Find Your Tool in 6 Steps
Result: 155

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps
Results: 155
Research Images Video Music Agent Business Marketing Website API

“The only E-CAD software with AI support.”

ELECTRIX AI is a professional E-CAD platform for electrical engineering, control panel design, fluid technology, process engineering, electrical installation, and building automation. The integrated AI copilot provides support for bill of materials, terminal diagrams, macro placement, translations, technical assistance, requirements checking, and the creation of control cabinet layouts, among other features.Electrix WSCAD

The only AI-powered E-CAD software

5.6/10 Limited
Free Full trial access including all six engineering disciplines, add-ons, interfaces, and AI features.

ELECTRIX Education Free license for verified universities and educational institutions. Subscription ELECTRIX AI Rental License
Time-limited license with updates; standard term is one year according to the provider, with additional multi-year contract options available. Other ELECTRIX AI Purchase License Perpetual license for the E-CAD software.

Maintenance and Support Software updates, support, and access to the WSCAD parts database.

Engineering Modules Electrical Engineering, Cabinet Engineering, P&ID, Fluid Engineering, Electrical Installation, and Building Automation.

Add-ons ProjectWizard, Automation, Interfaces, Manufacturing Integration, and other add-on modules.

Consulting and Training Onboarding, project consulting, training, and video tutorials via WSCADEMY.
– (0)

Link

GDPR: Partly For the European market, GDPR-compliant use is only feasible under certain conditions. On a positive note, WSCAD describes a privacy-focused architecture on the ELECTRIX website: Project content is not stored or transferred to third parties, chat histories are deleted after each session, text entries are end-to-end encrypted, and customer-specific guidelines and documents remain locally or on the customer’s own servers. At the same time, the privacy policy for AI features mentions that inputs are processed by AI and that anonymized inputs are used to improve the AI, and it refers to OpenAI Ireland Limited and, additionally, Perplexity AI, Inc. The website does not specify a concrete server or data center location for ELECTRIX AI within the EU or the EEA, nor does it provide a Data Processing Agreement (DPA), a list of subprocessors, or clearly documented EU data residency. Therefore, its use is not clearly and fully substantiated; rather, it is justifiable only on the condition that no personal or confidential data is entered into the AI and that local/in-house data storage for documents is indeed sufficient.
Positive
The product page emphasizes that personal data and IP addresses are not shared, project content is not stored or transferred to third parties, chat history is deleted after each session, and individual policies/documents remain entirely within the user’s IT environment—either locally or on the user’s own servers. From an EU/EEA perspective, this supports data-minimal and locally oriented processing steps.
Negative
At the same time, the privacy policy states that input data is processed for AI and used in anonymized form to improve the AI or to train AI models. Furthermore, OpenAI Ireland Limited and Perplexity AI, Inc. are mentioned. The website does not specify a specific ELECTRIX AI server location within the EU/EEA, EU data residency, a Data Processing Agreement (DPA), a list of subprocessors, an explicit opt-out from AI training, or certifications such as ISO 27001 or SOC 2. As a result, essential GDPR evidence for EU/EEA users remains incomplete.
Server Location
Not specified on the website. The privacy policy lists OpenAI Ireland Limited in Dublin, Ireland, as the provider of the AI platform; additionally, it mentions an interface provided by Perplexity AI, Inc. in the U.S. for wscaduniverse.com. The website does not specify a specific server or data center location for ELECTRIX AI itself within the EU/EEA.

Link

“Create custom, responsive websites with the power of code — visually.”

Webflow is a visual platform for creating, managing, and hosting websites and web-based experiences.

Its features include, among other things, a visual builder, CMS, hosting, collaboration, APIs, localization, Analyze/Optimize, as well as Webflow AI for site generation, copy, CMS content, and SEO/AEO support. For classification as an “AI tool,” it is important to note: AI is a growing part of the product, but not its sole core.Webflow

Build, manage, optimize — all with Webflow AI

7.3/10 Good
Free Free entry point for building and testing Webflow projects with a Webflow subdomain. Subscription Basic For simple websites with their own domain and no CMS focus.

CMS For blogs, content websites, and dynamic content with CMS features.

Business For larger marketing and business websites with higher capacity and more traffic.

Standard / Plus / Advanced For online stores with increasing e-commerce features and capacities.

Starter / Core / Growth / Freelancer / Agency Workspace plans for individuals, teams, freelancers, and agencies with collaboration, roles, and client access. Other Enterprise Custom Enterprise offering with advanced security, support, governance, and scalability features.

Webflow AI AI Site Builder and AI Assistant for website creation, pages, CMS Collection Items, SEO/AEO, and help in the Editor.
– (0)

Link

GDPR: Partly Webflow documents several important building blocks for GDPR-compliant use for customers in the EU/EEA region: a privacy policy, a Data Processing Addendum as a data processing agreement, a subprocessor list, standard contractual clauses in the DPA, certifications, as well as statements that customer data is not used to train generative AI models. At the same time, Webflow explicitly states the storage of customer and end-user data in the USA and refers to data transfers to the USA or other countries. Explicit EU data residency or clearly documented EU/EEA hosting as a standard or simple option is not specified on the website. For the EU/EEA as a whole, use is therefore only viable under certain conditions and following the user's own legal review, not as clearly and comprehensively demonstrated standard compliance.
Positive
Positively documented are a DPA/data processing agreement, the inclusion of the EU Standard Contractual Clauses and the UK transfer mechanism in the DPA, a published subprocessor list, contractual obligations toward subprocessors, statements excluding AI training on customer data, as well as certifications such as SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018.
Negative
Negative from an EU/EEA perspective is above all that Webflow itself states that it stores customer and end-user data in the USA, and that the website does not indicate clear EU data residency, no exclusive EU/EEA data center for SaaS use, and no on-premise/self-hosting option. This means that a third-country transfer risk remains, and fully uncomplicated GDPR use is not demonstrated on the basis of the website.
Server location
The website states that Webflow stores customer and end-user data in the USA. The DPA additionally describes that the infrastructure is operated via ISO 27001-certified Amazon Web Services data centers in multiple regions and Availability Zones; however, specific EU/EEA server locations for customer data are not named. The subprocessor list lists the locations of individual subcontracted processors, including the USA, the United Kingdom, and Ireland.

Link

"Trustworthy artificial intelligence that powers humanity towards superproductivity"

AI21 Labs is an Israeli provider of large language models and AI orchestration systems for enterprises. Its core product in the model space is the Jamba family, a hybrid SSM/Transformer model family for long contexts, RAG, question-answering systems, document processing, and secure enterprise deployments. In addition, with Maestro, AI21 offers a model-agnostic orchestration system for validated RAG agents and complex business tasks.AI21 Labs

LLM "Trustworthy artificial intelligence that powers humanity towards superproductivity"

7.2/10 Good
Free New accounts receive time-limited trial credits for AI21 Platform, APIs, SDK, and Playground. Truly usable for testing, prototyping, and evaluation; billing or a paid plan is required for continuous production use. Subscription Pay As You Go: usage-based access to Foundation Model APIs, SDK, and unlimited seats.

Custom Plan: includes pay-as-you-go features plus volume agreements, premium rate limits, private cloud hosting, priority support, a dedicated account manager, and AI consulting. No direct prices listed. Other AI21 uses token-based API billing, custom payment/enterprise plans, and cloud provider billing through partners such as AWS, Microsoft Azure, Google Cloud / Vertex AI Model Garden, or SageMaker/Bedrock. Additionally, self-deployment, fine-tuning, quantization, and custom AI systems are relevant, depending on the contract and infrastructure. No direct prices listed.
– (0)

Link

GDPR: Partly From the perspective of a user in the EU/EEA, it is not clearly demonstrated that AI21’s standard SaaS offering complies with the GDPR, because the website explicitly states that personal data is processed on servers outside the EEA, Switzerland, and the UK, including in the U.S. At the same time, however, AI21 describes private deployment options such as VPC and on-premises, as well as a DPA available upon request. Thus, GDPR-compliant use in the EU/EEA is conceivable only under certain conditions—specifically, with private deployment, appropriate contract terms, and the user’s own verification of the actual data residency in the specific setup.
Positive
The following aspects are confirmed: a published privacy policy; explicit GDPR-related transfer mechanisms such as SCCs, an adequacy decision, or a DPF in the privacy policy; a DPA/AVV template available upon request; private deployment options, including VPC and on-premises; statements that AI21 does not train models on customer content unless otherwise agreed in writing; and certifications or information regarding ISO 27001, ISO 27017, ISO 27018, SOC 2, and ISO 42001.
Negative
A major negative for standard EU/EEA operations is that AI21’s Privacy Policy mentions the processing of personal data on servers outside the EEA, including in the U.S. A specific EU/EEA server location for AI21’s own standard SaaS service is not specified on the website. No list of subprocessors was found on the website. An explicit, generally worded EU data residency commitment for the standard service was also not found on the website.
Server Location
The Privacy Policy states that personal data is processed on servers outside the EEA, Switzerland, and the UK, including in the U.S. Specific EU/EEA data center locations for standard SaaS usage are not specified on the website. The Deployment page merely lists data residency options such as “Single tenant,” “VPC,” and “On-premise,” but does not specify any specific countries or data centers within the EU/EEA.

Link

“Generative media platform for developers” / “The world’s best generative image, video, and audio models, all in one place.”

fal.ai is a developer platform for generative media APIs, serverless GPU inference, model deployment, training, fine-tuning, and dedicated GPU compute workloads. The platform provides access to 1,000+ models for image, video, audio, music, speech, 3D, and real-time streaming.fal.ai

The world’s best generative image, video, and audio models, all in one place

7.4/10 Good
Free Sandbox / Initial use Interactive sandbox for testing AI models; a publicly clearly defined permanently free standard plan with fixed limits could not be reliably found in the official sources. Other Model APIs Output-based billing per model; image models typically per image or megapixel, video models per second or video, other models per request or output unit. According to the docs, users only pay for successful outputs, not for server errors or queue waiting time.

