Find Your Tool in 6 Steps
Result: 144

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps
Results: 144
Search Images Video Music API Agent Voice Chatbot Coding Marketing
Provider login

“EDA’s premier code-based, AI-driven PCB design tool.”

JITX is a code-based platform for the development and optimization of complex printed circuit boards, particularly high-frequency systems. Requirements are described in Python; AI can generate or revise the code. JITX uses this to generate schematics and layouts, employs routing and optimization methods, and can initiate and evaluate electromagnetic simulations using Ansys HFSS.JTIX

Software-defined electronics

6.4/10 KIFOX Score – Solid
Free Permanent free access to designs under the CERN OHL Permissive License; unlimited design complexity, routine automation, technical design checks, and component optimization. Other Enterprise Locally hosted platform for proprietary designs, choice of design license, PLM integration, KiCad, Altium, and Siemens Expedition connectivity, air gap, and dedicated support.

Trial / Demo / Training Customized demonstrations, trial accounts, and training programs.

Consulting Consulting for automated hardware design and implementation of the JITX methodology.

Custom Development Custom development, company-specific design libraries, verification rules, and integrations.
– (0)

Link

GDPR: Partly Overall assessment:
Conditional; well-controlled in locally hosted enterprise environments.

A positive aspect is that JITX offers enterprise customers a locally hosted and air-gapped installation. This allows proprietary designs to be processed within the customer’s own IT infrastructure without requiring design data to be transferred to a public US cloud. JITX treats customer data as confidential information in its Terms of Service.

A negative aspect is that the general JITX services are hosted in the U.S. The privacy policy mentions Google Analytics, FullStory, and HubSpot; the website may collect device and interaction data, including form interactions. Personal data may be stored in the U.S. and transferred from there to other countries.

Server location: U.S. for general hosted services; local customer infrastructure for the Enterprise model. No publicly available GDPR DPA, EU hosting, SCC document, or complete list of subprocessors was found: No verified information available.

Training on customer data: JITX has published research on the use of external LLMs such as Claude, Gemini, and GPT for PCB code. No general public commitment stating that customer designs are never used for AI training was found. In local or air-gapped operations, this risk can be significantly reduced from a technical standpoint.

Conclusion: For GDPR- and IP-critical hardware projects, enterprise operation on proprietary infrastructure is the most sensible option. The browser-based website and marketing services should be evaluated separately from the actual local design environment.

PRIVACY POLICY

Link

"One Voice AI Assistant. Different Ways to Use It."

Speechify is a voice AI platform that converts text into natural-sounding speech and also offers features such as Voice Typing, Voice AI Assistant, AI Podcasts, OCR scanning, as well as creator/studio features like Voice Over, Dubbing, and Voice Cloning.

The product is available as a web app, browser extension, and for iOS, Android, macOS, and Windows; there is also an API for developers.Speechify

One Voice AI Assistant. Different Ways to Use It

6.9/10 KIFOX Score – Solid
Free Basic text-to-speech features, slower listening, limited simple voices, and text-to-speech only. Subscription Premium High-quality natural voices, many languages, faster listening, Scan & Listen, AI Summaries & Chats.

Speechify Studio Separate subscription for voiceovers, creator content, podcasts, videos, dubbing, and audio production. Other API Text-to-speech API with a free tier and scalable usage plans for apps and workflows.

Enterprise / EDU Enterprise and education offerings for larger organizations, teams, and integrations.
– (0)

Link

GDPR: Partly GDPR assessment: Speechify is conditionally suitable from a GDPR perspective.

Positive is that Speechify describes rights for EEA, Switzerland, and UK users, enables data deletion, mentions Standard Contractual Clauses for transfers outside Europe, and states encryption in transit and at rest.

Negative is that, according to the Privacy Policy, Speechify transfers information to the USA, where it is processed and stored; in addition, User Content and personal data are synchronized with the servers depending on usage. A publicly clear AVV/DPA for regular users could not be reliably verified.

Server location: USA. Further link: Speechify Privacy and Pricing.

Privacy Policy

Link

“A platform for all your company’s knowledge—search, assistant, agents.”

amber connects internal corporate systems and makes their content accessible via a central AI search. amberAI answers questions based on internal data and cites the sources used. amberAgents automates recurring, multi-step tasks and can trigger actions in other systems via interfaces.amber

A platform for all your company's knowledge – Search, Assistant, Agents

7.8/10 KIFOX Score – Good
Subscription SmartWebsite Basic Domain, SSL certificate, email accounts, limited website size, and AI website generator.

SmartWebsite Plus Basic features plus significantly more subpages, AI text generator and optimizer, AI SEO assistant, and marketingRadar.

SmartWebsite Pro Plus features, larger page quota, and rankingCoach for advanced search engine optimization.


Smart AI Phone Assistant Unlimited AI phone service with monthly cancellation option, featuring unlimited calls, call forwarding, appointment scheduling, and advanced API integration. Other AI Email Assistant Optional add-on for STRATO plans that include an email account; features drafts, summaries, replies, rephrasing, and translations.

WordPress Hosting with AI Setup WordPress hosting with AI-powered initial setup of websites and content.



SmartWebshop E-commerce packages with website/shop creation and integrated AI support for setup and content.

V-Server for LLM Hosting Virtual servers for independent operation of small and medium-sized open-source language models.

Dedicated Servers for LLM Hosting Dedicated hardware for larger models, custom AI services, agents, and controlled enterprise applications.

