatars, 720p export, sharing/download, as well as trial access to premium features. Subscription Creator For solo creators; longer videos, Custom Digital Twin, unlimited Photo Avatars, many Stock Video Avatars, Voice Cloning, many languages, faster processing, 1080p, Brand Kit, and watermark removal.

Pro For advanced individuals; everything in Creator plus significantly more premium usage, faster processing, translation script editing, and 4K export.

Business For teams/businesses; everything in Creator plus more generative usage, multiple Custom Digital Twins, centralized billing, Auto-Reload Credits, team members, Workspace Collaboration, comments, interactive videos, Screen Recorder, SCORM export, LMS and automation integrations. Other Enterprise Custom offer with unlimited videos, no maximum video duration, 4K, fastest processing, multi-workspace control, role management, SCIM, MFA, commercial contract terms, priority support, dedicated CSM, and onboarding.

API Pricing Separate API access for developers and product teams; HeyGen refers to a separate API pricing overview.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, HeyGen is conditionally to well suited, especially in the enterprise context.

Positive is that HeyGen provides a Data Processing Addendum in which HeyGen is described as the Processor and the customer as the Controller; the DPA contains references to GDPR, SCCs, the UK Addendum, subprocessors, data subject rights, and security measures. Also positive are SOC 2 Type II, GDPR/CCPA references, the EU-US Data Privacy Framework, a European DPO, and the note that enterprise data is excluded from AI training by default; according to HeyGen, all users can request an opt-out from AI training by contacting them.

Negative is that, according to the Security page, HeyGen stores all customer data in the USA on AWS infrastructure. For EU companies, the DPA, SCCs/DPF, Transfer Impact Assessment, avatar consents, voice cloning rights, and sensitive training content should therefore be reviewed.

Server location: USA on AWS infrastructure. Further links: HeyGen Security, DPA, GDPR Compliance.

Security

Link

"Your Visual Studio"

Fotor is a web-based creative and image editing tool with AI features for photo enhancement, background removal, retouching, text-to-image, image-to-video, design templates, and AI agent workflows.

The tool runs in the browser as well as on Windows, Mac, iOS, and Android and is aimed at beginners, content teams, marketers, freelancers, and smaller businesses that want to create visual content without complex professional software.Fotor

Your Visual Studio

6.8/10 KIFOX Score – Solid
Free Free forever; limited credits, one simultaneous generation, few chats and tasks with AI Agent Sisi, basic editing, basic templates, limited effects/fonts, limited creation storage duration, small cloud storage, and exports with watermarks. Subscription Fotor Pro More credits, multiple simultaneous generations, significantly more AI Agent Sisi chats, AI Agent tasks, 100+ editing tools, AI portrait retouch, many templates/assets, premium effects/fonts, exclusive AI models, unlimited creation storage duration, more cloud storage, and watermark-free HD/transparent PNG exports.

Fotor Pro+ Everything in Pro plus more credits, more parallel generations, more AI Agent Sisi usage, AI batch edit for Background Remover/Replacement, multiple brand kits, AI slides generation, significantly more cloud storage, and advanced project/asset features. Other Fotor Max / Credits Higher usage and storage limits; Fotor uses credits for AI models and mentions rollover of unused credits with an active subscription for up to a certain period.

AI Headshot Plans One-time headshot packages for individual and team use with AI Headshots, Redo, fast processing, and HD quality.

API Plans API plans are listed as a separate section on the pricing page; specific usage should be checked separately.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Fotor is unclear to conditionally suitable.

Positive is that Fotor publishes a Privacy Policy, mentions data protection rights under local privacy laws such as GDPR or CCPA, and asks users to assert their rights via email. Also positive is that Fotor offers a clearly documented product and pricing structure with Free, Pro, and Pro+ features.

Negative is that I could not publicly find a reliable AVV/DPA, no list of subprocessors, no SCC documentation, and no clear EU data residency. The Privacy Policy describes the collection, use, disclosure, transfer, and storage of information without transparently clarifying data residency or data processing on behalf of EU companies.

Server location: No verified information available. Further link: Fotor Privacy Policy, Terms, and Pricing.

Privacy Policy

Link

xAI offers Grok models via its API for text generation, reasoning, coding, tool use, document-centric workflows, and agentic research. The current docs focus primarily on Grok 4.20 as the new flagship, as well as on server-side tools such as Web Search, X Search, Code Execution, and Collections Search.

Additionally, xAI documents classic model-listing endpoints such as /v1/models and /v1/language-models.xAI API – Grok

LLM “Build with Grok, the AI model designed to deliver truthful, insightful answers.”

7.4/10 KIFOX Score – Good
Other Token-based API usage Billing based on input, reasoning, completion, image, and cached prompt tokens per model.

Server-side Tools Additional billing for tool invocations; costs may increase with the complexity of agentic requests.

Credits / API Key API usage takes place via an xAI account, API key, and purchased credits.

Enterprise / ZDR Enterprise customers can use Zero Data Retention so that API requests and responses are not stored.

Voice / Imagine / Batch / Tools Additional product areas for real-time conversations, TTS/STT, image/video generation, batch processing, web search, and structured outputs.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, the xAI API is conditionally to well suited if it is used in an xAI Business/Enterprise context with a DPA and appropriate data controls.

Positive is that xAI provides a Data Processing Addendum that addresses GDPR/UK GDPR/Swiss FADP, roles as Processor, SCCs, UK Addendum, subprocessors, and deletion after the end of the contract. xAI also states that it never uses API inputs and outputs for training without explicit permission; API requests and responses are stored by default for 30 days for abuse/misuse audits and then deleted. For Enterprise, there is Zero Data Retention, under which prompts, completions, and metadata are not persisted.

Negative is that xAI allows international transfers outside Europe, including to the USA, and there is no publicly confirmed EU-only data residency as the standard for the API.

Server location: No confirmed EU-only region as standard; the DPA mentions transfers/processing outside Europe, including the USA, insofar as necessary for service provision. Further link: xAI DPA, xAI API Security FAQ, and xAI Enterprise FAQ.

xAI Data Processing Addendum

Link

“Smarter business planning, powered by purpose-built AI”

LivePlan is a cloud-based software solution for business plans, financial forecasts, pitch presentations, and ongoing business management.