Prepaid Credits fal.ai uses a prepaid credit model; credits are purchased in advance and deducted when used via the UI or API. According to the terms, purchased credits expire after 365 days, free/promotional credits after 90 days.

Serverless Deploy your own apps/models serverlessly; billing differs from Model APIs and is based on runner/compute usage.

Compute Dedicated GPU instances for continuous workloads; billed hourly by instance type, e.g. H100/H200/A100 classes according to the Compute documentation.

Enterprise Custom Enterprise platform with Custom Models, Dedicated Serverless Infrastructure, SLA Guarantees, Support, Private Endpoints, SSO, Usage Analytics, and customer-specific agreements.

Third-Party Models Access to third-party models; for third-party API models, client content may be transmitted to the respective third party, and its terms also apply.
– (0)

Link

GDPR: Partly GDPR-compliant use for users in the EU/EEA can only be substantiated to a limited extent. On the positive side, fal explicitly acts as a data processor for enterprise use, describes the rights of data subjects in Europe, and lists appropriate safeguards—such as contractual clauses—for international data transfers. At the same time, the website explicitly lists servers in the U.S. and other countries as the default, provides no documentation of EU data residency, no EU/EEA data centers, no publicly accessible link to the Data Processing Agreement (DPA), and no published list of subprocessors. Consequently, its use in the EU/EEA is justifiable only under additional contractual and organizational conditions, but not as a clearly and fully documented standard solution.
Positive
The website includes a privacy policy with a section for individuals in Europe, references to legal bases and data subject rights, as well as a statement that fal acts as a “processor” on behalf of the customer in enterprise contracts. In addition, the documentation describes controllable data retention for request data and media, as well as open libraries and dedicated compute/deploy options for customer-owned models.
Negative
The website lists the U.S. and other countries as processing and storage locations. EU data residency, specific EU/EEA data centers, a published list of sub-processors, a publicly accessible Data Processing Agreement (DPA), an explicit commitment to “no training with customer data” or relevant certifications such as ISO 27001 are not specified on the website. Nor is there any evidence on the website of a genuine on-premises/self-hosting option on the customer’s own infrastructure.
Server Location
According to the privacy policy, fal processes and stores personal data on servers in the U.S. and other countries. Specific data center locations in the EU/EEA are not listed on the website.

Link

"The central AI platform for your company."

Logicc is a central B2B AI platform that bundles several leading models into one interface and offers features such as web search, deep research, document chat, image generation, assistants, and code support.

The platform is clearly geared toward businesses and advertises EU/Germany hosting, "No AI training," and optional hosting on your own servers. Officially, Logicc mentions, among others, ChatGPT/OpenAI, Gemini, Claude, and Mistral models, as well as Smart Select AI for automatic model selection.Logicc

The central AI platform for your company

7.4/10 Good
Free Free trial period with no obligation; suitable for trying out in a team. Subscription Business Access to all AI models, Smart Select AI, unlimited document uploads, text/voice/document chat, web search, security standards, EU computing, no AI training, and GDPR compliance.

Secure+ Everything in Business plus team collaboration, custom assistants, shared assistant library, higher usage limit, priority support, and a stronger focus on secure team use.

Max Everything in Secure+ plus very high usage limits, access to powerful models, §203 StGB confidentiality agreement, SSO/Identity Management, end-to-end encryption, and support for security/privacy questions. Other Enterprise Custom offering with many users, individual API integrations, SSO/Identity Management, advanced compliance features, dedicated support, SLA, onboarding workshop, training, possible own server hosting, and model API.

Own API keys / integrations / model API Relevant in higher-tier or Enterprise contexts for individual system connectivity, databases, software integration, and API usage.
– (0)

Link

GDPR: Yes Based on the information published on the Logicc website itself, a clearly documented path to GDPR-compliant use within the EU/EEA is evident. Logicc describes data storage exclusively within the EU, storage on German servers, AI processing conducted solely within the EU, the General Terms and Conditions (AVV) including Terms of Use (TOMs) and information on subprocessors, as well as a contractual and technical prohibition on the use of customer data for model training. In addition, the website lists hosting on the company’s own servers as an option, which further reinforces this as the best available approach.
Positive
Particularly positive are the points mentioned on the website: GDPR-compliant within the EU, conversation and application data stored on German servers, AI processing exclusively within the EU, zero data retention by model providers, no model training using customer data, Terms of Service (TOS) including Terms of Use (TOMs) and information on subprocessors used, as well as the mentioned option of hosting on one’s own servers.
Negative
A limitation is that, although the website makes numerous claims regarding data protection and provides structural details, no separately accessible list of subprocessors was found; instead, it merely states that information on subprocessors is included in the General Terms and Conditions. The pages reviewed also lack specific statements regarding SOC 2, an explicit “EU data residency” product option as a selectable tenant/region mechanism for customers, and specific open-source components of the platform.
Server Location
The website states that all conversation and application data is permanently stored in the ISO 27001-certified data centers of Hetzner Online GmbH in Nuremberg and Falkenstein. It also states that data processing for all AI models available on Logicc takes place exclusively within the European Union.

Link

“The Visual No Code App Builder – Now Powered By AI”

Adalo is a visual no-code platform for building and publishing database-driven web apps as well as native iOS and Android apps from a single project.

AI features such as Ada, Magic Start, Magic Add, Visual AI Direction, and X-Ray support the generation, editing, and review of apps using natural language. The focus is therefore on app building, data modeling, publishing, and integrations—not on an isolated AI chat or content tool.Adalo

The Visual No Code App Builder – Now Powered By AI

6.4/10 Solid
Free Free plan for building and testing, unlimited screens, limited records per app, and Ada AI Assistant. Subscription Starter One published app, unlimited App Actions, one App Editor, Custom Fonts, Custom Domain, Publish to Web, automated app store publishing, no Adalo branding, and Ada AI Assistant.

Professional More published apps, more employees/editors, more storage, and advanced integrations.

Team More published apps, more editor/team capacity, Priority Support, and team-oriented capacity increases.

Business More apps, unlimited editor structure or stronger team/business features, and enterprise-level enhancements. Other Adalo Blue Dedicated infrastructure, custom monitoring, on-premise option, and connection to any data sources, including legacy systems without an API. Add-ons Additional published apps and additional app editors can be added depending on the plan.
– (0)

Link

GDPR: Partly Adalo provides a privacy policy on its website and a Data Processing Agreement (DPA) embedded in its Terms of Service, with explicit reference to the GDPR. At the same time, according to its privacy policy, Adalo is based in the United States and describes international data transfers only in general terms as involving “appropriate safeguards,” without providing evidence on its website of a specific EU/EEA server location, EU data residency, or an EU SaaS option. For users throughout the EU/EEA, GDPR-compliant use is therefore justifiable at best under certain conditions, particularly based on the DPA and following a careful independent review of the transfers and the categories of data used.
Positive
Positive aspects include a published privacy policy, a DPA/SLA as part of the Terms, the explicit mention of the GDPR, the allocation of roles with the customer as the controller and Adalo as the processor, and the statement that “Customer Content” is processed only on behalf of and in accordance with the customer’s instructions.
Negative
On the negative side, the website does not document any EU/EEA data center, any EU data residency, any on-premises/self-hosting option, or a robust opt-out for AI training. Furthermore, the website refers to international data transfers only in general terms and does not list any specific subprocessors in Schedule 2 of the DPA, but rather lists “N/A.”
Server Location
The privacy policy states that Adalo is based in the U.S. and that data may be transferred, stored, and processed in countries where Adalo or its service providers operate. The website does not specify a specific server or data center location or EU/EEA data residency.

Link

“Chat with any PDF using AI: ask questions, get summaries, and find answers.”

PDF.ai is an AI tool for chatting with PDF documents.

Users can ask questions about PDFs, generate summaries, find content, and extract data; in addition, the provider offers an API for Parse, Extract, Split, and Ask for document-driven workflows. The product is positioned as a web app, Chrome extension, and API.PDF.ai

Chat with any PDF using AI: ask questions, get summaries, and find answers

4.0/10 Limited
Free Free start or demo/trial use for uploading and chatting with PDFs; exact limits should be checked on the live pricing page. Subscription Starter Monthly credit quota for PDF.ai usage and API/document workflows.

Pro Higher credit quota for more intensive PDF analysis and document processing.

Scale Significantly higher credit quota for teams or larger document volumes.

Growth Very high credit quota for extensive workflows. Other API API for parsing, extracting, splitting, and processing PDFs in your own workflows.

Credits Usage-based billing via monthly credits per plan.
– (0)

Link

GDPR: Unclear For the EU/EEA area, a certain security and privacy orientation is apparent on the website, but the evidence central to a reliable GDPR assessment is missing or not specified on the website. Positive aspects include references to encrypted transmission and storage, a private document option without contact with cloud storage, as well as statements that documents are not used for other purposes. However, the website lacks clear information on EU/EEA data residency, specific server locations, DPA/AVV, subprocessors, and relevant certifications of the provider itself.
Positive
The website contains statements about encrypted storage and transmission, a private document option in which documents do not come into contact with cloud storage, as well as limited purpose limitation of processing. In addition, the API website states for the parse function 'files deleted after processing'.
Negative
The website does not specify EU/EEA data residency, specific server or data center locations, a DPA/AVV, a list of subprocessors, an explicit opt-out from AI training at the policy/contract level, on-premise/self-hosting offerings, or certifications such as ISO 27001 or SOC 2 of the provider itself. The indication that a 'data storage partner' is SOC2 Type II accredited does not replace this evidence.
Server location
Not specified on the website. Only a 'data storage partner' is mentioned, which according to the website is accredited as 'SOC2 Type II'; no country, EU/EEA reference, or specific data center location is stated.

Link

“EDA’s premier code-based, AI-driven PCB design tool.”