OpenClaw and n8n Hosting Server offerings for self-hosted AI agents and workflow automations.
– (0)

Link

GDPR: Yes Overall assessment: Very well suited for GDPR compliance, subject to the specific
data sources and company settings. amber is operated by amber Tech GmbH, based in Aachen. The provider offers AVV/DPA documentation and technical and organizational measures, and operates an ISO 27001-certified information security management system. According to the provider, the platform is designed in accordance with Privacy by Design and Privacy by Default.

A positive aspect is that the platform and search index are operated in German T-Cloud data centers. Virtual network isolation is provided for each customer. amber lists role-based permissions, least-privilege access, 2FA, SAML 2.0, LDAP/Active Directory, encrypted remote access, firewalls, vulnerability scans, and comprehensive audit logging.
amber explicitly states that it does not use customer data to train AI models. According to the provider, the integrated models are deployed in Europe in compliance with the GDPR. Administrators can control which models are used. Processing is based on RAG and search indexes: corporate knowledge is used as context at runtime without retraining a general language model with customer data.

Server location: By default, Germany on T Cloud infrastructure. With the Enterprise plan, amber can be operated on the customer’s own infrastructure. The specific hardware and operational architecture of the customer’s deployment is agreed upon individually. Deletion and Retention: Sensitive data can be completely removed from the amber servers upon request; deletion metadata is logged. Backups are created for recovery purposes. The exact retention periods for production data, backups, and the end of the contract should be verified in the respective General Terms and Conditions (AVV) and offer.

A negative aspect, or one requiring review, is that amber can integrate numerous external systems and various AI models. Each data source—such as SharePoint, Salesforce, DATEV, Confluence, or email—brings its own permissions, personal data, and retention rules. These source systems and the selected models must therefore be included in the record of processing activities and, if necessary, in a data protection impact assessment.

Conclusion: amber is among the European enterprise AI platforms with stronger data protection measures. To ensure proper implementation, the register of processing activities, retention periods, model approvals, source systems, permission synchronization, and agent actions should be centrally managed by IT and data protection.

Security at amber

Privacy Policy

Link

"Building AI to Simulate the World"

Runway is an AI platform for generative media production with a focus on AI video, image generation, video editing, performance capture, audio/voice features, workflows, and API access.

The tool is aimed at creators, marketing teams, film/media production, agencies, developers, and companies that want to create or edit visual content with AI.Runway

Building AI to Simulate the World

7.1/10 KIFOX Score – Good
Free Free entry with a one-time credit allocation; suitable for testing and for initial generations. Subscription Standard More monthly credits, access to core Runway apps and generative video/image features; for individuals and small teams.

Pro More credits, access to all apps, workflows, generative video models, third-party models, more storage, and advanced creative features.

Unlimited Everything in Pro plus Explore Mode for unlimited image and video generations at a relaxed speed; additionally, monthly credits for features without Explore Mode. Other Enterprise Custom enterprise offering with SSO, custom credits, configurable organization and team spaces, Advanced Security, onboarding, success program, and priority support.

Credits / Additional Credits Runway uses credits for many generation features; additional credits are available for paid plans.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Runway is conditionally suitable.

Positive is that Runway documents SOC 2 Type II, encryption in transit and at rest, access controls, content isolation, private assets, and enterprise security processes. According to Runway, enterprise customers can request security reports via the Trust Center or the sales process. It is also positive that, according to the Help Center, users generally retain ownership and rights to uploaded and generated content.

Negative is that Runway is a US provider and there is no publicly documented general EU-only data residency as a standard. Help documents mention AWS S3 domains with a US-East reference for uploads; for GDPR-critical use, the DPA, subprocessors, storage location, training use, deletion periods, and enterprise contract should therefore be reviewed.

Server location: No verified EU-only standard region is publicly documented; cloud processing with a US connection is likely. Further link: Runway Data Security, Privacy Policy, Pricing and Usage Rights.

Runway Security

Link

Robotics

Optimus is Tesla’s humanoid robotics platform designed for physical tasks in factories and, in the future, in homes. Tesla is developing software for balance, navigation, perception, and physical interaction. The robot is not currently available for purchase by the general public.Tesla

general-purpose, bipedal, autonomous humanoid robot

3.1/10 KIFOX Score – Insufficient
– (0)

Link

GDPR: Unclear Overall assessment:

On the positive side, Tesla has a comprehensive general privacy policy. For individuals in the EEA, the United Kingdom, and Switzerland, Tesla International B.V. in the Netherlands is designated as the data controller. Tesla identifies a data protection officer, outlines data subject rights, provides options for erasure, describes technical and organizational security measures, and references EU Standard Contractual Clauses for international transfers. Tesla also states that it does not sell personal data.

On the negative side, the publicly available privacy policy mainly refers to vehicles, energy products, websites, accounts, and existing Tesla services. A specific privacy policy for Optimus, its cameras, microphones, telemetry, remote control, training data, or operating environment has not been published: No verified information available.

Server location: Tesla is a global company and may transfer personal data to the U.S. and other countries. For European data, Tesla refers to standard contractual clauses and technical and organizational safeguards. A specific EU data residency for Optimus is not specified.

Training on customer data: Tesla describes, in part, local camera processing for vehicles and consent-based data sharing for fleet learning. These statements cannot be automatically applied to Optimus. There is no publicly available Optimus-specific non-training commitment.

DPA: No publicly available, product-specific DPA template exists for future enterprise use of Optimus: No verified information is available.

Conclusion: Tesla generally has established GDPR processes, SCCs, and a European data controller. However, a robust GDPR assessment for Optimus will only be possible once Tesla publishes specific product terms, data flows, storage locations, retention policies, training usage, and contractual documents.