The AI helps with writing plan sections, rewriting texts, suggesting forecasts, validating ideas, and conducting market-related research. In addition, LivePlan offers integrations with QuickBooks Online and Xero, as well as dashboards for comparing forecasts with actual data.LivePLan

Smarter business planning, powered by purpose-built AI

7.0/10 KIFOX Score – Good
Subscription Standard Write a business plan, collaborate with others, download and print the plan; suitable for classic business planning and simple financial planning.

Premium Everything in Standard plus multiple forecast scenarios, QuickBooks Online and Xero integration, Actual Results Dashboard, automated Forecast Builder, Monthly Review, and Actuals + Forecast. Other LivePlan Coach / Expert Additional offering with personal video support, priority support, and individual guidance for planning and use.

Consultant / Strategic Advisor Use Training and resources for consultants, startup centers, and strategic advisors.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, LivePlan is conditionally suitable.

Positive is that Palo Alto Software provides a Data Processing Addendum for LivePlan, describes GDPR compliance activities, and mentions a Security Overview with HTTPS, password hashing, redundancy, daily backups, and AWS data centers. It is also positive that LivePlan explicitly states for AI-powered features that data transmitted to AI functions is not used as training data for AI models or processing services and may not be used to improve these services.

Negative is that LivePlan uses AWS and does not publicly provide clear evidence of an EU-only server location as the standard. Business plans, financial forecasts, market analyses, and accounting integrations often contain confidential company data.

Server location: AWS data centers; specific EU-only data residency is not publicly guaranteed.

DPA Data Privacy

Link

“Launch your dream site in seconds”

Hostinger Website Builder is a no-code website builder with integrated hosting, a domain/SSL bundle, templates, marketing features, and several AI tools.

Users can create websites via drag-and-drop or with an AI prompt and then customize them for portfolios, company websites, blogs, or small to medium-sized online stores. Particularly relevant are the integrated AI features for text, images, logos, blog posts, product descriptions, and SEO.Hostinger

Build anything with AI from a personal site to an advanced web app – no coding needed

8.0/10 KIFOX Score – Very good
Subscription Premium For small businesses, appointment pages, and professional presentations; includes AI Website Builder, Hostinger Horizons Credits, a free domain in the first year, email inboxes, hosting, and security features.

Business Website Builder For websites and online stores; includes AI tools, e-commerce features, domain, SSL, email, multiple websites, Vibe-Coding/Horizons Credits, SEO, marketing, and email campaign features.

Web Hosting / WordPress / Cloud / VPS Alternative hosting plans for users who need WordPress, their own code, cloud resources, or VPS control. Other Hostinger Horizons AI-powered prompt-based web app/website builder with credits, depending on the plan.

Domains, Email, CDN, Agency Hosting, API Additional products and extensions related to hosting, domain management, email, performance, and developer access.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, Hostinger is conditionally to well suited, depending on the selected product, data center, and website setup.

Positive is that Hostinger provides a Data Processing Addendum and addresses EU GDPR, UK GDPR, SCCs, subprocessors, and technical/organizational measures. The Privacy Policy also refers to processing in accordance with the GDPR. Another positive aspect is that, for AI Agents, Hostinger states that it does not use conversations for training or fine-tuning AI models and does not use them for advertising profiles.

Negative is that Hostinger is a global provider with many products; data center, CDN, email, domains, third-party tools, tracking, WordPress plugins, and website builder features must be reviewed individually.

Server location: For web/cloud hosting, European locations such as France, Germany, Lithuania, the Netherlands, and the UK are available; website builder files are stored in a fixed location, assets are delivered worldwide via the Cloudflare CDN. Further link: Hostinger DPA, Privacy Policy, Server Locations, and AI Agents Data Handling.

Data processing addendum Privacy policy

Link

Google offers a family of models with the Gemini API for text generation, reasoning, coding, agent workflows, tool use, multimodal prompts, and document-centric processing.

For current API LLMs, Gemini 3.1 Pro Preview, Gemini 3 Flash Preview, Gemini 3.1 Flash-Lite Preview, Gemini 2.5 Pro, Gemini 2.5 Flash, and Gemini 2.5 Flash-Lite are particularly relevant. Older Gemini 2.0 Flash variants are still available, but are already marked as deprecated.Google Gemini API

LLM “AI for every developer”

7.3/10 KIFOX Score – Good
Free Free or unpaid use with limits; content may be used for product improvement and should not contain sensitive or confidential data. Other Gemini API Paid Tier For production applications with higher limits, context caching, Batch API, access to advanced models, and without using content for product improvement.

Batch / Context Caching / Priority / Flex Additional billing and operational options for controlling cost, latency, and throughput.

Vertex AI / Google Cloud Enterprise-oriented operation with Cloud DPA, IAM, regional endpoints, data residency, monitoring, and zero-data-retention configurations.

Grounding / Tuning / Embeddings / Live API Advanced features for search, context enrichment, model customization, vector search, real-time audio, and multimodal applications.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, the Gemini API depends heavily on the usage path: Google AI Studio/Gemini API Free Tier, Paid Tier, or Vertex AI.

Positive is that Google states for Paid Services that prompts and responses are not used for product improvement and are processed in accordance with the Data Processing Addendum. For the Free Tier, however, the following applies: content and responses may be used to provide, improve, and develop Google products and ML technologies; human reviewers may examine API input and output, and Google explicitly warns against entering sensitive, confidential, or personal information into Unpaid Services. For the EEA/Switzerland/UK, the Gemini API Terms state: API clients for users in these regions may only use Paid Services.

Server location: For Gemini Developer API Paid Services, prompts/responses may be temporarily stored or cached in countries where Google or its agents operate facilities for safety/abuse detection; with Vertex AI, data at rest remains in the selected location, and ML processing takes place for supported models in the chosen region or multi-region. Further link: Gemini API Terms, Gemini API Pricing, and Vertex AI Data Residency.

Gemini API – Additional Terms Vertex AI and no data retention

Link

"AI-powered research assistant"

NotebookLM is an AI-powered research and knowledge assistant by Google that works with your own sources.