JITX is a code-based platform for the development and optimization of complex printed circuit boards, particularly high-frequency systems. Requirements are described in Python; AI can generate or revise the code. JITX uses this to generate schematics and layouts, employs routing and optimization methods, and can initiate and evaluate electromagnetic simulations using Ansys HFSS.JTIX

Software-defined electronics

3.5/10 Insufficient
Free Permanent free access to designs under the CERN OHL Permissive License; unlimited design complexity, routine automation, technical design checks, and component optimization. Other Enterprise Locally hosted platform for proprietary designs, choice of design license, PLM integration, KiCad, Altium, and Siemens Expedition connectivity, air gap, and dedicated support.

Trial / Demo / Training Customized demonstrations, trial accounts, and training programs.

Consulting Consulting for automated hardware design and implementation of the JITX methodology.

Custom Development Custom development, company-specific design libraries, verification rules, and integrations.
– (0)

Link

GDPR: Unclear For the entire EU/EEA region, compliance with the GDPR as stated on the provider’s website is not sufficiently substantiated. On the positive side, according to the website, JITX can run on local hardware or the provider’s own infrastructure. At the same time, the privacy policy for the services mentions hosting and processing in the U.S. as well as transfers from Europe to the U.S. The website does not provide an AVV/DPA, EU data residency, specific EU/EEA data centers, a list of subprocessors, or an explicit exclusion of the use of customer data for AI training.
Positive
The website describes JITX as running locally or on the user’s own infrastructure: “Runs on your hardware,” “JITX runs on your local computer,” and “JITX runs on your infrastructure with your approved AI.” In addition, the privacy policy lists European data subject rights and, regarding international transfers, refers to appropriate safeguards as well as the option to request contractual guarantees.
Negative
The privacy policy explicitly states that the services are hosted in the U.S. and that personal data from Europe is transferred to the U.S., among other destinations. For a robust GDPR assessment, the website lacks a Data Processing Agreement (DPA), information on EU/EEA data residency, specific data center locations in the EU/EEA, a list of sub-processors, a documented opt-out from AI training, and relevant certifications.
Server Location
According to the privacy policy, the services are hosted in the United States, and personal data is processed and stored in the United States. The website does not specify a specific EU/EEA server location or EU data residency.

Link

"The all-in-one AI platform for businesses — Turnkey, Secure & GDPR-compliant"

Omnifact is a B2B AI platform for the secure use of generative AI in businesses. It combines team chat with multiple LLM providers, document-based AI assistants via Spaces, integrations, API access, privacy filters, role/team management, and optional enterprise deployment up to on-premise. The platform is clearly focused on data sovereignty, compliance, and integration into enterprise IT.Omnifact

The all-in-one AI platform for businesses — Turnkey, Secure & GDPR-compliant

7.3/10 Good
Subscription Pro Access to the entire Omnifact platform including Chat and Spaces, leading AI models with monthly usage credits, unlimited base-tier models after the credits are used up, Omnifact Privacy Filter™, teams up to a certain size, Knowledge Spaces with a page limit, email support, and onboarding materials. Other Enterprise Everything in Pro plus no team size limit, custom usage credits, self-hosted LLMs, Bring Your Own API Key, usage analytics, API access to Spaces, Enterprise SSO, custom SLAs, on-premise deployment, and a dedicated account manager.

Spaces API / Self-Hosted LLMs / BYOK For enterprise integrations, internal knowledge assistants, your own model infrastructure, and controlled model usage.
– (0)

Link

GDPR: Yes Omnifact presents several building blocks on its own website for GDPR-compliant use throughout the EU/EEA: DPA pursuant to Art. 28 GDPR, hosting of customer data in Microsoft Azure in the Germany West Central region (Frankfurt), EU-hosted model options, privacy filters to reduce external data sharing, a documented subprocessor register, as well as self-hosting/on-premise options. Since on-premise, private cloud, and EU hosting are also expressly offered, a straightforward path to GDPR-compliant use is clearly described. As a limitation, Omnifact itself points out that for certain activatable providers and US-related subprocessors, additional assessments pursuant to Art. 44 et seq. GDPR may be necessary depending on the configuration.
Positive
Particularly positive are the DPA that becomes effective automatically upon registration, the documented data processing in Frankfurt, the option for EU-hosted models via Google Vertex AI in the 'europe-west' region, the statement 'We never use your data to train our models', the self-hosting/on-premise deployment up to and including air gap, as well as the ISO/IEC 27001:2022 certification.
Negative
Negative or limiting is that Omnifact itself points out possible third-country risks on its own website: For subprocessors headquartered in the USA, US access cannot be ruled out despite EU data storage. In addition, for certain activatable providers such as Groq, it is explicitly noted that currently no DPA is provided and use therefore takes place under the customer's own responsibility. GDPR compliance therefore depends in part on the specific provider and hosting configuration selected.
Server location
For customer data on the Omnifact platform, the website states Microsoft Azure, Germany West Central region (Frankfurt). In addition, the website mentions EU-hosted models via Google Vertex AI with hosting in the 'europe-west' region. Furthermore, Omnifact promotes EU cloud, private cloud, and on-premise; other specific data center locations are only partially specified on the website.

Link

“The #1 framework for AI-generated electronics.”

tscircuit is an open-source, code-based EDA framework that allows you to describe schematics and PCBs in React and TypeScript. From the code, the system generates schematic, PCB, 3D, and manufacturing views, among other things. AI assistants can interpret requirements, search for components, and generate the necessary tscircuit code.tscircuit

The #1 framework for AI-generated music

3.6/10 Insufficient
Free The core is open-source under the MIT license and can be used locally via the CLI or as a TypeScript/React framework. This enables full-fledged circuit design, PCB layout, simulation, and export workflows. Other PCB Hosting and Ordering Service Hosting and ordering of printed circuit boards, circuit modules, schematics, 3D models, and other electronics assets.

Private Registry Use of a custom npm-compatible registry for internal components, files, and team collaboration.

External AI Providers AI requests can be processed via OpenAI and Anthropic; potential costs and quotas depend on the specific integration.
– (0)

Link

GDPR: Unclear For the European region (EU/EEA), the website contains references to data protection rights under the GDPR and EEA relevance, but key evidence for a reliable assessment of the practical GDPR compliance of the entire service is missing. In particular, the website does not document a server location, EU data residency, a DPA/AVV, a subprocessor list, or reliable information on international data transfers. A positive aspect is that tscircuit can also be used locally via CLI and is presented as an open-source MIT project; however, the website does not specifically describe whether this is sufficient for straightforward, fully GDPR-compliant use in the EU/EEA.
Positive
The website has a privacy policy with references to rights for persons in the EEA as well as an explanation of legal bases under the GDPR. In addition, the website describes tscircuit as open source under the MIT license and mentions local use via the CLI; furthermore, a private registry model is mentioned.
Negative
The website does not specify a DPA/AVV, subprocessors, EU data residency, specific server or data center locations, SCCs or other transfer mechanisms, certifications such as ISO 27001 or SOC 2, or an explicit statement that content is not used to train general AI models. In the terms of use, the provider is based in California, USA.
Server location
Not specified on the website. The website names tscircuit Inc. as a company in San Francisco, California, USA, but provides no specific server or data center location and no EU/EEA data residency.

Link

“A one-stop, integrated AI developer studio for end-to-end development of AI applications.”

IBM watsonx.ai is a development platform for building, customizing, testing, and deploying generative AI, traditional machine learning models, and AI agents. It combines foundation models, prompt and agent tools, RAG, AutoAI, APIs, notebooks, and production runtimes in a single environment. The platform can be operated as IBM Cloud SaaS or via IBM Software Hub in your own OpenShift environments.IBM watsonx.ai

A comprehensive, all-in-one AI development studio for end-to-end development of AI applications.

8.0/10 Very good
Free Toolbox Playground / Free Free plan with a limited monthly foundation model quota, limited machine learning compute hours, and limited text extraction. Suitable for testing, playground use, and initial prototyping.

Lite Runtime Plan Free runtime plan with limited capacity for testing machine learning and inference. Foundation model tuning is not supported on the Lite plan. Subscription Essentials – Pay-as-you-go For production deployments with no fixed minimum usage; usage-based billing for models, machine learning, text extraction, model tuning, and other resources.

Standard – Pay-as-you-go Enterprise plan with a larger included compute quota and additional usage-based billing; designed for extensive production and enterprise workloads.

HIPAA-Ready Specialized plan for generative AI and machine learning under HIPAA security and privacy requirements; officially available only in the IBM Cloud Dallas region. Other IBM Foundation Models Use IBM Granite models via pay-as-you-go inference or dedicated on-demand hosting, depending on the model.

Third-party models Access to models from Meta, Google, DeepSeek, Mistral, and others; usage-based inference or dedicated on-demand deployment, depending on the model.

Embedding and Reranking Models Usage-based billing for IBM and third-party embedding models, as well as reranking capabilities for semantic search and RAG.

Deploy on Demand Dedicated hosting of selected foundation models with hourly runtime billing; availability depends on the model and region.

Machine Learning / AutoAI Usage-based billing via Capacity Unit Hours for training, AutoAI, model deployment, and scoring.

LoRA/QLoRA Fine-Tuning Customization of supported foundation models using your own data; according to IBM, QLoRA is available in Frankfurt and Dallas, among other locations.

Custom Foundation Models Import, hosting, and deployment of customer-owned or customized foundation models on dedicated infrastructure.

IBM Software Hub / On-Premise Self-operated watsonx.ai installation on Red Hat OpenShift, including a private registry and optional air-gapped environment; customized software, infrastructure, and support agreement.