Customer Privacy Notice

Link

"Seeking the optimal conversion from energy to intelligence"

Moonshot AI is the provider behind Kimi, an LLM and agent platform focused on long contexts, coding, deep research, documents, spreadsheets, slides, web search, and multimodal processing. The Kimi API offers models such as Kimi K2.6, K2.5, K2, and Moonshot-v1.Moonshot AI

LLM “Seeking the optimal conversion from energy to intelligence”

4.3/10 KIFOX Score – Limited
Other Pay-as-you-go API Flexible, usage-based billing according to input and output tokens, model selection, and, where applicable, document/tool usage; suitable for developers and small teams.

Kimi K2.6 / K2.5 / K2 / Moonshot V1 Model families for multimodal or text-based tasks, long context, coding, agents, reasoning, and dialogue tasks.

Enterprise Solutions & Customization For medium-sized and large companies with flexible rate limits, multi-project deployments, support, SLA-oriented reliability, and individual agreements according to the platform page.
– (0)

Link

GDPR: Unclear Overall assessment: Unclear to conditionally GDPR-suitable. According to the official Privacy Policy, the Kimi OpenPlatform is provided by MOONSHOT AI PTE. LTD. in Singapore; for users from the EEA, Switzerland, and the UK, the policy contains supplementary data protection information and legal bases.

Positive is that data subject rights such as access, deletion, rectification, restriction, data portability, objection, and the right to lodge a complaint are described.

Negative is that the policy covers User Content—i.e., prompts, audio, images, videos, files, and generated content—and explicitly states that data may be used to improve, develop, train, and refine the underlying technology, such as machine learning models.

Server location: according to the policy, the servers are located in Singapore; personal data may be processed and stored there. No verified information is publicly available regarding a DPA/AVV, EU hosting, SCCs, or a complete list of subprocessors for EU customers. For GDPR-critical use, Kimi is therefore only advisable after additional contractual review and, if possible, without personal or confidential data. Sources: Kimi OpenPlatform Privacy Policy and Terms of Service.

Kimi OpenPlatform Privacy Policy

Link

“Boost visibility in Google, ChatGPT, and beyond.”

Surfer is an SEO and AI visibility platform for planning, creating, optimizing, and monitoring content.

The product combines Content Editor, Topical Map, Content Audit, SERP Analyzer, Audit, as well as AI visibility tracking for systems such as ChatGPT, Perplexity, Google AI Overview, Google AI Mode, and Gemini. In addition, it includes AI writing features, internal linking, integrations, and team/workspace functions.Surfer

Boost visibility in Google, ChatGPT, and beyond

6.8/10 KIFOX Score – Solid
Free Free tools such as Chrome Extension, AI Writing Tools, AI Detector, Humanizer, and courses; no fully featured permanently free version of the Surfer platform. Subscription Discovery Getting started with content creation and optimization, limited documents, page tracking, AI SEO guidelines, Surfy, and Humanizer.

Standard Unified SEO workflow, more documents, AI visibility tracking, AI prompts, integrations, brand knowledge, 1-click content optimization, and team collaboration.

Pro Everything in Standard plus more AI prompt tracking, multiple brand workspaces, internal linking, content ideas, coverage gap, templates, custom voices, and cannibalization report.

Peace of Mind Everything in Pro plus more unlimited optimization, more AI visibility tracking, API access, and VIP/scale features. Other Enterprise Customized packages with SSO, Enterprise Security, Advisory, Legal Onboarding Assistance, Early Access, Custom Limits, White-Label, Priority Support, and Team Onboarding.

AI Credits / Top-ups Additional AI credits can be added to active subscriptions.
– (0)

Link

GDPR: Partly GDPR assessment: Surfer AI / Surfer SEO is conditionally to well suited from a GDPR perspective.

Positive is that Surfer is a Polish provider based in Wrocław, explicitly mentions the GDPR in its Customer Privacy Policy, and describes a DPA mechanism for customer data directly in the privacy clause. Surfer specifies technical and organizational measures under Art. 32 GDPR, deletion/return rules, a list of subprocessors, and SCCs or appropriate transfer mechanisms for third-country transfers.

Negative is that subprocessors are not located exclusively in the EU; among others, Google Cloud Platform with EU/USA, Cloudflare globally, Stripe globally, as well as other providers with US ties are mentioned.

Server location: Not exclusively in the EU; Google Cloud Platform EU/USA and other global or US subprocessors are documented.

Privacy Policy

Link

“The #1 framework for AI-generated electronics.”

tscircuit is an open-source, code-based EDA framework that allows you to describe schematics and PCBs in React and TypeScript. From the code, the system generates schematic, PCB, 3D, and manufacturing views, among other things. AI assistants can interpret requirements, search for components, and generate the necessary tscircuit code.tscircuit

The #1 framework for AI-generated music

6.1/10 KIFOX Score – Solid
Free The core is open-source under the MIT license and can be used locally via the CLI or as a TypeScript/React framework. This enables full-fledged circuit design, PCB layout, simulation, and export workflows. Other PCB Hosting and Ordering Service Hosting and ordering of printed circuit boards, circuit modules, schematics, 3D models, and other electronics assets.

Private Registry Use of a custom npm-compatible registry for internal components, files, and team collaboration.

External AI Providers AI requests can be processed via OpenAI and Anthropic; potential costs and quotas depend on the specific integration.
– (0)

Link

GDPR: Partly Overall assessment:

On the positive side, tsCircuit has published a detailed privacy policy that outlines the legal basis for EU users, data subject rights, account deletion, and technical and organizational security measures. Personal data is generally only stored for as long as an active account exists or as required by legal obligations. Users can request access, correction, or deletion via a dedicated privacy form.