You can upload PDFs, Google Docs, Slides, websites, YouTube transcripts, audio, images, Office files, and text, among other things, and use them to generate questions with source references, summaries, mind maps, flashcards, quizzes, infographics, presentations, as well as audio and video overviews.
For teams and organizations, there are sharing options, analytics, higher limits, and – depending on the plan – enterprise/cloud security features.NotebookLM

KI-Recherche-Tool & DenkpartnerWait, I need to translate FROM German TO English. But the input "AI research tool & thinking partner" is already in English.AI research tool & thinking partner

7.5/10 KIFOX Score – Good
Free NotebookLM Standard is free to use. It includes up to 100 notebooks per user, up to 50 sources per notebook, up to 500,000 words per source, chat with sources, Audio Overviews, Video Overviews, Reports, Flashcards, Quizzes, Mind Maps, limited Deep Research as well as limited Data Tables, Infographics and Slide Decks. Subscription NotebookLM in Google AI Plus: more notebooks, more sources per notebook, higher chat/audio/video limits, more reports, flashcards, quizzes, deep research, and additional NotebookLM features.

NotebookLM in Google AI Pro: higher limits than Plus, higher Gemini model access, more audio/video overviews, reports, flashcards, quizzes, deep research, data tables, infographics, and slide decks.

NotebookLM in Google AI Ultra: highest limits, highest Gemini model access, very high limits for chats, audio/video overviews, reports, flashcards, quizzes, and deep research; additionally watermark removal for infographics and slide decks. Other NotebookLM upgrades are available not only through Google AI Plans, but also through Google Cloud or qualifying Google Workspace and Workspace for Education plans. For work and school accounts, there are additional access tiers such as Standard, More, Higher, Expanded, and Highest Level Access. When using Workspace/Education, Google notes that uploaded files, chats, and model outputs are not reviewed by human reviewers and are not used to improve generative AI models.
– (0)

Link

GDPR: Partly NotebookLM is heavily dependent on the usage context from a data protection perspective: private NotebookLM use, NotebookLM via Google Workspace / Workspace for Education, and NotebookLM Enterprise via Google Cloud must each be assessed differently. Private use: NotebookLM uses uploaded files, generated outputs, and chat history to create the knowledge base; according to Google, content in NotebookLM is not directly used to train the underlying AI models, unless users provide feedback. When feedback is given, prompts, sources, uploads, and outputs may be reviewed by specially trained teams and stored for up to three years; Google advises users not to include confidential or sensitive information in feedback. Important: the classic DPA context does not apply to private use; users cannot specify data residency, and according to Google, the personal NotebookLM version does not have the compliance and admin features of NotebookLM Enterprise. Google Workspace / Education: significantly more suitable. NotebookLM is available as a Core Service for Workspace and Workspace for Education users; according to Google, uploads, requests, and model responses from Workspace or Education users are not reviewed by human reviewers and are not used for training AI models, even when feedback is provided. Google Workspace refers to NotebookLM as a Workspace product and states that NotebookLM is not trained on uploaded Workspace user data; sources remain private unless users share a notebook. NotebookLM Enterprise / Google Cloud: the most robust option for GDPR-relevant use. NotebookLM Enterprise runs in a Google Cloud-compliant environment; data remains within the customer's Google Cloud project and cannot be shared externally. Google Cloud offers a Cloud Data Processing Addendum / DPA in which Google commits to processing customer data in accordance with the contract and customer instructions, guarantees technical and organizational security measures, regulates deletion, addresses sub-processors, and provides SCCs for third-country transfers.

Positive: no training on NotebookLM content except feedback in private use; no training and no human review even with feedback for Workspace/Education; Enterprise with Google Cloud project, DPA, SCCs, IAM, VPC-SC, CMEK, and data residency options.

Negative / Points to review: private use without a DPA, without controllable data residency, and without Enterprise admin controls; when feedback is provided in private accounts, content may be reviewed and stored; in Enterprise, some features such as "Discover Sources" are not fully data residency-compliant, as they run via Grounding with Google Search, which can result in temporary logs of certain customer data being created.

Privacy and Terms of Use in NotebookLM

Link

“The Creator-First Generative AI Platform”

Leonardo.AI is a generative AI platform for image, video, design, and motion workflows.

Officially, the product is positioned for creating high-quality visuals from prompts or reference images, for precise editing, upscaling, as well as for API-powered production workflows. The platform also offers team collaboration and developer access via API.Leonardo.AI

The Creator-First Generative AI Platform

6.6/10 KIFOX Score – Solid
Free Free entry with daily renewed Fast Tokens, image generation, video generation, Flow State, limited Blueprints, limited Realtime Canvas, Realtime Generation, Presets, Elements, platform models, and third-party models. Subscription Essential For daily hobby use and enthusiasts; includes monthly Fast Tokens, Token Bank, private generations, presets, Enhanced Quality, unlimited personal collections, personal AI models, simultaneous generations, and top-up tokens.

Subscription Premium For semi-professionals and active creators; includes more monthly Fast Tokens, a larger Token Bank, private generations, Enhanced Quality, unlimited collections, more personal AI models, higher parallelization, queue, top-up tokens, and unlimited Relaxed Image Generation for selected models.

Subscription Ultimate For professional creators, small businesses, and content producers; includes significantly more monthly Fast Tokens, a larger Token Bank, private generations, Enhanced Quality, many personal AI models, higher parallelization, a larger queue, top-up tokens, as well as unlimited Relaxed Image and Video Generation for selected models.

Subscription / Team Starter Team plan with Shared Tokens, Bank Capacity, Fast Tokens per seat, private team generations, team token usage for model training, unlimited collections, unlimited Realtime Canvas and Realtime Generation actions, Enhanced Quality, and team workflow features.

Subscription / Team Growth Advanced team plan with more Shared Tokens, higher Bank Capacity, more Fast Tokens per seat, private team generations, model training with Team Tokens, unlimited collections, unlimited Realtime actions, and Enhanced Quality. Other Custom Plan Individually tailored plan for larger workflows; includes custom Fast Tokens per seat, all Starter and Growth features, as well as bespoke requirements.

Pay as you go / API Usage-based API option with no long-term commitment, automatic top-ups, access to the latest models, and parallel generations.

API Custom For higher production volumes and long-term scaling; includes custom limits for parallel generations, model-based discounts, and dedicated support for production deployments.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Leonardo AI is conditionally suitable.

Positive is that Leonardo AI provides a Data Processing Addendum in which Leonardo acts as a processor when used accordingly, processes customer data only for the agreed purpose, provides for SCCs for restricted international transfers, regulates subprocessors, and documents technical and organizational measures. Also positive are TLS encryption, AES-256 encryption of customer data at rest, SOC 2 certification, data subject rights for EU/UK users, and an EEA representative in Ireland.