Enterprise Support Extended support and SLA options in addition to the included basic support.
– (0)

Link

GDPR: Yes For users in the EU/EEA, GDPR-compliant use in accordance with the best available practice documented on the IBM website is well-documented, because IBM provides a DPA for the processing of personal data and watsonx.ai can be operated not only as SaaS but also via the IBM Software Hub in a user’s own OpenShift environment or on-premises. In addition, EU regions are designated on IBM Cloud for watsonx.ai Runtime and watsonx.ai Studio. This provides a relatively straightforward path to data-sovereign usage within Europe, particularly through self-hosting or EU regions. However, a blanket statement that any standard SaaS usage is automatically fully GDPR-compliant cannot be substantiated in every detail on the website.
Positive
IBM outlines a data protection infrastructure that includes the IBM Privacy Statement and the IBM Data Processing Addendum. For watsonx.ai, EU regions on IBM Cloud are documented, specifically Frankfurt for watsonx.ai Runtime and watsonx.ai Studio. Additionally, watsonx.ai can be installed via IBM Software Hub on private, on-premises, or the customer’s own OpenShift infrastructure. In the FAQs, IBM also states that prompts do not train the foundation models and that customer data is intended to remain private to the account.
Negative
No standalone, product-specific subpage for watsonx.ai was found on the website that provides a clear, comprehensive EU/EEA data residency commitment for all pricing plans and all components. A specific, publicly accessible list of subprocessors specifically for watsonx.ai was not found; instead, IBM refers generally to DPAs, privacy information, and, in some cases, lists available upon request. An explicit opt-out mechanism is also not described separately on the website but is only indirectly addressed by the fact that, according to the FAQs, customer data is not used for model training.
Server Location
For the SaaS/IBM Cloud version, EU locations are documented on the IBM website, specifically Frankfurt (eu-de) for watsonx.ai Runtime and watsonx.ai Studio. An IBM article on watsonx on IBM Cloud also mentions secure facilities in Dallas and Frankfurt. When using the service via IBM Software Hub or on-premises, the customer determines the infrastructure location themselves. Other specific server locations for all watsonx.ai components are not consistently listed on the website.

Link

"The leading AI platform"

innoGPT is a German multi-model AI platform for private users, teams, and companies. Officially, it combines language models, image generation, voice integration, file/document work, a prompt library, projects, Code Interpreter, web search, academic search, Deep Research, assistants, integrations, and an API in one interface. It also includes team features, desktop apps, and a clear data protection/compliance focus with EU hosting, DPA, and Trust Center.InnoGPT

All AI models. One tool. Permanent updates. Fully GDPR-compliant

7.4/10 Good
Free Free trial period without payment details according to the provider; suitable for evaluation. Subscription Personal According to the public OMR profile for private use with access to all models and functions except team functionality.

Business According to the OMR profile for companies with all functions, all models, no limits, up to 1000 users, as well as SSO/SCIM/SAML. Other Enterprise Custom offer for large organizations; according to the OMR profile for 1000+ users, on-premise possible and individual support.

Shared-/Family models A shared-access/family model with EU hosting was mentioned publicly; specific functional details should be checked directly with the provider.
– (0)

Link

GDPR: Yes The website clearly emphasizes compliance with the GDPR for the European market: innoGPT describes EU hosting—specifically servers in Frankfurt am Main—a directly executable data processing agreement (DPA) in accordance with Article 28 of the GDPR, a zero-training/zero-retention policy, automatic deletion schedules, and a Trust Center featuring subprocessors and compliance documents. Additionally, according to the Help Center, admin settings are available for different model hosting levels, including “EU Hosting / EU Processing.” From an EU/EEA perspective, this provides a documented path to GDPR-compliant use.
Positive
Positive aspects include EU/Germany hosting for the core infrastructure, a data processing agreement (DPA) in accordance with Article 28 of the GDPR, documented subprocessors in the Trust Center, zero training as stated on the security page and in the Help Center, ISO/IEC 27001:2022 in the Trust Center, and a clearly described data flow with storage and deletion after 180 days. Additionally, the website lists hosting options for individual models, such as “EU Hosting / EU Processing,” which is relevant for EU/EEA users.
Negative
A limitation is that the website also states that not all models are processed exclusively within the EU: The Help Center mentions “EU Hosting / Global Processing” and “Global Hosting / Global Processing” as well. As a result, actual compliance in individual cases depends on the model selected and the admin settings. The website does not consistently provide comprehensive evidence to support a claim that, without exception, all processing for all models takes place exclusively within the EU/EEA.
Server Location
The website specifies servers in Frankfurt am Main, Germany, for core data and platform hosting, as well as hosting within the EU in general. According to the Help Center, three levels are listed for individual models: “EU Hosting / EU Processing,” “EU Hosting / Global Processing,” and “Global Hosting / Global Processing.”

Link

Robotics

Optimus is Tesla’s humanoid robotics platform designed for physical tasks in factories and, in the future, in homes. Tesla is developing software for balance, navigation, perception, and physical interaction. The robot is not currently available for purchase by the general public.Tesla

general-purpose, bipedal, autonomous humanoid robot

3.4/10 Insufficient
– (0)

Link

GDPR: Unclear From the perspective of the EU/EEA region, no reliable GDPR compliance can be demonstrated for the AI/robotics offering presented at https://www.tesla.com/AI. Tesla's website does provide a general privacy policy and notices for the EEA/UK/Switzerland, including a controller in the Netherlands and standard contractual clauses for international transfers. However, for the specific AI/Optimus offering, the website contains no specific information on EU data residency, server/data center locations, DPA/AVV, subprocessors, self-hosting, or a clear exclusion of training with user content. Therefore, the documentation is too incomplete for an EU/EEA-wide compliance assessment.
Positive
General privacy notices are available. For individuals in the EEA/UK/Switzerland, Tesla designates Tesla International B.V. in the Netherlands as the controller and refers to standard contractual clauses for international data transfers. Tesla also names privacy rights and options for controlling certain data sharing.
Negative
For the specific tool or the AI/Optimus page, the website provides no specific information on EU/EEA hosting, data center locations, DPA/AVV, subprocessors, certifications, on-prem/self-hosting, or a contractually clear no-training path. The privacy notices also explicitly refer to possible transfers to the USA and other countries.
Server location
Not specified on the website. The general privacy policy only states that information may be transferred to Tesla in the USA and to other countries; specific server or data center locations for the AI/Optimus offering are not mentioned.

Link

“Turn lazy prompts into great ones”

Prompt Cowboy is a web-based AI tool for optimizing prompts for ChatGPT, Claude, Gemini, and other LLMs.

According to the provider, it transforms rough ideas into clearer, more powerful prompts and, depending on the input, adds follow-up questions so the prompt can be improved with more context. The platform is aimed at individual users and teams who want to create, save, reuse, and organize prompts for team collaboration.Prompt Cowboy

Turn lazy prompts into great ones

3.7/10 Insufficient
Free Unlimited prompts with standard AI; limited access to the most powerful model; use of the results with ChatGPT, Claude, Gemini, and other tools. Subscription Individual For individuals with unlimited access to the most powerful model, Advanced Memories, reusable templates, and early access.

Team For teams with shared workflows, team usage, and access to powerful prompt optimization.
– (0)

Link

GDPR: Unclear The website does contain a privacy policy referring to the EU/UK GDPR, names the service providers used, and describes security measures as well as standard contractual clauses for international transfers. However, for a reliable assessment of full GDPR compliance across the entire EU/EEA, essential information is missing from the website, in particular a designated AVV/DPA, specific server or data center locations, documented EU data residency, and a subprocessor list. Therefore, from an EU/EEA perspective, compliance is overall only unclearly evidenced.
Positive
Positively documented are a dedicated privacy policy, the explicit mention of the EU/UK GDPR as the applicable framework, standard contractual clauses, and encryption during transmission and storage. In addition, the provider states that it does not use user data to train large language models, and names Supabase, Google Cloud, Stripe, and PostHog as key service providers on the website.
Negative
It is negative that no AVV/DPA can be found on the website, no specific server locations or EU/EEA data centers are named, and no explicit EU data residency is guaranteed. A dedicated subprocessor list with locations and roles is also missing. On-premise, self-hosting, or private cloud options are not stated on the website. Relevant certifications such as ISO 27001 or SOC 2 are also not specified there.
Server location
Not specified on the website. Only the company headquarters in Sydney, Australia, as well as service providers such as Supabase, Google Cloud, Stripe, and PostHog are mentioned; specific server/data center locations in the EU/EEA or elsewhere are not named on the website.

Link

Robotics

“Building a world where we do more of what we love, while our humanoid companions handle the rest.”

1X develops humanoid robots for household and general physical work. The current flagship product, NEO, is a humanoid home robot featuring Redwood AI, LLM, audio/visual intelligence, app control, a voice interface, remote control options, and Scheduled Expert Mode for tasks the robot cannot yet perform autonomously.1X Technologies

Building a world where we do more of what we love, while our humanoid companions handle the rest.

3.6/10 Insufficient
Subscription Standard – Monthly subscription with the Starter Productivity Package and Standard Delivery, as described on the order page.

Early Access – Ownership model with warranty, premium support, and priority delivery, as described on the order page. Other Refundable Deposit, Ownership, Subscription, Support/Priority Delivery, possibly future software/service enhancements.
– (0)

Link

GDPR: Unclear The website includes a privacy policy, but key information regarding data processing on behalf of others, subprocessors, specific server locations, EU data residency, and contractual safeguards is missing, making it impossible to conduct a reliable GDPR assessment. The privacy policy also mentions international data transfers to the U.S. and other jurisdictions without providing the detailed evidence typically found on a German tool directory website.
Positive
On the positive side, there is a privacy policy that includes data subject rights, a contact option via “[email protected],” and a section on international data transfers. In addition, the website describes technical architecture details such as “onboard” and “off-board language” as well as remote supervision, which allows for certain inferences regarding data processing.
Negative
On the negative side, the website does not include a Data Processing Agreement (DPA), a list of subprocessors, a specific EU data residency, named data centers or server locations, an explicit opt-out from AI training using usage data, or reliable certification evidence. The Privacy Policy also states that personal data may be transferred to affiliated companies and service providers in the U.S. and other jurisdictions.
Server Location
Not specifically stated on the website. The Privacy Policy only states that personal data may be transferred to affiliated companies and service providers in the U.S. and other jurisdictions; specific data centers or countries where the main processing takes place are not named.