On the negative side, tsCircuit Inc. is headquartered in San Francisco, and according to the Terms of Service, the services are hosted in the U.S. When using the AI features, inputs, outputs, and, where applicable, personal data are shared with external AI service providers. The privacy policy explicitly names OpenAI and Anthropic as AI service providers. Additionally, cloud, storage, analytics, authentication, and payment service providers may be used.

Server location: USA for the hosted services. A publicly available DPA for European business customers, EU data residency, standard contractual clauses, or a complete list of subprocessors by name were not found: No reliable information available.

Conclusion: tsCircuit is well-suited for public open-source projects and non-confidential electronic designs. For proprietary circuits or personal data, it is preferable to work locally, use a private package registry, and review the external AI integration separately. Confidential project details should not be transmitted to the integrated AI chat without prior review.

PRIVACY POLICY

Link

"Your finances. Under control." / "Here is your AI tax advisor"

Accountable is a tax, accounting, invoicing, and banking app for self-employed people in Germany. The integrated AI tax advisor answers tax questions, takes the user's personal Accountable situation into account according to the provider, and assists with receipt recognition, expense categorization, tax checks, and tax returns.Accountable – AI tax advisor

Your finances. Under control. / Here is your AI tax advisor

6.7/10 KIFOX Score – Solid
Free Free entry into e-invoicing via smartphone, a linked bank account, unlimited ZUGFeRD and XRechnungen, limited expense booking and business account features. No full-fledged AI tax advisor access apparent as a core service. Subscription Invoices Plus Includes everything from Free plus web access for income, unlimited e-invoices on smartphone and laptop, quotes, installment invoices, recurring invoices, as well as limited AI tax advisor access.

Accounting For complete bookkeeping and expense management; includes web and mobile access, multiple bank accounts, unlimited expense booking, tax overview, small business year-end closing features, and limited AI tax advisor access.

Taxes Includes accounting and invoicing tools plus VAT advance return, annual financial statements, income tax/EÜR/trade tax/annual VAT return, and significantly expanded AI tax advisor access.

Max Highest Accountable tier with advanced tax and support features, personal onboarding, tax coach access, extended tax guarantee, and unlimited AI tax advisor access. Other Tax advisor services
Separate tax advisory services such as consultations with certified tax advisors, income tax returns, or support during tax audits; not identical to the AI tax advisor.
– (0)

Link

GDPR: Yes Overall assessment: Conditionally to well suited for GDPR compliance. Accountable processes very sensitive tax, financial, and in some cases special categories of personal data, so a data protection review is particularly important.

Positive is that Accountable states Frankfurt as the server location for the AI tax advisor and refers to strict data protection and confidentiality rules. In addition, Accountable explains in the privacy policy that personal data is processed to provide tax and accounting services and that GDPR legal bases such as contract performance, consent, and legitimate interests are used. For tax returns, data is transmitted to the tax office via the ELSTER interface; according to the privacy policy, sensitive data such as health data or religious affiliation is processed on the basis of consent.

Negative is that Accountable explicitly points out for the AI tax advisor that AI can be wrong and that important information should be checked; in addition, chats may be reviewed for quality assurance. A clear public statement on whether specific AI chat content is used for training or fine-tuning the AI tax advisor could not be clearly verified in the official sources reviewed: No verified information available.

Server location: For the AI tax advisor, Accountable states Frankfurt; for third-party providers of the website/app, the privacy policy also mentions services with possible processing in the USA, such as Google Analytics, Amplitude, Stripe, Mailchimp, or Intercom. For tax-sensitive data, a distinction should therefore be made between app/tax processing, website tracking, and AI chat use. Conclusion: For self-employed persons in Germany, Accountable is generally plausibly usable from a data protection perspective, but confidential or particularly sensitive information should only be entered consciously; for business use involving third-party data, a DPA, third-party providers, retention, and AI chat review should be clarified in advance. Sources: Accountable AI tax advisor, Accountable privacy policy, and Accountable pricing.

Privacy Policy

Link

“The only E-CAD software with AI support.”

ELECTRIX AI is a professional E-CAD platform for electrical engineering, control panel design, fluid technology, process engineering, electrical installation, and building automation. The integrated AI copilot provides support for bill of materials, terminal diagrams, macro placement, translations, technical assistance, requirements checking, and the creation of control cabinet layouts, among other features.Electrix WSCAD

The only AI-powered E-CAD software

7.1/10 KIFOX Score – Good
Free Full trial access including all six engineering disciplines, add-ons, interfaces, and AI features.

ELECTRIX Education Free license for verified universities and educational institutions. Subscription ELECTRIX AI Rental License
Time-limited license with updates; standard term is one year according to the provider, with additional multi-year contract options available. Other ELECTRIX AI Purchase License Perpetual license for the E-CAD software.

Maintenance and Support Software updates, support, and access to the WSCAD parts database.

Engineering Modules Electrical Engineering, Cabinet Engineering, P&ID, Fluid Engineering, Electrical Installation, and Building Automation.

Add-ons ProjectWizard, Automation, Interfaces, Manufacturing Integration, and other add-on modules.

Consulting and Training Onboarding, project consulting, training, and video tutorials via WSCADEMY.
– (0)

Link

GDPR: Yes Overall assessment:
Well-suited for GDPR compliance, subject to the specific license and cloud configuration.
A positive aspect is that WSCAD is a German GmbH based in Bergkirchen. Regarding ELECTRIX AI, WSCAD explicitly states that neither personal data nor IP addresses are shared, project content is not stored or transferred to third parties, and inputs to the AI Copilot are end-to-end encrypted. The chat history is automatically deleted after each session. According to WSCAD, engineering and control cabinet AI run locally on the workstation or the customer’s infrastructure. The automatic control cabinet agent is designed to operate entirely locally and learn from customer projects without transferring engineering data to an external cloud. A hybrid approach is used for functions such as translations.