Negative is that, according to the Privacy Policy, Leonardo AI may analyze content and account data to improve the services and to train algorithms, models, and AI products; according to Leonardo, content is only not used for model training if it is generated privately, which requires a paid plan. In addition, there are international data transfers and several subprocessors outside the EU.

Server location: The DPA subprocessor list names Amazon Web Services for platform hosting and infrastructure with location in the United States; in addition, AI/inference service providers in the USA, Singapore, and Germany, among others, are listed.

Leonardo AI Data Processing Addendum, Privacy Policy

Link

“Truly usable and practical AI”

Tencent Hunyuan is Tencent Cloud’s AI model family. It includes text models, reasoning models, vision, video understanding, image generation, translation, 3D generation, and open-source models. Tencent positions Hunyuan for content creation, mathematics, code, dialogue, enterprise scenarios, and multimodal workflows.Tencent Hunyuan / Tencent HY

LLM “Truly usable and practical AI”

4.3/10 KIFOX Score – Limited
Free Free Resource Package / Test Quota
Upon initial activation of Tencent HY Text Generation Global, a one-time free test quota is provided as a Resource Package; after it is used up or expires, postpaid activation is required. Other Token Postpaid / Pay-as-you-go API billing based on token consumption for Hunyuan text functions; billing via Tencent Cloud according to usage and with postpaid enabled.

Tencent HY 3D Global Separate product for 3D generation from text, image, or sketch with its own billing and API/cloud usage.

Enterprise / Tencent Cloud Agreements Individual cloud, contractual, and compliance setups are possible via Tencent Cloud; specific terms and data regions must be reviewed contractually.
– (0)

Link

GDPR: No Overall assessment: Conditionally to critically GDPR-suitable. For the EEA, UK, and Switzerland, Tencent Cloud designates Tencent Cloud Europe B.V. in Amsterdam as the Data Controller for administrative data and states that customer data or content is generally processed as a processor within the scope of the services.

Positive is that Tencent Cloud references a Data Processing and Security Addendum structure in the Privacy Policy, distinguishes roles between Controller and Processor, and offers formal contractual documentation for enterprise/cloud use.

Negative is that Tencent Cloud states in the Privacy Policy that servers may be located outside the user's country, for example in Mainland China. In addition, the AI Service Terms allow Tencent Cloud to use User Input and AI Output for the provision, support, improvement, development, and training of AI Models, unless an opt-out is made in the respective AI function. According to the AI Terms, sensitive personal data and specially regulated data must not be entered into AI Services unless this has been expressly agreed in writing and configured accordingly.

Server location: depending on the Tencent Cloud service and configuration; the official Privacy Policy mentions possible processing outside the user's country, including Mainland China. For GDPR-critical use, Tencent Hunyuan is therefore only recommended with a DPA, region/transfer review, training opt-out, subprocessor review, and exclusion of sensitive data. Sources: Tencent Cloud Privacy Policy, AI Service Terms, and Hunyuan documentation.

Privacy Policy

Link

“The #1 AI Headshot Generator for Professional Headshots”

HeadshotPro is an AI tool for creating professional business and team headshots from uploaded selfies.

The product is aimed at both individuals and companies and, in addition to individual packages, also offers team features such as an admin dashboard, API, webhooks, and enterprise SSO. It is officially positioned as a SaaS for professional portraits, LinkedIn/CV photos, team pages, and branded employee photos.HeadshotPro

The #1 AI Headshot Generator for Professional Headshots

7.3/10 KIFOX Score – Good
Free Free headshot test feature; according to HeadshotPro, lower quality than the professional generator. Other Individual Packages One-time packages for professional AI headshots, commercial use, and download of the generated images.

Corporate / Team Headshots Team dashboard, invitations for employees, consistent company styles, branded profile pictures, and management of larger groups.

API / Enterprise / Sales API and enterprise options for larger or integrated headshot workflows.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, HeadshotPro is conditionally to well suited.

Positive is that HeadshotPro provides its own Data Processing Agreement, addresses GDPR/UK GDPR/Swiss-FADP, describes itself as a Processor in the DPA, mentions SCCs for third-country transfers, and documents technical and organizational measures. In addition, HeadshotPro states in the Master Service Agreement that customer data and AI headshots are not used by default to train or retrain its own or third-party generative models unless the customer explicitly opts in. Also positive are references to SOC 2 Type II, a subprocessor list, encryption, and clear deletion periods: according to the pricing page, input photos are deleted after 7 days and generated headshots after 30 days.

Negative is that HeadshotPro is operated by a company in Singapore and uses infrastructure/subprocessors such as Google Cloud Storage, Render, and Vercel; EU-only hosting is not publicly documented as the standard.

Server location: No guaranteed EU-only data residency; operator address according to the DPA is Singapore, infrastructure via cloud service providers. Further link: HeadshotPro DPA, Security Policy, Privacy Policy, and subprocessors.

Data Processing Agreement Privacy Policy

Link

"AI that brings out the best in you, from first idea to final draft"

Paperpal is an AI-powered academic writing tool for researchers, students, authors, and scientific teams.

It combines language correction, academic paraphrasing, research and citation assistance, PDF chat, plagiarism checking, and other pre-submission features on one platform. The provider explicitly positions Paperpal as a secure all-in-one solution for scientific writing.Paperpal

AI that brings out the best in you, from first idea to final draft

7.0/10 KIFOX Score – Good
Free Free entry with academic writing features, PDF chat, Research & Cite, AI detector, plagiarism check, and submission checks with limitations. Subscription Extended or unlimited use of central functions such as Language Editing, Consistency, Research Q&A, Citation Generation, writing features, and advanced academic checks. Other Teams Plan Group plan for 2–10 members with centralized billing, activation codes, and team discounts; according to support, based on Paperpal Prime annual.

Institutional Plans Individual solutions for universities, institutions, students, or employees.

Multi-year Plan One-time longer-term option for users who want to book long-term.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Paperpal is well suited to conditionally well suited, especially for research and higher education contexts.

Positive is that Paperpal cites GDPR compliance, ISO/IEC 27001:2022, PECR, CSA STAR Level 1, and other security frameworks. Paperpal explicitly states that it does not use user data and documents to train its AI models. In addition, Paperpal mentions encryption, confidentiality of processed documents, and security measures for research data.