Link

“The Ultimate AI Creative Suite for Creators Marketers Sellers”

Pollo AI is a multimodal AI creative suite for video, image, avatar, and audio creation. The platform combines Creative Studio, Marketing Studio, Commerce Studio, and Pollo Agent and offers features such as text-to-video, image-to-video, reference-to-video, AI image generator, AI voice generator, voice cloning, face swap, lip sync, UGC ads, product shots, and virtual try-on.Pollo AI

The Ultimate AI Creative Suite for Creators Marketers Sellers

4.8/10 Limited
Free Start for Free / Free Use
Get started with limited usage for initial generations; specific quotas may change. Subscription Lite Creator plan for regular use with a credit allowance and access to core image and video features; exact limits depend on checkout and promotions.

Pro Advanced Creator plan with a larger credit/usage allowance, higher production capacity, and expanded features.

Ultra / Unlimited promotions Higher-tier plan or promotional model with expanded or temporarily unlimited model access; unlimited use may be subject to dynamic speed adjustments. Other Creative Studio AI video, text-to-video, image-to-video, video-to-video, AI video editor, AI image generator, avatars, voice, and effects.

Marketing Studio UGC videos, ads, URL-to-video, script-to-ad, Facebook, TikTok, YouTube, and Instagram video ads.

Commerce Studio Product videos, product images, virtual try-on, listing images, Amazon/Shopify/e-commerce visuals.

Pollo Agent Agentic video creation for production-ready videos, scenes, SFX, consistent characters, and automated editing.

Pollo API API access with API keys, model selection, video/image generation, task status, webhooks, and usage-based billing or top-up models.

Top-ups / Credits Additional usage packages for API or web app; specific billing depends on model, duration, resolution, and usage.
– (0)

Link

GDPR: Unclear For the EU/EEA region, GDPR compliance cannot be reliably verified based on the information available on the provider's website. It is positive that a privacy policy is available on the main domain and that the API privacy policy mentions a DPA as well as naming third-party processors for AI generation. However, key information for a reliable EU/EEA assessment is missing, in particular regarding server location/data center, EU data residency, available DPA/Data Processing Agreement text, subprocessor list with locations and relevant certifications. Therefore, no clear statement can be made regarding fully GDPR-compliant use for SaaS usage throughout the entire European region.
Positive
The website provides a general privacy policy for Pollo AI as well as a separate API privacy policy. The API privacy policy explicitly states that the use of the API services is subject to a 'Data Processing Agreement (DPA)'. In addition, the API privacy policy names several third-party providers for AI processing and describes that, depending on the model, selected inputs may be transmitted to these providers; furthermore, a choice option via model selection is described. The main privacy policy also states that uploaded images are only stored temporarily for certain functions and are automatically deleted shortly after video generation.
Negative
The website does not specify concrete server locations or data centers, EU/EEA data residency, a linked or retrievable DPA/Data Processing Agreement version, a complete subprocessor list with roles and locations, SCC/transfer information for data transfers outside the EU/EEA, a clear opt-out from general AI training, or certifications such as ISO 27001 or SOC 2. On-premise, self-hosting, or private cloud options are also not specified on the website.
Server location
Not specified on the website. No concrete information on server locations, data centers, or EU/EEA data residency was found on the main domain or in the identified API legal pages.

Link

"The first no-design creation software"

Mate is a web-based content creation software for on-brand images, graphics, animations, videos, social media assets, performance marketing creatives, and website visuals. The platform is aimed at teams that want to create content in corporate design without any design skills. AI features include Brand AI, AI Onboarding, AI Templates, AI Caption, AI Pictures, as well as AI Posts & Templates.Mate Studio

Create agency-level visuals in less than 60 seconds with AI

7.3/10 Good
Subscription Free trial / Demo
Trial option without a credit card as well as regular live demos; no permanently free production plan publicly listed.

Basic Entry-level plan with AI credits, asset storage, stock assets from Unsplash and Pexels, social media integrations, and email support.

Pro For small teams; includes Basic features plus more AI credits, more asset storage, video and audio features, custom font, multiple color schemes, scheduled social media posts, and bookable add-ons.

Business For power users and growing teams; includes Pro features plus more storage, unlimited color schemes, DAM and publishing tool integrations, full role management, approval workflow, and priority support.

Enterprise Custom offering for large teams, multiple brands, and international locations; includes Business features plus custom digital and print templates, multiple brandings, dedicated account manager, SSO, and enterprise service package. Other Add-ons Service packages, integrations, SSO options, enterprise services, and custom templates.

AI Credits Monthly AI credits depending on the plan; exact quotas vary by plan.
– (0)

Link

GDPR: Partly The website documents several data protection and hosting aspects relevant for the EU/EEA region: Mate describes itself as GDPR-compliant, offers an AVV/DPA upon request, and states hosting on AWS in European regions. This is positive for use in the EU/EEA. However, the documentation published on the website is not sufficient for a fully clear classification as 'yes', because key points are only available indirectly or only upon request: specific EU data center countries are not named, the list of subprocessors is not publicly viewable, an explicit exclusion of training with customer data is not stated on the website, and certifications such as ISO 27001 or SOC 2 are not mentioned on the website.
Positive
Positively documented are: Privacy policy available, AVV/DPA available upon request, Hosting via AWS in European regions, AES-256 encryption for data at rest as well as an external penetration test, which can be shared under NDA. In addition, Mate positions itself as a 'One European Creation platform' and 'Built with ❤️ in Europe'.
Negative
Negative or limiting is that the website states no specific server location within the EU/EEA, provides no publicly viewable subprocessor list, mentions no explicit opt-out or contractual exclusion of AI training with customer data, describes no on-prem/self-hosting option, and states no relevant certifications such as ISO 27001 or SOC 2 on the website.
Server location
The Security page states that Mate's entire infrastructure runs on Amazon AWS and is 'hosted in European regions'. A specific country or specific data center in the EU/EEA is not stated on the website.

Link

“Industrialize Enterprise AI. Make Enterprise AI work.”

Celonis connects data from enterprise systems to create a dynamic, context-aware view of business processes. Companies can analyze workflows, identify causes of delays or policy violations, run simulations, and automate actions. AI capabilities such as Process Copilot, machine learning, predictions, and agent integration make process knowledge accessible through natural language and operational applications.Celonis

Industrialize enterprise AI. Make enterprise AI work.

8.1/10 Very good
Free Celonis Free Plan
An officially promoted free option designed to help you get started with the platform and for limited process mining applications. Current self-service availability may be restricted based on your account or region and should be verified in advance. Subscription Custom Celonis Subscription
Enterprise contracts are based on platform scope, data volume, applications, users, processes, and support requirements; there is no public standard price list. Other Celonis Process Intelligence Platform Data Core, process data model, process mining, analytics, action and business apps, and integrations.

Process Copilot Natural language queries, process analytics, charts, summaries, and context-aware insights.

AgentC Suite for building, connecting, orchestrating, and governing AI agents with process context.

AI API / Intelligence API Integration of Celonis process knowledge and Copilot features into external applications, communication platforms, and agent systems.

Marketplace and Business Apps Preconfigured applications and process solutions for finance, supply chain, procurement, sales, manufacturing, and other areas.

Premium and Premier Plus Support Extended support, service, and maintenance models for mission-critical installations.

Consulting and Partner Services Implementation, process modeling, data integration, consulting, and industry-specific solutions provided by Celonis and its partners.

Celonis Academy Training and certification programs for users, analysts, developers, and implementation teams.
– (0)

Link

GDPR: Yes On its website, Celonis outlines several key components for GDPR-compliant use within the EU/EEA: a Privacy Notice, a linked General Terms and Conditions (GTC)/Data Processing Agreement (DPA), a linked list of subprocessors, technical and organizational measures, and statements regarding the EU region for European customer data. Regarding AI features, it is further specified that customer data is not used to train large language models and that fine-tuning is performed only with the customer’s explicit consent. This clearly demonstrates a practical approach to GDPR-compliant use within the EU/EEA.
Positive
Positive aspects include the Privacy Notice available on the website, the linked General Terms and Conditions (GTC)/Data Processing Agreement (DPA), the linked list of subprocessors, the linked Standard Contractual Clauses (SCCs) and Terms of Use (TOMs), as well as the statement that European customers’ data is generally hosted in an EU data center. For AI applications, Celonis also states that hosting takes place in the same region as the Celonis platform and that customer data is not used for training LLMs; fine-tuning is performed only with the customer’s explicit consent.
Negative
A limitation is that the website does not specify a particular member state or a specific EU data center address; it only states in general terms that European customer data is hosted in the EU. The website does not provide evidence of a complete, genuine on-premises deployment of the platform; the documented on-premises components primarily concern extractors and clients, while processing and orchestration run via cloud services. An explicit opt-out function via the UI for AI training is not described; instead, training is generally ruled out, and fine-tuning is contingent upon explicit consent.
Server Location
The website does not specify a concrete server location by country or city. It only states that Celonis uses Microsoft and Amazon hosting and that the hosting location of the customer database generally corresponds to the customer’s location; for European customers, this means a data center in the EU. For AI applications, the same region is specified as for the Celonis platform; thus, for EU hosting, the hosting is also in the EU.

Link

"Free Online AI Photo Editor, Image Generator & Design Tool"

Pixlr is a browser-based photo editor, design, and AI image editing service. The platform offers Pixlr Editor, Pixlr Express, Pixlr Designer, Remove Background, Batch Editor, AI Image Generator, Super Scale, Templates, and mobile apps.Pixlr

Free Online AI Photo Editor, Image Generator & Design Tool

4.3/10 Limited
Free Free access to Pixlr’s basic features; usable for many simple edits, but with limitations on premium and AI features. Subscription Plus Ad-free use, unlimited saving, and monthly AI credits for basic usage.

Premium Full access to premium features across platforms, significantly more AI credits, Private Mode for AI generations, as well as a larger library of fonts, templates, elements, animations, and other assets.