Server location: Central engineering and project files can be stored locally or on the corporate network. For optional online functions such as translations or wscaduniverse.com, no uniform data region is documented for all operations.

AVV/DPA: A publicly available, specific AVV for ELECTRIX AI was not found. Since essential project processing takes place locally, not every function necessarily involves data processing on behalf of a client. However, the contractual situation should still be reviewed for cloud, support, or translation functions.

Conclusion: ELECTRIX AI is among the more privacy-friendly engineering AI solutions because, according to the provider, sensitive project data remains local. Companies should nevertheless document the specific network, translation, support, and online library configurations.

WSCAD Privacy Policy

Link

“The ultimate AI-powered camera control for filmmakers & creators” / Platform for AI video, image, audio, supercomputer, MCP/CLI, Marketing Studio, Cinema Studio, and AI Influencer.

Higgsfield AI is a creative platform for generative images, videos, ads, UGC, AI influencers, storyboards, VFX presets, camera movements, character consistency, and marketing content. The platform brings together many leading models and proprietary workflows in a single interface.Higgsfield.AI

The ultimate AI-powered camera control for filmmakers & creators

3.7/10 KIFOX Score – Insufficient
Free The official website advertises “Try Free”; specific permanently free limits were not fully confirmed in the publicly readable pricing content. Subscription Individual / Single Plans Higgsfield uses a credit-based model for image, video, and premium generations. The currently binding names and limits of the individual plans could not be fully verified on the dynamic pricing page during research access; the official pricing page is the authoritative source.

Team Plan Shared workspace for creative teams with collaboration on prompts, visuals, and videos; designed for joint production and team workflows.

Enterprise Enterprise offering with SOC-2-aligned security, SSO, custom integrations, audit logs, and SLA support according to the enterprise page; specific terms and privacy details must be requested. Other Credits Generations consume Credits depending on model, resolution, length, and function; according to the official MCP page, MCP uses the same Credit system as the Higgsfield platform.

MCP / CLI / API Use of Higgsfield generations via external agents or developer/automation access; API limits and restrictions may be set by Higgsfield.

Enterprise / Custom Individual workflows, integrations, security requirements, and volume needs via Enterprise sales; no fully verified publicly standardized pricing/performance scheme.
– (0)
GDPR: Unclear Overall assessment:
Conditionally to critically GDPR-suitable.

A positive aspect is that Higgsfield includes a GDPR/Europe section in its Privacy Policy, appoints an EU/EEA representative via DataRep, and describes data subject rights such as access, rectification, erasure, data portability, restriction, objection, and withdrawal of consent. In addition, the Privacy Policy names legal bases such as contract performance, legitimate interests, legal obligations, and consent.

Negative is that, according to the Privacy Policy, Higgsfield is a US-based provider and personal data may inevitably be processed in the USA; additionally, Higgsfield names locations and providers/partners in the USA, EU, UK, Kazakhstan, and China. For transfers outside Europe, Higgsfield refers to adequacy decisions, the EU-U.S. Data Privacy Framework, the UK Extension, and Standard Contractual Clauses or exceptions.

Particularly critical for GDPR- and IP-sensitive use: The Terms expressly state that Higgsfield does not claim ownership rights to inputs or outputs and does not restrict commercial use of the outputs; at the same time, inputs, other user content, and outputs may be used by Higgsfield for development, improvement, model training, moderation, marketing, and promotion. For this purpose, users grant Higgsfield a non-exclusive, irrevocable, worldwide, royalty-free, transferable, and sublicensable license.

Server location: No verified information on EU data residency or specific hosting regions is available. Only this is certain: Higgsfield is US-based and also processes data in the USA. DPA/AVV: No publicly and clearly identifiable GDPR DPA/AVV for standard users was found. Conclusion: Usable for public marketing content, social media assets, and creative experiments; for confidential customer data, personal images/videos, unpublished campaigns, or privacy-sensitive organizations, only recommended with an enterprise contract, DPA/AVV, transfer assessment, non-training commitment, and clear rights review.

Privacy Policy

"Turn ideas into apps in minutes — no coding needed"

Replit is an AI-powered platform that lets you create, edit, and publish apps directly in the browser.

At its core is the Replit Agent, which writes code, sets up infrastructure, and runs tests. It also includes integrated publishing, database, storage, design, and integration features in a single interface.Replit

Turn ideas into apps in minutes — no coding needed

7.5/10 KIFOX Score – Good
Free Free entry point for creating apps, using AI integrations, and publishing the first project; suitable for learning, testing, and simple projects. Subscription Core For individuals with premium tools, Replit Agent, more resources, more credits/usage allowance, and more productive app building.

Teams / Pro / Team-oriented plans For smaller teams with collaboration, more centralized management, more resources, private deployments, and advanced control features; specific plan names may change. Other Enterprise Custom enterprise offering with SSO/SAML, SOC 2 reference, admin controls, private deployments, security review, and enterprise support.

Usage Credits / AI Billing Replit Agent uses effort-based billing; AI Integrations are bundled via Replit Credits, and Replit manages provider access and billing.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Replit is conditionally suitable.

Positive is that Replit provides a Data Processing Agreement, mentions SOC 2 compliance, and offers enterprise security features such as SSO/SAML, private deployments, and admin controls. It is also positive that, for published projects, a geographic region for compute and storage resources can be selected depending on the plan.