Negative is that no clear, directly linked AVV/DPA and no precise EU server location as a standard could be found publicly; the secure data centers mentioned are not clearly described as EU-only.

Server location: No verified EU-only information available; Paperpal mentions secure certified data centers, but no clearly documented location. Further link: Paperpal Data Security, support article on training and pricing.

Data Security Privacy Policy

Link

AI-powered video platform for avatar-based business videos.

Synthesia is an AI video platform that enables companies to create professional videos without a camera, studio, or actors.

Content can be transformed from a prompt, script, document, PDF, or URL into multi-scene videos and then refined with avatars, voices, branding, and translations. The clear focus is on training, sales enablement, marketing, and internal communication.Synthesia

The #1 AI video platform for business

7.5/10 KIFOX Score – Good
Free Free entry with AI video creation, limited credits, limited video minutes, and a small selection of AI avatars. Subscription Starter Everything in Basic plus video downloads, AI Video Assistant, AI Dubbing, removal of the Synthesia logo, your own Personal Avatars, more avatars, support, and credits.

Creator Everything in Starter plus more Personal Avatars, API access, branded video pages, multiple avatars per scene, interactive videos, more AI avatars, priority support, and more credits. Other Enterprise Custom Enterprise plan with unlimited video minutes, translation, many stock avatars, unlimited Personal Avatars, SAML/SSO, live collaboration, Brand Kits, SCORM export, onboarding, dedicated CSM, and custom credits.

Credits / API / Custom Avatar Synthesia uses credits as a shared currency for AI usage features; custom Personal Avatars are included depending on the plan or expanded on the Enterprise side.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Synthesia is conditionally to well suited, especially for business and enterprise use.

Positive is that Synthesia offers a Data Processing Addendum that addresses its role as a processor of customer data. In addition, Synthesia lists security measures, subprocessors management, transfer impact assessments for cross-border transfers, and technical/organizational measures in its Security section. It is also positive that, according to the Trust Center FAQ, Synthesia stores data within the EU in data centers in Ireland.

Negative is that Synthesia uses subprocessors and affiliates in several countries, including connections to the USA and the UK; therefore, EU companies must review the DPA, subprocessors, third-country transfers, avatar/voice rights, and moderation processes.

Server location: According to the Synthesia Trust Center, data is stored within the EU in data centers in Ireland; however, subprocessors and international processing remain relevant. Further links: Synthesia DPA, Security Practices, Subprocessors.

Data Processing Agreement

Link

"Where knowledge begins"

Perplexity Sonar is a family of models for AI search, web-based answers, research, reasoning, and deep research. The API is particularly strong in current facts, citations, product comparisons, summaries, and research workflows.Perplexity Sonar

LLM “Where knowledge begins”

7.6/10 KIFOX Score – Good
– (0)

Link

GDPR: Yes Overall assessment: Conditionally to well suited for GDPR compliance for the Sonar API, depending on the contract.

Positive is that Perplexity states a strict Zero Data Retention Policy for the Sonar API: content from API requests is not stored and customer data is not used for model training. According to the API documentation, only necessary billing metrics are collected, such as token count, model used, timestamp, duration, and API key identification; according to Perplexity, this metadata does not contain prompt or response content. In addition, Perplexity mentions SOC 2 Type II, HIPAA Gap Assessment, and CAIQlite in the trust/security context.

Negative is that, according to the FAQ, Perplexity hosts its compute infrastructure via AWS in North America; for EU customers, this means a third-country/transfer assessment is required. No verified information is available in the evaluated sources about a publicly directly reviewed DPA/AVV or SCC document.

Server location: AWS in North America for language models/API according to the Perplexity FAQ. Conclusion: For API-based research and search applications, significantly more attractive from a data protection perspective than many LLM APIs, but for GDPR-compliant EU use, the DPA/AVV, transfer mechanism, subprocessors, and enterprise contract should be reviewed. Sources: Perplexity Privacy & Security, FAQ, and Enterprise Security information.

Privacy & Security

Link

“The #1 AI Assistant for Your Meetings”

Fireflies.ai is an AI meeting assistant that automatically transcribes, summarizes, searches, and analyzes meetings. The tool supports video conferencing systems, audio/video uploads, meeting search, AskFred, a mobile app, a Chrome extension, an API, conversation intelligence, AI skills, and integrations with CRM, collaboration, and storage tools.Fireflies.ai

The #1 AI Assistant For Your Meetings

8.2/10 KIFOX Score – Very good
Free Free entry with limited transcription, limited storage, AskFred, audio/video file upload, mobile app, Chrome extension and API access according to the pricing page. Subscription Pro For professionals and small teams; includes unlimited transcription, unlimited AI summaries, increased storage, downloads of transcripts/summaries/recordings, Personal Assistant, talk-time analytics, AI skills, voice agents, AI credits, action items, task manager, and unlimited integrations.

Business For growing businesses; includes Pro features plus unlimited storage, video recording, multi-language mode, conversation intelligence, team analytics, more AI credits, and user groups.

Enterprise For large enterprises; includes Business features plus Rules Engine, SSO, SCIM, HIPAA compliance, private storage, custom data retention, Transcript+Summary-only mode, more AI credits, Super Admin, and a dedicated account manager. Other API Fireflies provides API access for processing audio files and integrating them into your own workflows.

Private Storage Enterprise option for storing meeting data in a preferred location or dedicated storage environment.

AI Credits / AI Skills AI Credits control the use of specific AI features; AI Skills automatically extract follow-ups, scores, insights, and structured meeting data.
– (0)

Link

GDPR: Yes Overall assessment:
Conditionally to well-suited for GDPR compliance. A positive aspect is that Fireflies.ai provides a public Data Processing Addendum that outlines the processing of business and enterprise customer data in accordance with documented instructions, as well as confidentiality obligations, data deletion or return upon contract termination, security measures, audit options, subprocessor provisions, and data transfer rules. According to its own statements, Fireflies.ai is certified under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF.

A very positive aspect is the official statement that meeting content—audio, video, transcripts, and summaries—is not used to train internal or external AI models. Fireflies also describes a zero-data-retention policy for meeting content with third-party vendors: meeting content is not to be stored, reused, or used for training by third-party vendors after processing. Voice- and biometrics-related features for speaker differentiation may be processed temporarily but are not to be used for identification or authentication and are not to be stored on Fireflies servers.