Team The team plan is listed in the pricing data structure; the specific included features must currently be checked on the pricing page or with the provider. Other AI Credit Pack Additional AI credits for generative tools; according to the Pricing FAQ, Credit Packs do not expire and are counted separately from subscription credits.

Enterprise Custom solution for more seats or custom API solutions; details available upon request.

Pixlr for Education Free PixlrEdu upgrades for schools and universities worldwide.
– (0)

Link

GDPR: Unclear The website contains a privacy policy with explicit GDPR references, EU representation, and notices on safeguards for transfers outside the EEA. However, for a reliable assessment of GDPR compliance across the entire EU/EEA area, the website lacks key evidence, particularly regarding specific server or data center locations, EU data residency, AVV/DPA, subprocessors, and a contractually regulated exclusion of AI training for regular user data. Therefore, from an EU/EEA perspective, use is only insufficiently documented and overall must be classified as unclear.
Positive
Positively documented are a detailed privacy policy, the designation of an EU representative in Hamburg, a data protection officer, GDPR legal bases, data subject rights, references to standard contractual clauses or appropriate safeguards for transfers outside the EEA, as well as a 30-day deletion statement after account closure. For Pixlr for Education, it is also stated that photos are stored locally in the web browser and are not uploaded or made publicly accessible.
Negative
Negative is that the website does not name any specific server locations or EU data centers, does not guarantee EU data residency, does not provide or describe an AVV/DPA, does not publish a list of subprocessors, and does not provide a reliable statement that regular prompts, uploads, or outputs are not used to train general AI models. In addition, the homepage mentions numerous external AI models and the privacy policy permits transfers outside the EEA subject to appropriate safeguards.
Server location
Not specified on the website. Only the company's registered office in Singapore is specified, as well as that personal data may, under certain circumstances, be transferred outside the EEA to other Pixlr companies or third-party processors.

Link

Amazon Nova is Amazon's own family of foundation models for text, image/video understanding, document analysis, agents, tool use, and speech.

Nova is used via Amazon Bedrock APIs, in particular InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream, and, for Sonic, via bidirectional streaming.Amazon Nova API

LLM “frontier intelligence” - “industry-leading price-performance”

6.8/10 Solid
Free AWS shows “Get started for free,” but for Amazon Nova/Bedrock, publicly documented billing is primarily usage-based; specific free quotas depend on AWS offerings, region, and account. Other On-Demand / Standard Tier Usage-based inference by model, modality, and tokens or image/video/special usage.

Flex / Priority / Reserved Tiers Bedrock supports different service tiers to manage cost, availability, latency, and throughput.

Batch Inference Asynchronous processing of larger workloads; according to AWS, cheaper than On-Demand for selected models.

Provisioned Throughput Reserved capacity for higher or predictable throughput; required for certain custom or production scenarios.

Fine-Tuning / Custom Models Customization using your own training/validation data; use of individual models typically via provisioned capacity.

Guardrails / Knowledge Bases / Agents / Prompt Routing Additional Bedrock features for security, RAG, agent orchestration, model routing, and governance.
– (0)

Link

GDPR: Partly The documentation on the AWS website outlines several components for GDPR-compliant use in the EU/EEA context: AWS references a GDPR-compliant DPA, refers to SCCs for international transfers, describes Bedrock/Nova as capable of being supported in a GDPR-compliant manner, and documents in-region and EU-specific processing options. At the same time, the documentation found does not allow for the inference of a comprehensive, automatic “EU-only” default configuration for all Nova scenarios; compliance depends on the specific region selected, the chosen Bedrock routing, and the customer’s configuration. Therefore, from an EU/EEA perspective, its use can only be considered GDPR-compliant under certain conditions.
Positive
Positive aspects include an AWS Data Processing Addendum, which, according to AWS, is GDPR-compliant and applies automatically; SCCs or additional safeguards for transfers; the option for processing in an EU region; references to EU-based data residency with Bedrock routing; encryption at rest and in transit, customer-managed key management, and the statement that inputs/outputs via Amazon Bedrock are not used to train Amazon Bedrock models, including Amazon Nova.
Negative
A negative or limiting aspect is that the documentation for Amazon Nova itself does not guarantee a blanket EU/EEA-only operating mode as the standard for all usage scenarios. In addition to in-region routing, Bedrock offers geo- and global routing; for GDPR-sensitive cases, the customer must therefore actively select the appropriate option. The website does not specify an explicit Nova-specific server location for all functions, a Nova-specific list of subprocessors, an explicit self-hosting/on-premises deployment of Nova, or a clear statement regarding open-source components.
Server Location
The website documents for Amazon Bedrock that in-region processing remains strictly within the selected region and that geo-routing can occur within a geographic area such as the EU. For Amazon Nova, the Bedrock regional table lists at least one EU region as available, namely 'eu-north-1 (Stockholm)' for Nova 2 Sonic. A general, central server location for Amazon Nova is not specified on the website.

Link

“All-in-one AI video and audio platform” Async is an AI platform for audio and video production with remote recording, editing, AI voices, voice cloning, dubbing, subtitles, clips, and publishing workflows.



The product is aimed at both solo creators and teams and companies that want to produce podcasts, video formats, social clips, or voice-first content. The platform combines recording, post-production, and publishing in one workflow.Async

All-in-one AI video and audio platform

6.9/10 Solid
Free Free entry with limited AI credits, limited media upload, text-to-speech, cloud storage, and basic features. Subscription Essentials More monthly AI Credits, unlimited media upload in AI Chat, more text-to-speech, AI Clips, Reframe, Dubbing/Lipsync, Subtitles, Thumbnail Generator, and more storage.

Pro Higher credit amount, greater usage for video, audio, and voice features, more storage, and professional creator workflows.

Teams Team workspace, collaboration, significantly more credits and storage, shared use for teams. Other Business Customized business offering with custom credits, custom storage, live support, onboarding, Customer Happiness Manager, and dedicated support.

Top-up Packs Additional AI credits as one-time packages; usage depends on model, medium, duration, and resolution.
– (0)

Link

GDPR: Partly The website contains several GDPR-relevant elements, such as a privacy policy with a GDPR section, data subject rights for users in the EEA, information on security measures, and an opt-out option for AI training. However, for use throughout the EU/EEA, the documentation is not comprehensive enough to warrant a clear “yes”: The website does not specify a specific server or data center location, does not explicitly state EU data residency, and an explicitly linked Terms of Service (TOS)/Data Processing Agreement (DPA) for customers could not be found on the website. Furthermore, the privacy policy provides for international data transfers, and the terms of service permit, by default, the use of input/output data to improve services and third-party AI, unless users opt out.
Positive
Positive aspects include the explicit GDPR section in the privacy policy, data subject rights for individuals in the EU/EEA, security measures for biometric voice data such as encryption “in transit” and “at rest,” the reference to third-party providers’ contractual obligations regarding voice biometric data, and an explicit opt-out for the use of input and output data for AI training by contacting the company. On the homepage, Async also promotes “GDPR” and “SOC 2” for its Voice API.
Negative
A negative factor for an EU/EEA assessment is that the website does not specify a concrete EU/EEA data residency or a specific server location. The privacy policy only states that data is processed at the company’s facilities and at other locations of the parties involved and may be transferred to other countries. An explicit Data Processing Agreement (DPA) for customers and a dedicated list of subprocessors for product processing were not found on the website. Additionally, the Terms of Service permit, by default, the use of input and output data for “research and development” as well as to improve services and third-party AI; exclusion from this use is only possible after actively opting out.
Server Location
Not specified on the website. The privacy policy only states that data may be processed at the company’s facilities and at other locations of the parties involved in the processing and may be transferred to other jurisdictions; no specific EU/EEA region or data center is mentioned.

Link

"The leading AI management and orchestration platform" / "AI platform – Made in Germany"

The neuland.ai HUB is an AI management and orchestration platform for companies. It brings together AI chat, assistants, projects, workflows, AI apps, integrations, document processing, governance, and model strategy within a controlled enterprise framework.neuland.ai

AI platform – Made in Germany

6.4/10 Solid
Free Free trial period with full access to get started, AI chat with your own documents, prompt tests, and creation of assistants; no credit card and no commitment according to the pricing page. Subscription Business Business plan for teams with scalable usage, core modules, AI assistants, projects, assistant creation, as well as centralized role and permission management.

Enterprise Customized enterprise package with unlimited users and use cases, tailored AI systems, AI apps, integration into existing IT systems, cloud or on-premise operation, industry competency models, as well as advanced security and compliance options. Other Custom onboarding Implementation support by Customer Success with a tailored onboarding plan for Business and Enterprise customers. Other Custom AI apps Development, operation, and monitoring of custom AI applications tailored to business processes and systems.

Custom enablement / academy Training, change support, and structured rollout for sustainable AI use within the company.

On-premise & dedicated hosting Operation of the neuland.ai HUB in your own infrastructure or a dedicated environment for the highest security requirements, data sovereignty, and regulated environments.

AI app store / SDK Marked as “Coming soon”: access to agentic AI apps as well as an SDK for custom AI apps, agents, and integrations.
– (0)

Link

GDPR: Yes The website outlines a clear path for GDPR-compliant use within Europe. Decisive factors are the explicitly stated options 'Secure EU hosting or on-premise operation', the statement that the entire neuland.ai HUB as well as all deployed models are operated and processed exclusively in the EU, and the claim that the platform complies with the GDPR. Since the assessment should reflect the best available path, compliance here should be rated as 'yes'.
Positive
Positive aspects are the EU operating models mentioned on the website, in particular EU hosting and on-premise operation, the statement regarding exclusive processing in the EU, the explicit mention of GDPR compliance, and the existing privacy policy. In addition, the published ISO/IEC 27001:2022 certification indicates a formalized level of information security.
Negative
A negative or limiting factor is that no specifically named server location at country level within the EU/EEA is stated on the website in the subpages found. Likewise, no separately identifiable information was found on the website regarding a DPA/AVV, subprocessors, or an explicit opt-out or contractual exclusion of AI training using customer data.
Server location
The website mentions EU hosting or exclusive processing in the EU; however, no specific country, data center, or data center operator is specified on the website.