Negative is that, according to Replit’s own security documentation, Replit primarily hosts data in Google Cloud data centers in the USA; India is mentioned as an option, but blanket EU data residency is not documented as a standard. For personal or confidential data, the DPA, SCCs, deployed AI models, third-party integrations, app region, logs, secrets, and backup/restore processes must be reviewed.

Server location: Primarily USA; optional app regions may be relevant depending on the plan/deployment, but platform data is not generally EU-only. Further links: Replit DPA, Security, Information Security, Pricing.

Data Processing Agreement Replit Privacy Policy

Link

“Build production-ready apps through conversation.”

Emergent is an agent-based no-code—or “vibe-coding”—app builder. Natural-language requirements are transformed into complete web and mobile applications, complete with user interface, backend logic, database, authentication, integrations, and hosting. Users can export the generated code via GitHub and continue developing or deploying it outside the platform.Emergent

Build production-ready apps through conversation.

3.9/10 KIFOX Score – Insufficient
Free Monthly free credit allowance, access to core platform features, web and mobile experiences, advanced models, and one-click LLM integration. Subscription Standard Free features plus private projects, a larger monthly credit allowance, the ability to purchase additional credits, GitHub integration, and task forking.

Pro Standard features plus a large context window, advanced reasoning, system prompt editing, custom AI agents, high-performance computing, a higher credit allowance, and prioritized support.

Enterprise Custom enterprise plan with higher usage limits, SSO, domain capture, shared workspaces, role-based access control, audit logs, managed hosting, onboarding, and enterprise support. Other Credits Consumption units for AI agents, development steps, and platform usage; the standard plan allows you to purchase additional credits.

GitHub Code Export Full synchronization and transfer of the generated code to your own GitHub repository.

Managed Hosting Hosting, monitoring, authentication, database, and deployment can be provided within the platform.

Enterprise Cloud Deployment Custom deployment within the company’s cloud and governance environment; technical and regional details available upon request.

Integrations and MCP More than 100 integrations, payment providers, APIs, and MCP connections for external systems and workflows.
– (0)

Link

GDPR: Unclear Overall Assessment:
On the positive side, Emergent offers SOC 2 Type II and ISO 27001 certifications for the enterprise sector, as well as SSO/SAML, role-based access controls, and audit logs. Enterprise is marketed as a controlled environment “inside your cloud, under your governance.” The privacy statement is issued by Emergent Labs Inc. It explicitly states that the general Privacy Policy does not apply to personal data that Emergent processes on behalf of business customers as a service provider. Separate contractual or data processing terms would therefore have to apply to this data. However, a publicly available GDPR DPA was not found in the official sources reviewed: No verified information is available.

A negative finding is that no publicly verified information was found regarding a European branch office, an EU representative, standard contractual clauses, a complete list of subprocessors, or standard EU data residency. Furthermore, no clear public commitment was found stating that prompts, generated code, project data, or app content will not be used for training or improving the AI models in use: No verified information available.

Server location: No specific hosting region has been published for the standard individual plans. The Enterprise plan is advertised as operating in the customer’s cloud or under the customer’s governance; specific cloud providers, regions, and data residency options must be agreed upon individually.

Conclusion: Emergent offers good technical enterprise security features but, from a GDPR perspective, is less transparent than established European providers. Before processing personal or confidential data, the DPA/AVV, SCCs, data region, subprocessors, retention, model training, and deletion processes should be confirmed in writing.

Privacy Policy

Link

“Get found. Get booked. Get paid.”

Jimdo is a platform developed in Germany for websites and small online businesses. Users can use AI to create a website with a structure, text, images, and calls to action, and then manage bookings, forms, online stores, payments, invoices, and local visibility. The AI assistant, Companion, analyzes existing Jimdo business data and suggests specific steps for optimization.Jimdo

A website that thinks along with you and helps self-employed individuals build and grow their businesses.

7.3/10 KIFOX Score – Good
Free Free monthly credit allowance, access to core platform features, web and mobile experiences, advanced models, and one-click LLM integration. Subscription Standard Free features plus private projects, a larger monthly credit allowance, the ability to purchase additional credits, GitHub integration, and task forking.

Pro Standard features plus a large context window, advanced reasoning, system prompt editing, custom AI agents, high-performance computing, a higher credit allowance, and prioritized support.

Enterprise Custom enterprise plan with higher usage limits, SSO, domain capture, shared workspaces, role-based access control, audit logs, managed hosting, onboarding, and enterprise support. Other Credits Consumption units for AI agents, development steps, and platform usage; the standard plan allows you to purchase additional credits.

GitHub Code Export Full synchronization and transfer of the generated code to your own GitHub repository.

Managed Hosting Hosting, monitoring, authentication, database, and deployment can be provided within the platform.

Enterprise Cloud Deployment Custom deployment within the company’s cloud and governance environment; technical and regional details available upon request.

Integrations and MCP More than 100 integrations, payment providers, APIs, and MCP connections for external systems and workflows.
– (0)

Link

GDPR: Yes Overall Assessment:
Conditionally to generally GDPR-compliant. Jimdo is operated by Jimdo GmbH, headquartered in Hamburg, and provides a Data Processing Agreement in accordance with Article 28 of the GDPR. The DPA obligates Jimdo and its subprocessors to comply with relevant data protection obligations and stipulates that personal data covered by the DPA must generally be deleted four weeks after the contract ends, provided that no statutory retention requirement precludes this. According to the DPA, transfers to third countries may only take place under the conditions set forth in Chapter V of the GDPR.