Negative: Fireflies.ai is a U.S. provider. The Privacy Policy explicitly states that Fireflies.ai and its service providers process and store personal data on servers in the U.S. and other countries. For international transfers, Fireflies uses, among other things, the DPF and contractual safeguards. Private Storage and Custom Data Retention are available for Enterprise customers; without an Enterprise plan, no blanket EU data residency is guaranteed.

Server location: By default, the U.S. and other countries; according to the Trust Center FAQ, processing takes place in the U.S., while storage can be influenced depending on the selected storage option or Enterprise Private Storage.

Conclusion: Fireflies.ai is better documented for EU companies than many meeting AI tools, particularly due to the DPA, the non-training commitment, the zero-retention commitment for third-party providers, and Enterprise Private Storage. However, for GDPR-compliant use, meeting notices, legal basis, DPA, third-country transfers, subprocessors, storage location, retention, integrations, and participant rights must be reviewed.

Privacy Policy

Link

“The Visual No Code App Builder – Now Powered By AI”

Adalo is a visual no-code platform for building and publishing database-driven web apps as well as native iOS and Android apps from a single project.

AI features such as Ada, Magic Start, Magic Add, Visual AI Direction, and X-Ray support the generation, editing, and review of apps using natural language. The focus is therefore on app building, data modeling, publishing, and integrations—not on an isolated AI chat or content tool.Adalo

The Visual No Code App Builder – Now Powered By AI

6.8/10 KIFOX Score – Solid
Free Free plan for building and testing, unlimited screens, limited records per app, and Ada AI Assistant. Subscription Starter One published app, unlimited App Actions, one App Editor, Custom Fonts, Custom Domain, Publish to Web, automated app store publishing, no Adalo branding, and Ada AI Assistant.

Professional More published apps, more employees/editors, more storage, and advanced integrations.

Team More published apps, more editor/team capacity, Priority Support, and team-oriented capacity increases.

Business More apps, unlimited editor structure or stronger team/business features, and enterprise-level enhancements. Other Adalo Blue Dedicated infrastructure, custom monitoring, on-premise option, and connection to any data sources, including legacy systems without an API. Add-ons Additional published apps and additional app editors can be added depending on the plan.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Adalo is conditionally suitable.

Positive is that Adalo states in its Privacy Policy that it processes Customer Content on behalf of and according to the instructions of the customer; in addition, Adalo help pages refer to a DPA with GDPR Article 28 obligations, subprocessors, and EU-US transfer mechanisms. Adalo mentions international data transfers and appropriate safeguards; the platform also enables external data sources, allowing EU databases or custom backends to be connected.

Negative is that Adalo, Inc. is based in the USA and, according to the Privacy Policy, personal data may be processed in countries where Adalo or service providers operate. A general EU-only data residency for standard Adalo is not publicly documented; older community statements mentioned US storage.

Server location: For standard Adalo, there is no confirmed EU-only region; provider is in the USA, international processing is possible. For Adalo Blue, dedicated infrastructure, on-premise capability, and arbitrary data sources are mentioned. Further link: Adalo Privacy Policy, DPA help, and Pricing.

Privacy Policy

Link

Automate without limits

n8n is a workflow automation platform for technical teams that combines visual building with code, API connectivity, and AI capabilities.

Workflows, agents, and integrations can be created through a graphical interface, but can also be extended deeply with JavaScript, Python, HTTP requests, custom nodes, and self-hosting when needed. n8n can be run in the cloud or on your own infrastructure.n8n

AI agents and workflows you can see and control

8.3/10 KIFOX Score – Very good
Free Free version for up to 14 days after sign-up or when self-hosted. As a Community Edition for self-hosting. According to the documentation, every self-hosted installation runs without a license key as a free Community Edition; the website also refers to it as a “standard, self-hosted version.” There is also a free cloud trial period, but no permanently free cloud tier. Important: The Community Edition is licensed under the Sustainable Use License, not under a classic open-source license. Subscription Starter: €20 / month, billed annually; 2.5K workflow executions, 1 shared project, 5 concurrent executions, unlimited users, 50 AI Workflow Builder credits.

Pro: €50 / month, billed annually; custom execution volume, 3 shared projects, 20 concurrent executions, 7 days of insights, 150 AI Workflow Builder credits, admin roles, global variables, workflow history, execution search.

Business: €667 / month, billed annually; self-hosted, 40K executions, 6 shared projects, SSO/SAML/LDAP, 30 days of insights, environments, scaling options, Git source control.

Enterprise: Price on request; cloud or self-hosted, custom execution volume, 200+ concurrent executions, 365 days of insights, external secret store integration, log streaming, extended data retention. According to the pricing page, all paid plans include unlimited users, unlimited workflows, and all integrations; billing is based on workflow executions.

The Help Center article adds that Business is currently only available for self-hosted deployments. Other Community Edition free via self-hosting under the Sustainable Use License. A free trial for Cloud is available and, according to the pricing page, can be started without a credit card. In addition, there is a startup plan with a 50% discount on Business, publicly listed at €333 / month, billed annually, for early-stage startups. In principle, n8n follows an execution-based pricing model, not per task/step.
– (0)

Link

GDPR: Yes Yes, conditionally – depending on the operating model.
For n8n Cloud, according to its own documentation, n8n acts in the GDPR context as both a Controller and a Processor. As a Processor, n8n provides a Data Processing Agreement / DPA; according to n8n, the DPA includes the Standard Contractual Clauses / SCCs.

Positive: n8n states that it does not use personal data – including data from third-party services – for the development, improvement, or training of AI/ML models. n8n publishes a subprocessor list; cloud infrastructure runs, among other things, on Microsoft Azure in EU regions Germany/Sweden and Hetzner in Germany. In addition, AI providers such as OpenAI, Anthropic, Google Vertex AI, and LangChain are named as subprocessors, in some cases with processing in the USA.

Self-hosted: For self-hosted n8n, according to its own documentation, n8n is neither a Controller nor a Processor, since n8n does not manage customer data. GDPR responsibility then lies entirely with the operator.

Assessment: For companies with GDPR requirements, n8n is generally well suited, especially when self-hosted on EU infrastructure. With n8n Cloud, subprocessors, AI nodes, third-party APIs, credential storage, execution logs, and data retention should be carefully reviewed and documented.