Link

"The Agentic Enterprise."

Salesforce Agentforce is a platform for CRM-adjacent AI agents in sales, customer service, field service, commerce, and internal processes. Agents operate based on Salesforce data, workflows, Data Cloud, Knowledge, APIs, and integrations.Salesforce Agentforce

The Agentic Enterprise

7.1/10 Good
Free Salesforce Foundations
Includes selected core Agentforce features such as Agent Builder, Prompt Builder, Agent Script, Agentforce Coworker, and Agentforce Vibes for eligible Salesforce editions. Other Conversations Consumption model for customer-oriented agent conversations.

Per-User Licenses User-based licensing for selected Agentforce and Salesforce editions.

Agentforce 1 Editions More comprehensive Salesforce editions with AI, agent, Data Cloud, and industry-specific features.

Agentforce for Service Service agents with templates, actions, omnichannel communication, and Service Cloud integration.

Professional Services Consulting, implementation, data preparation, governance, and agent development.
– (0)

Link

GDPR: Partly Salesforce documents several central building blocks for GDPR-compliant use of Agentforce in the EU/EEA region: a privacy policy, a data processing agreement, documented subprocessors, transfer mechanisms, zero-data-retention commitments for used third-party LLMs, as well as an EU/Switzerland option via Hyperforce Operating Zone. At the same time, standard use is not automatically completely unproblematic, because Salesforce itself describes international transfers, processing outside the country, and the use of third-party LLMs on its website. Therefore, compliant use from an EU/EEA perspective is possible, but typically only with the deliberate selection of suitable product/hosting options and contractual configurations.
Positive
Positively documented are: an existing privacy policy; Data Processing Addendum with SCCs or Processor Binding Corporate Rules; according to the FAQ, Agentforce is covered by the DPA; subprocessors and hosting countries are disclosed via the Infrastructure-&-Sub-processors documentation; Hyperforce Operating Zone offers processing and storage strictly within the EU and Switzerland region; zero-data-retention commitments are described for third-party LLMs; relevant certifications for Agentforce or the platform are listed, including ISO 27001, 27017, 27018, as well as SOC 2/SOC 3.
Negative
Negative or limiting factors are: Salesforce itself states on its website that personal data may be transferred to and stored in the USA and other jurisdictions; Agentforce can use third-party LLMs; specific default server locations for each Agentforce deployment are not directly stated on the product page, but instead outsourced to linked documentation; a true local on-premise/self-hosting option for Agentforce is not indicated on the website.
Server location
For Agentforce-specific hosting countries, Salesforce refers to the 'Infrastructure & Sub-processors Documentation'. The website also documents the Hyperforce Operating Zone for the EU and Switzerland; according to Salesforce, customer data there can be processed and stored strictly within the EU and Switzerland region. At the same time, the general privacy policy states that personal data may also be processed and stored in the USA, as well as via affiliates and third parties outside one's own country or jurisdiction.

Link

"Built to Keep You in Flow State"

Windsurf is an AI-powered coding assistant, or rather an agentic IDE for software development.

The Windsurf Editor combines the local agent Cascade with the cloud agent Devin, supports model routing via Adaptive, offers IDE integrations, MCP connections, previews, and team/enterprise features for governance, security, and deployment. The tool is aimed primarily at developers, technical teams, and companies, not general office users.Windsurf

Built to Keep You in Flow State

7.1/10 Good
Free Light Usage Allowance, Tab, Previews/Deploys depending on the limit and getting started in Windsurf. Subscription Pro Standard Usage Allowance, unlimited core features, additional usage at the API price.

Max Heavy Usage Allowance for power users and high agent/coding usage. Other Teams Team plan with centralized billing, admin dashboard, analytics, support, and team features. Enterprise SSO, access controls, RBAC, volume discounts, hybrid deployment, account management, and custom deployment.
– (0)

Link

GDPR: Partly For users in the EU/EEA region, GDPR-compliant use is not clearly documented for the general standard SaaS variant, as the privacy policy mentions processing on servers in the USA. At the same time, the website mentions EU servers in Frankfurt for enterprise/hybrid deployments as well as self-hosted and VPC options. This means that GDPR-compliant use in the European region appears possible only under certain, rather enterprise-oriented conditions.
Positive
The website links to a privacy policy and a DPA. In addition, EU servers in Frankfurt are mentioned for certain enterprise deployments. There are references to hybrid deployment, a self-hosted plan, VPC deployment, as well as SOC 2 Type II.
Negative
The privacy policy mentions servers in the USA and international transfers including, among others, to the USA. General EU data residency for all plans is not documented on the website. A list of subprocessors is not provided on the website. An explicit, generally applicable opt-out for AI training is not clearly documented on the website for all product variants.
Server location
By default, the privacy policy mentions servers in the USA. For enterprise/hybrid deployments, the security page mentions EU servers in Frankfurt, Germany. No other specific data center locations in the EU/EEA region are provided on the website.

Link

"AI that brings out the best in you, from first idea to final draft"

Paperpal is an AI-powered academic writing tool for researchers, students, authors, and scientific teams.

It combines language correction, academic paraphrasing, research and citation assistance, PDF chat, plagiarism checking, and other pre-submission features on one platform. The provider explicitly positions Paperpal as a secure all-in-one solution for scientific writing.Paperpal

AI that brings out the best in you, from first idea to final draft

4.7/10 Limited
Free Free entry with academic writing features, PDF chat, Research & Cite, AI detector, plagiarism check, and submission checks with limitations. Subscription Extended or unlimited use of central functions such as Language Editing, Consistency, Research Q&A, Citation Generation, writing features, and advanced academic checks. Other Teams Plan Group plan for 2–10 members with centralized billing, activation codes, and team discounts; according to support, based on Paperpal Prime annual.

Institutional Plans Individual solutions for universities, institutions, students, or employees.

Multi-year Plan One-time longer-term option for users who want to book long-term.
– (0)

Link

GDPR: Unclear For users in the EU/EEA, the Paperpal website contains several positive statements about data protection and security, including references to GDPR compliance, ISO certification, and the statement that user data is not used to train the AI. However, for a robust GDPR assessment for the entire European area, the website lacks key, concretely verifiable information, in particular regarding EU/EEA data residency, specific server locations, a publicly available DPA/AVV, and a list of subprocessors. Therefore, GDPR-compliant use cannot be clearly demonstrated based on the website documentation.
Positive
Positive are the explicitly stated data protection and security measures: Paperpal describes itself as 'fully aligned' with GDPR, mentions ISO/IEC 27001 certification, refers to CSA STAR Level 1, states encrypted storage and transmission, and says that inputs, prompts, and documents are not used to train the AI.
Negative
Negative is that the website does not name any specifically identified EU/EEA data centers or countries. Likewise, no publicly accessible DPA/AVV, no list of subprocessors, and no clear statement regarding EU data residency, SCCs, or other mechanisms for data transfers within the EU/EEA were found on the website. On-premise, self-hosting, or private cloud options are also not indicated on the website.
Server location
The website mentions 'SSAE 18/SOC1-certified facilities', 'trusted globally', as well as Amazon Web Services/cloud infrastructure, but does not specify any concrete server location or any EU/EEA country. EU data residency is not stated on the website.

Link

"Work AI that Works"

Glean is an enterprise work AI platform that brings together search, assistants, and agents across enterprise data.

The platform connects to business applications, documents, chats, and tickets, respects existing permissions, and supports features such as enterprise search, generative answers, data analysis, deep research, and agentic automation. It is clearly geared toward enterprises rather than consumer self-service.Glean

Work AI that Works

7.7/10 Good
Subscription Glean Enterprise Work AI platform with Enterprise Search, Assistant, Agents, Connectors, permissions, company context, and security features.

Glean Enterprise Flex Seat-based licensing combined with pooled FlexCredits for advanced AI features; includes platform capabilities and usage-based premium features. Other FlexCredits / Usage-based Features Advanced features such as Thinking Mode, Deep Research, Data Analysis, Canvas, image understanding, and other features may consume credits.

APIs / Developer Platform / MCP APIs for Search, Chat, and Agents; integrations with Cursor, Claude Code, Copilot, and MCP hosts.
– (0)

Link

GDPR: Partly Glean documents several components relevant to the GDPR in the EU/EEA region on its own website: GDPR compliance, a Data Processing Addendum with SCCs, a list of subprocessors, customer rights for the EEA, and customer-controlled hosting options—including deployment in preferred regions and operation in the customer’s own AWS, Azure, or GCP cloud. At the same time, the website indicates that standard subprocessors and LLM/cloud providers are based in the U.S., and the general privacy policy describes international transfers to the U.S. This appears to offer a viable path for GDPR-compliant use in the EU/EEA, but not as a simple, blanket solution for standard SaaS usage in all cases.
Positive
Positive aspects include the published DPA with EU Standard Contractual Clauses, the explicit designation of Glean as a data processor in the DPA, the documented support for data subject rights and data protection impact assessments, the list of subprocessors, the statement on data sovereignty across global regions, the option for an isolated single-tenant deployment, and customer-hosted deployments in their own AWS, Azure, or GCP cloud. In addition, Glean lists certifications and attestations such as SOC 2 Type II, ISO/IEC 27001, and ISO/IEC 42001.
Negative
A negative or limiting aspect is that the website does not provide a specific commitment regarding EU/EEA data centers for the standard deployment, with named countries or regions. The published list of subprocessors includes numerous U.S. providers, such as AWS, Google, Microsoft, OpenAI, Anthropic, Groq, Fireworks.ai, and Snowflake, as well as a support affiliate in India. The privacy policy also describes data transfers to the U.S. or other jurisdictions. The website does not provide a reliable statement confirming that the standard SaaS version is processed entirely within the EU/EEA.
Server Location
The website does not provide a fixed list of EU/EEA servers with specific countries for the standard SaaS version. It mentions global regions such as “AMER, EMEA, or APAC,” as well as customer-controlled deployment in the preferred region. The list of subprocessors includes several U.S. subprocessors and an affiliate in India. For customer-hosted deployments, the website refers to the customer’s own AWS, Azure, or GCP cloud; the specific EU/EEA location would be selectable by the customer, but is not further specified on the website.