On a positive note, Jimdo states that its servers are hosted in Europe. The official list of subprocessors includes Amazon Web Services EMEA (with processing in the EU), First Colo in Germany, and OpenAI for AI-powered content creation (with processing in the EU). However, Cloudflare, Fastly, FullStory, Google Analytics, Mailchimp, Twilio, and LangChain—among others—are also used, with processing taking place in the U.S. or worldwide. For transfers to third countries, Jimdo refers to Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

Negative: There is an important restriction to note regarding the use of AI: Jimdo states that provided content—such as company information—may be used for the provision, further development, and optimization of AI-powered features. Anonymized content may be used to improve AI models. Users may object in writing to the use of their content for AI training purposes. Jimdo names OpenAI LLC as its AI service provider and allows users to request the deletion of data processed there. Therefore, there is no blanket commitment not to use any content for training purposes.

Server location: Europe. Individual subcontractors also process data in the U.S. or worldwide. According to the current list of subcontractors, AI-generated content via OpenAI is processed within the EU.

Conclusion: Jimdo offers a solid GDPR foundation for self-employed individuals and small businesses. However, for sensitive customer, health, employee, or project data, AI training should be deactivated or objected to, external widgets should be minimized, and the subprocessors used should be documented.

Privacy Policy

Link

Leading AI models on a secure platform operated in Germany.

DeutschlandGPT provides models such as GPT, Claude, Gemini, Llama, and Mistral through a single interface. Users can chat, analyze documents and images, perform real-time web searches, configure their own assistants or specialized applications, and integrate external business systems. The platform is designed for individual users, teams, companies, and public or data-sensitive organizations.GermanyGPT

Leading AI models on a secure platform operated in Germany.

7.7/10 KIFOX Score – Good
Free Try it for free: A permanently free plan with a limited number of daily messages, custom prompts, and limited file and image analysis. Subscription Pro All leading AI models, projects, integrations, specialized applications, and higher usage limits.

5x Pro Pro features with significantly higher usage limits for more intensive individual use.

Business Pro features plus centralized user management, white labeling, prioritized support, and configurable retention periods; for SMBs and teams.

Enterprise Business features plus custom domain, SAML SSO, SCIM provisioning, Customer Success Manager, dedicated onboarding, invoice billing, and AI training. Other Enterprise Trial Access Time-limited trial access for larger organizations, available by arrangement.

Germany GPT API Usage-based access to various AI models; billing depends on the model and token consumption.

Fair Use Model Paid platform plans have higher limits but are subject to rules against automated bulk usage and resale.
– (0)

Link

GDPR: Yes Overall assessment: Good to very good GDPR compliance. DeutschlandGPT is operated by DeutschlandGPT GmbH, based in Germering, and provides a publicly available data processing agreement in accordance with Article 28 of the GDPR.

Positive aspects include storage on German infrastructure, an external data protection officer, configurable retention periods, two-factor authentication, encryption, client isolation, backups, and documented technical and organizational measures. The DPA explicitly governs the processing of account data, conversation histories, user inputs, files, and contextual content.

DeutschlandGPT states that it has concluded agreements on zero data retention with the connected AI providers. According to these agreements, data is not to be stored by the respective AI provider after model processing and is not to be used for training the models. T-Systems, Hetzner, IONOS, Microsoft Ireland, AWS EMEA, Google Cloud EMEA, Mistral AI, and OpenAI Ireland are listed, among others, as data processors or infrastructure partners.

Server location: According to the provider, persistent data storage takes place in Germany on the Open Telekom Cloud or in T-Systems data centers in Magdeburg and Biere. DeutschlandGPT cites BSI-C5-certified infrastructure and ISO 27001-related security standards for this purpose.

External integrations, optional third-party services, and processing by different model providers are considered negative or subject to review. Even with Zero Data Retention, data transfers may occur for the actual inference process. Users must therefore continue to assess model selection, legal basis, and special categories of personal data themselves.

Conclusion: For German companies, DeutschlandGPT is among the more privacy-friendly multi-model platforms. For corporate use, terms of service, retention periods, role-based access rights, activated models, and integrations should be documented, and sensitive data should only be processed in accordance with internal AI policies.

Privacy Notice

Link

“A one-stop, integrated AI developer studio for end-to-end development of AI applications.”

IBM watsonx.ai is a development platform for building, customizing, testing, and deploying generative AI, traditional machine learning models, and AI agents. It combines foundation models, prompt and agent tools, RAG, AutoAI, APIs, notebooks, and production runtimes in a single environment. The platform can be operated as IBM Cloud SaaS or via IBM Software Hub in your own OpenShift environments.IBM watsonx.ai

A comprehensive, all-in-one AI development studio for end-to-end development of AI applications.

8.2/10 KIFOX Score – Very good
Free Toolbox Playground / Free Free plan with a limited monthly foundation model quota, limited machine learning compute hours, and limited text extraction. Suitable for testing, playground use, and initial prototyping.

Lite Runtime Plan Free runtime plan with limited capacity for testing machine learning and inference. Foundation model tuning is not supported on the Lite plan. Subscription Essentials – Pay-as-you-go For production deployments with no fixed minimum usage; usage-based billing for models, machine learning, text extraction, model tuning, and other resources.

Standard – Pay-as-you-go Enterprise plan with a larger included compute quota and additional usage-based billing; designed for extensive production and enterprise workloads.

HIPAA-Ready Specialized plan for generative AI and machine learning under HIPAA security and privacy requirements; officially available only in the IBM Cloud Dallas region. Other IBM Foundation Models Use IBM Granite models via pay-as-you-go inference or dedicated on-demand hosting, depending on the model.

Third-party models Access to models from Meta, Google, DeepSeek, Mistral, and others; usage-based inference or dedicated on-demand deployment, depending on the model.