Privacy

Link

"The all-in-one AI platform for businesses — Turnkey, Secure & GDPR-compliant"

Omnifact is a B2B AI platform for the secure use of generative AI in businesses. It combines team chat with multiple LLM providers, document-based AI assistants via Spaces, integrations, API access, privacy filters, role/team management, and optional enterprise deployment up to on-premise. The platform is clearly focused on data sovereignty, compliance, and integration into enterprise IT.Omnifact

The all-in-one AI platform for businesses — Turnkey, Secure & GDPR-compliant

7.6/10 KIFOX Score – Good
Subscription Pro Access to the entire Omnifact platform including Chat and Spaces, leading AI models with monthly usage credits, unlimited base-tier models after the credits are used up, Omnifact Privacy Filter™, teams up to a certain size, Knowledge Spaces with a page limit, email support, and onboarding materials. Other Enterprise Everything in Pro plus no team size limit, custom usage credits, self-hosted LLMs, Bring Your Own API Key, usage analytics, API access to Spaces, Enterprise SSO, custom SLAs, on-premise deployment, and a dedicated account manager.

Spaces API / Self-Hosted LLMs / BYOK For enterprise integrations, internal knowledge assistants, your own model infrastructure, and controlled model usage.
– (0)

Link

GDPR: Yes GDPR assessment: Omnifact is very well suited from a GDPR perspective, especially for European companies.

Positive is that Omnifact mentions GDPR compliance, ISO 27001 certification, EU data residency, and hosting in Germany/Frankfurt. The DPA governs processing within the EU/EEA, processing on behalf under instruction, technical and organizational measures, support in the event of data protection incidents, data subject rights, and data protection impact assessments. In addition, Omnifact offers a Privacy Filter™, EU-hosted models, controllable model approvals, and, in the Enterprise plan, options for own API keys, self-hosted LLMs, and on-premise hosting.

Negative is that with optional third-party tools, CRM/support integrations, or model providers outside the EU, additional transfer mechanisms and subprocessors must be reviewed.

Server location: Germany / Frankfurt for Omnifact hosting; EU-hosted models are mentioned as an option.

Privacy Policy

Link

"Built to Keep You in Flow State"

Windsurf is an AI-powered coding assistant, or rather an agentic IDE for software development.

The Windsurf Editor combines the local agent Cascade with the cloud agent Devin, supports model routing via Adaptive, offers IDE integrations, MCP connections, previews, and team/enterprise features for governance, security, and deployment. The tool is aimed primarily at developers, technical teams, and companies, not general office users.Windsurf

Built to Keep You in Flow State

7.1/10 KIFOX Score – Good
Free Light Usage Allowance, Tab, Previews/Deploys depending on the limit and getting started in Windsurf. Subscription Pro Standard Usage Allowance, unlimited core features, additional usage at the API price.

Max Heavy Usage Allowance for power users and high agent/coding usage. Other Teams Team plan with centralized billing, admin dashboard, analytics, support, and team features. Enterprise SSO, access controls, RBAC, volume discounts, hybrid deployment, account management, and custom deployment.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Windsurf is conditionally to well suited, especially for Teams, Enterprise, EU cluster, Hybrid, or Self-hosted.

Positive is that Windsurf documents SOC 2 Type II, penetration tests, Zero Data Retention as standard for Teams/Enterprise, and ZDR opt-in for Individual plans. Also positive are EU servers in Frankfurt for Enterprise options, Hybrid Deployment with a customer-owned data-hosting instance, and Self-hosted Deployment in the company’s own private cloud or on-premises.

Negative is that in cloud plans, requests may pass through Windsurf servers and subprocessors; certain features such as web search, MCP, or remote indexing may require data retention or subprocessors without ZDR.

Server location: Standard cloud USA; Enterprise EU option Frankfurt; Hybrid/Self-hosted controllable by the customer. Further link: Windsurf Security and Pricing.

Security Privacy Policy

Link

"Turn any idea into stunning images and cinematic video"

BasedLabs is an AI platform for creating and editing images, videos, and in some cases also audio/voice content.

Officially, the platform advertises, among other things, an AI Image Generator, AI Video Generator, Face Swap, Voice Changer, Video Editor, YouTube Video Editor, community/feed features, as well as an API for using models in your own applications. The focus is clearly on creator, social media, advertising, and content workflows.BasedLabs AI

Turn any idea into stunning images and cinematic video

3.5/10 KIFOX Score – Insufficient
Free Free AI tools and credits via platform/community; exact limits may vary. Other Starter One-time credit purchase for tests, images, and short videos.

Creator More credits for regular creator use.

Pro More credits, bonus credits, and more professional use.

Studio High credit volume for high-volume production.

Enterprise / API Enterprise pricing, API access, and custom solutions available.
– (0)

Link

GDPR: No GDPR assessment: From a GDPR perspective, BasedLabs AI is unclear to conditionally suitable.

Positive is that BasedLabs mentions GDPR rights for EU citizens in its Privacy Policy, including access, rectification, erasure, restriction, and data portability. It is also positive that BasedLabs describes security measures and deletion rights.

Negative is that no reliable AVV/DPA, no SCCs, no list of subprocessors, and no clear server location can be found publicly. In addition, the tool potentially processes highly sensitive content such as faces, images, videos, and creative assets.

Server location: No verified information available. Further link: BasedLabs Privacy and Pricing.

Privacy Notice

Link

"Trustworthy artificial intelligence that powers humanity towards superproductivity"

AI21 Labs is an Israeli provider of large language models and AI orchestration systems for enterprises. Its core product in the model space is the Jamba family, a hybrid SSM/Transformer model family for long contexts, RAG, question-answering systems, document processing, and secure enterprise deployments. In addition, with Maestro, AI21 offers a model-agnostic orchestration system for validated RAG agents and complex business tasks.AI21 Labs

LLM "Trustworthy artificial intelligence that powers humanity towards superproductivity"

7.9/10 KIFOX Score – Good
Free New accounts receive time-limited trial credits for AI21 Platform, APIs, SDK, and Playground. Truly usable for testing, prototyping, and evaluation; billing or a paid plan is required for continuous production use. Subscription Pay As You Go: usage-based access to Foundation Model APIs, SDK, and unlimited seats.