Link

"Stable Diffusion is a deep learning model used for converting text to images" / "Use Stable Diffusion online for free"

stablediffusionweb.com is a web interface for using Stable Diffusion models, especially Stable Diffusion XL. It offers text-to-image, a prompt database, upscaling, partly video/advanced models, and a credit-based pricing model.Stable Diffusion

Stable Diffusion is a deep learning model used for converting text to images

3.6/10 Insufficient
Free Free use with a daily credit quota, a limited number of images per generation, without ads/watermarks according to the pricing page; commercial license and private images/videos are not included. Subscription Pro Monthly credit allowance, more images per generation, no ads, no watermark, upscaling, advanced image and video models, commercial license, and private images/videos.

Max Higher monthly credit allowance, Pro features, advanced models, commercial license, and private images/videos. Other Credit/Usage Logic Usage is based on credits; specific consumption values depend on the function.

Contradictory Contract Presentation Pricing describes monthly/annual plans, while the Terms simultaneously refer to a software license without recurring fees; the pricing/contract logic should be reviewed before purchase.
– (0)

Link

GDPR: Unclear The website does mention a privacy policy and states that the service acts as a controller and processor within the meaning of the EU GDPR. However, for a reliable assessment of usability throughout the EU/EEA, key information is missing on the website, in particular regarding server location/data center, EU data residency, data processing agreement, subprocessors, international data transfers, and a contractual exclusion of training on user data.
Positive
It is positive that a dedicated privacy policy is available and explicitly mentions the GDPR. In addition, the website states that information is only collected when it is needed to provide the service, that data is only stored for as long as necessary for the requested service, and that personal data is not intended to be made public or shared with third parties, except where this is required by law.
Negative
It is negative that no server location and no EU data residency are specified on the website. A DPA is not specified on the website. A list of subprocessors is not specified on the website. Certifications such as ISO 27001 or SOC 2 are not specified on the website. An opt-out option for AI training is not specified on the website. In addition, the Acceptable Use Policy describes that prompts, uploads, and outputs may be reviewed automatically and manually, without the website explaining a more detailed data protection framework for EU/EEA users.
Server location
Not specified on the website. Neither specific server locations nor EU/EEA data centers or EU data residency are mentioned.

Link

Sakana Fugu: “One Model to Command Them All.” Overall, Sakana AI positions itself with “Building Frontier AI in Japan.”

Sakana AI develops frontier AI products and research projects. Fugu combines multiple external leading models behind an OpenAI-compatible API and orchestrates them dynamically for complex, multi-step tasks. Marlin is an autonomous research agent for market, technology, competitive, and regulatory analyses; Sakana Chat is a chat service based on the Namazu model family in the alpha phase.Sakana AI

One Model to Command Them All.

3.6/10 Insufficient
Subscription Standard Monthly entry-level plan for occasional API calls, smaller tests, and personal workflows; includes Fugu and Fugu Ultra.

Pro Monthly plan for regular coding, review, research, and analysis tasks; includes a higher usage allowance.

Max Monthly plan for longer, compute-intensive, and frequent multi-agent tasks. Other No permanently free production version
Credits must be purchased for API usage; an official free-tier version is not specified.

Token Plan / Pay-as-you-go Usage-based API access for production workloads and peak loads; billing based on token consumption.

Fugu Standard model focused on response speed, coding, code review, interactive work, and optional exclusion of individual model providers.

Fugu Ultra Model for demanding multi-step tasks, research, paper reproduction, patent and literature research; the full agent pool is predefined.

Enterprise Deployment Custom enterprise agreement for access, plans, and enterprise deployment; public details are unavailable.
– (0)

Link

GDPR: Unclear The website contains a privacy policy for 'Fugu', and it includes information on international data transfers, data subject rights, and a possible opt-out for training. However, for a reliable GDPR assessment across the entire EU/EEA, key information is missing from the website: a clearly specified EU/EEA server location or EU data residency, published DPA/AVV information, a subprocessor list, and specific details on certifications. In addition, the privacy policy explicitly mentions transfers to Japan and the USA. Therefore, GDPR-compliant use for EU/EEA users cannot be clearly demonstrated based on the website alone.
Positive
Positive aspects include the published privacy policy, the description of data subject rights, the reference to 'appropriate safeguards' for international transfers, and the statement that there may be an opt-out control for training/fine-tuning via account or product settings, if offered. In addition, according to the documentation, 'fugu' can restrict provider selection via the 'custom model pool', which at least suggests some degree of technical control over the disclosure to external model providers.
Negative
Negative is that the website does not guarantee an EU/EEA server location or EU data residency. Instead, the privacy policy states that personal data may be transferred to third parties outside the country of residence, including Japan and the USA. Also not specified on the website are a DPA/AVV page, a subprocessor list, on-prem/self-hosting options, and relevant certifications such as ISO 27001 or SOC 2.
Server location
No specific server/data center location for the EU/EEA is stated on the website. The privacy policy merely states that personal data may be transferred to third parties outside the country of residence, including Japan and the USA. EU data residency is not specified on the website.

Link

“The #1 AI Headshot Generator for Professional Headshots”

HeadshotPro is an AI tool for creating professional business and team headshots from uploaded selfies.

The product is aimed at both individuals and companies and, in addition to individual packages, also offers team features such as an admin dashboard, API, webhooks, and enterprise SSO. It is officially positioned as a SaaS for professional portraits, LinkedIn/CV photos, team pages, and branded employee photos.HeadshotPro

The #1 AI Headshot Generator for Professional Headshots

7.2/10 Good
Free Free headshot test feature; according to HeadshotPro, lower quality than the professional generator. Other Individual Packages One-time packages for professional AI headshots, commercial use, and download of the generated images.

Corporate / Team Headshots Team dashboard, invitations for employees, consistent company styles, branded profile pictures, and management of larger groups.

API / Enterprise / Sales API and enterprise options for larger or integrated headshot workflows.
– (0)

Link

GDPR: Partly HeadshotPro provides a privacy policy, a DPA/AVV, a list of subprocessors, and information on security and data deletion on its website. For users in the EU/EEA, this provides a formal framework for GDPR-compliant use, including SCCs for transfers from the EEA, the United Kingdom, and Switzerland. At the same time, the website does not specify EU data residency; rather, it specifies that hosting and processing take place in the U.S. and lists several U.S. subprocessors for hosting, databases, AI processing, and content. Therefore, GDPR-compliant use appears possible only under certain conditions and following an additional independent review of the transfer, the legal bases, and the risk assessment.
Positive
The website publishes a DPA/AVV, provisions regarding documented instructions, support for data subject rights, TOMs, subprocessor information, and SCCs for international transfers. In addition, HeadshotPro states that it processes personal data solely for the purpose of providing services and not for its own purposes, such as marketing, advertising, or profiling.
Negative
The website does not specify an EU/EEA-exclusive data residency. The Security Policy and the list of subprocessors mention data hosting and processing in the U.S., including GCS in the U.S., Render, Vercel, MongoDB, OpenAI, Google Gemini, Replicate, and Fal.ai. The website does not specify an on-premises, self-hosting, or dedicated private cloud option for the EU/EEA. Relevant certifications such as ISO 27001 or SOC 2 are not listed on the website.
Server Location
The website specifically lists the U.S. as a location. The Security Policy mentions data hosting in GCS facilities in the U.S. ('us-east-1') as well as Render; the list of subprocessors includes production systems for customer content in facilities in the U.S. as well as infrastructure subprocessors, including Google Cloud Platform with “EU/US,” Render US, Vercel US, and MongoDB US. A binding EU data residency requirement is not specified on the website.

Link

“The freedom AI stack.”

Open WebUI is a self-hosted AI portal for teams and organizations. The platform connects local or external LLMs with team chat, RAG, document knowledge, tools, MCP, role-based permissions, and integrations.Open WebUI

The freedom AI stack.

7.5/10 Good
Free Community Edition
Free self-hosted AI portal with chat, RAG, local models, cloud models, tools, and team use. Other Enterprise Custom enterprise support, architecture consulting, scaling, SSO, governance, and professional support.

Self-hosting Costs for servers, GPU, storage, databases, backups, and operations.

External model providers Usage costs for OpenAI, Anthropic, Azure, Bedrock, or other model providers.

License notice Current components are available under multiple licensing models; for larger deployments, branding requirements of the current Open-WebUI license apply.
– (0)

Link

GDPR: Yes Open WebUI documents on its own website a clear self-hosting/on-premise path, including private cloud, air-gapped, and hybrid operation. For users in the EU/EEA, this provides a straightforward path to GDPR-compliant use, because according to the documentation, data processing can take place within their own infrastructure and the operator determines where data is physically located. At the same time, the website also makes it clear that compliance responsibility lies with the deploying company; a blanket GDPR commitment for a provider SaaS is not evident on the website.
Positive
Positively documented are self-hosting, on-premise, private cloud, air-gapped and hybrid deployment, as well as control over data residency. The website explicitly states that data remains in the organization's own infrastructure by default, provided no external model providers are configured, and that organizations themselves can determine where data is physically stored. In addition, a publicly auditable codebase is described.
Negative
Negative or limiting is that the website does not appear to provide its own privacy policy, no AVV/DPA, no subprocessor list, no specific EU data center indication for a provider-operated service, and no contractual statement excluding model training. The documentation also emphasizes that compliance certifications and regulatory obligations for the specific deployment lie with the operating organization.
Server location
No specific provider server location is stated on the website. Instead, the documentation for self-hosting and private cloud describes that the operator chooses the physical storage location of the data and that the data remains in the organization's own infrastructure by default. EU/EEA data residency is therefore possible via own deployment, but no provider-designated EU data center is stated on the website.

Link