Custom Plan: includes pay-as-you-go features plus volume agreements, premium rate limits, private cloud hosting, priority support, a dedicated account manager, and AI consulting. No direct prices listed. Other AI21 uses token-based API billing, custom payment/enterprise plans, and cloud provider billing through partners such as AWS, Microsoft Azure, Google Cloud / Vertex AI Model Garden, or SageMaker/Bedrock. Additionally, self-deployment, fine-tuning, quantization, and custom AI systems are relevant, depending on the contract and infrastructure. No direct prices listed.
– (0)

Link

GDPR: Yes Overall assessment: AI21 Labs is generally suitable for GDPR-compliant use, but it is not “automatically” unproblematic. A positive aspect is that AI21 provides a DPA/AVV upon request and classifies itself as a Processor/Service Provider for Customer Content. A critical point is that Customer Content and Outputs—unless otherwise contractually agreed—may be processed worldwide, including in Israel, the USA, the EEA, the UK, and other locations. For production use involving personal data, the AVV/DPA, hosting region, subprocessors, SCCs/transfer mechanisms, retention periods, and training exclusion should therefore be contractually reviewed.

Positive: AI21 Labs Ltd. is based in Israel; Israel is recognized by the European Commission as a country with an adequacy decision, meaning EU data transfers to Israel are generally possible without additional transfer safeguards. AI21 documents ISO 27001/27017/27018 and SOC 2 references, a DPA/AVV is available upon request, and AI21 states in the model terms that, unless otherwise agreed in writing, AI21 Models are not trained on Customer Content.

Negative: According to the Terms, Customer Content may be processed in Israel, the USA, the EEA, the UK, and other regions; for the USA/other third countries, subprocessors, SCCs, and specific region-lock commitments, the publicly reviewed sources do not provide complete verified details. Sensitive data and personal data are only intended for use with a solution that has been appropriately configured or approved.

Server location: Israel, USA, EEA, UK, and other locations are possible unless otherwise specified in the Order. For GDPR-compliant use, the AVV/DPA, hosting region, subprocessors, retention periods, training exclusion, and traceless operations should be contractually fixed.

A121 SOLUTIONS PRIVACY POLICY

Link

“All-in-one AI video and audio platform” Async is an AI platform for audio and video production with remote recording, editing, AI voices, voice cloning, dubbing, subtitles, clips, and publishing workflows.



The product is aimed at both solo creators and teams and companies that want to produce podcasts, video formats, social clips, or voice-first content. The platform combines recording, post-production, and publishing in one workflow.Async

All-in-one AI video and audio platform

7.3/10 KIFOX Score – Good
Free Free entry with limited AI credits, limited media upload, text-to-speech, cloud storage, and basic features. Subscription Essentials More monthly AI Credits, unlimited media upload in AI Chat, more text-to-speech, AI Clips, Reframe, Dubbing/Lipsync, Subtitles, Thumbnail Generator, and more storage.

Pro Higher credit amount, greater usage for video, audio, and voice features, more storage, and professional creator workflows.

Teams Team workspace, collaboration, significantly more credits and storage, shared use for teams. Other Business Customized business offering with custom credits, custom storage, live support, onboarding, Customer Happiness Manager, and dedicated support.

Top-up Packs Additional AI credits as one-time packages; usage depends on model, medium, duration, and resolution.
– (0)

Link

GDPR: Partly GDPR assessment: Async is conditionally suitable from a GDPR perspective.

Positive is that Async lists GDPR rights, describes voice biometric data rules, requires explicit consent for voice cloning, mentions deletion rights, describes encryption for biometric voice data, and states that it does not sell or unauthorizedly share such data. The pricing page also mentions GDPR compliance, encryption in transit and at rest, as well as SOC2 certification.

Negative is that Async is operated by Podcastle Inc. / DBA Async based in Delaware, USA, and the Privacy Policy describes international data transfers. Particularly critical are voice cloning, biometric templates, recordings, videos, dubbing, and AI-generated media.

Server location: No verified specific server location is publicly documented; company headquarters in the USA/Delaware, international processing possible. Further link: Async Privacy, AI Terms, and Pricing.

Privacy Policy

Link

"Create high-impact, professional video content without the inevitable cost and delay of outsourced video production."

Elai is an AI video generator for professional avatar, training, e-learning, communication, and marketing videos. The tool offers AI Avatars, Custom Avatars, Voice Cloning, automatic translation, AI Storyboard, Article-to-Video, PPTX-to-Video, Avatar Dialogs, personalization, Screen Recorder, and API.Elai.io

Create high-impact, professional video content without the inevitable cost and delay of outsourced video production

6.1/10 KIFOX Score – Solid
Free Free entry with 1 user, a very limited minute allowance, access to 80+ avatars, 75+ languages, and creator features. Subscription Creator For individual creators with more video minutes, Full HD video, and the complete avatar, voice, and language library.

Team For teams with multiple editors/guests, custom images and fonts, Ultra 4K video, Premium Voices, Selfie Avatar, and Voice Clone.

Enterprise Custom plan with unlimited users, multiple Voice Clones, Selfie Avatars, Premium Avatars, Brand Kit, Workspaces, SSO, and Premium Support. Other API API access for paid and trial accounts; supports video rendering, Story API, Avatar API, Voice API, webhooks, media upload, and personalization.

Custom Avatar / Voice Cloning Enterprise-grade features for digital twins, custom avatars, and voice cloning; rights and consents must be verified before use.

Zapier app and API integration for automated video creation, personalization, and external workflows.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-suitable.

Positive is that Elai provides its own security page, states GDPR and CPPA compliance, describes data deletion and data export in the profile or via an account deletion request, and mentions technical protective measures such as TLS/SSL, encrypted storage on AWS servers, backups, access restrictions, and vulnerability scans. According to the Privacy Policy, Elai is also a subsidiary of Panopto and refers to Panopto’s EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF certification for international data transfers.

Negative is that, according to Elai, all data including backups is stored in data centers in the USA, operated by providers such as Amazon Web Services and DigitalOcean. According to the security page, Elai processes, among other things, names, email addresses, scripts and texts from the editor/API, uploaded photos, videos, music, as well as video/image material for personal avatars and mascots. A publicly fully verifiable AVV/DPA or a complete list of subprocessors could not be reliably found in the directly accessible official sources; a trust/security portal existed, but was not fully publicly accessible.

Server location: USA according to the official security page.

Conclusion: Well usable for companies if the enterprise contract, DPA/AVV, transfer mechanism, subprocessors, and avatar/voice consents are reviewed; do not use for sensitive personal data without additional data protection review.


Privacy Policy

Link