Embedding and Reranking Models Usage-based billing for IBM and third-party embedding models, as well as reranking capabilities for semantic search and RAG.

Deploy on Demand Dedicated hosting of selected foundation models with hourly runtime billing; availability depends on the model and region.

Machine Learning / AutoAI Usage-based billing via Capacity Unit Hours for training, AutoAI, model deployment, and scoring.

LoRA/QLoRA Fine-Tuning Customization of supported foundation models using your own data; according to IBM, QLoRA is available in Frankfurt and Dallas, among other locations.

Custom Foundation Models Import, hosting, and deployment of customer-owned or customized foundation models on dedicated infrastructure.

IBM Software Hub / On-Premise Self-operated watsonx.ai installation on Red Hat OpenShift, including a private registry and optional air-gapped environment; customized software, infrastructure, and support agreement.

Enterprise Support Extended support and SLA options in addition to the included basic support.
– (0)

Link

GDPR: Yes Overall assessment:
Well-suited for GDPR compliance, provided that a European region or a controlled on-premises deployment is selected and the IBM contractual documents are properly incorporated. IBM provides a Data Processing Addendum for watsonx.ai. According to official documentation, the IBM DPA and the associated Data Processing and Protection Data Sheets apply when personal data as defined by the GDPR is processed in customer content. The data sheets describe product-specific permissible content, processing activities, data protection features, retention, and data return. Changes to subprocessors and opt-out options are governed by the DPA.

A positive aspect is the explicit training rule: IBM states that uploaded content and the outputs generated by foundation models will not be used to further train or improve IBM models or other models. This means that watsonx.ai is generally suitable for business data, internal knowledge, and confidential RAG applications. However, this statement does not relieve companies of the responsibility to review the third-party, open-source, or customer-owned models they select.

Server location: IBM watsonx.ai is available on IBM Cloud in locations including Frankfurt, London, Dallas, and Tokyo. Projects, catalogs, and data are region-bound; a project stored in Frankfurt cannot simply be opened via an instance in Dallas. For German companies, the Frankfurt region or eu-de is therefore particularly relevant. IBM also supports private service endpoints in these regions, allowing watsonx.ai Runtime to be operated without public internet access.

A drawback—or rather, a point requiring review—is that individual models and features are not available in every region. Watsonx.ai also includes models from IBM as well as third-party providers such as Meta, Google, DeepSeek, and Mistral. Model licensing, deployment type, regional availability, and any additional terms must therefore be reviewed on a model-by-model basis.

IBM also notes that personal data should not be written to training log files, as these may be accessible to other users within the customer’s organization and, if necessary, to IBM Support. For personal data in watsonx.ai Runtime, IBM describes a process for secure deletion.

Conclusion: Watsonx.ai is comparatively well-suited for GDPR-critical organizations, particularly when using the Frankfurt region, private endpoints, or an installation on their own OpenShift infrastructure. A DPA and data sheet, a documented region selection, role and permission concepts, retention periods, logging rules, and an individual review of the foundation models and data sources used remain required.

Security policies and responsibilities in IBM Cloud Privacy Statement

Link

Robotics

“Empowering Every Home with Robotics”

Noetix Robotics develops compact and full-size humanoid robots for education, research, entertainment, developers, corporate demonstrations, and, in the future, private households. Bumi is positioned as a lightweight entry-level and educational robot, N2 focuses more on dynamic movement and research, and E1 on voice interaction, service, and embodied AI.Noetix Robotics

Empowering Every Home with Robotics

3.4/10 KIFOX Score – Insufficient
Other Hardware purchases, product variants such as Pro and EDU, customized sales offers, configurations for education and research, optional computing modules, as well as support and warranty services.
– (0)

Link

GDPR: No Overall assessment:

On the positive side, Noetix provides a privacy policy in English, lists technical and organizational safeguards, and states that it stores data only for necessary purposes. After the retention period expires or upon a request for deletion, data is to be securely deleted or anonymized. Noetix also states that it does not sell personal data or make it available to third parties for unrestricted use.

On the negative side, the privacy policy explicitly applies only to the website at noetixrobotics.com. It does not sufficiently describe data processing related to robots, smartphone controls, language models, cameras, microphones, OTA updates, or SDKs. The website uses, among other things, Google Analytics/Ads, Facebook Pixel, LinkedIn Insight Tag, Bing Pixel, Reddit Pixel, and Criteo.

Server location: Noetix explicitly states that it stores personal data within China. No EU data residency is indicated.

DPA, SCCs, and EU Representative: A publicly available data processing agreement, EU Standard Contractual Clauses, an EU representative, a complete list of subprocessors, and a European Data Protection Officer were not found: No verified information available.

Conclusion: From a GDPR perspective, Noetix must be viewed critically regarding personal data, camera or audio recordings, and use in schools, households, or publicly accessible spaces. Prior to procurement, a product-specific privacy policy, data processing agreement, transfer impact assessment, SCCs, telemetry and deletion policy, as well as clear statements regarding language model, camera, and training data are required.

Privacy Policy

Link

“Automate your work.”

Make is a visual no-code/low-code automation platform for integrations, workflows, and increasingly also agentic AI processes.

Companies can use it to connect data and actions across 3,000+ apps, automate API-based processes, and incorporate AI features such as AI Agents, AI Toolkit, AI Content Extractor, AI Web Search, and MCP servers into scenarios. The product addresses both simple app automations and more complex enterprise workflows with team, governance, and hybrid connectivity.Make

Automate your work

7.4/10 KIFOX Score – Good
Free Monthly credits, visual no-code workflow builder, 3,000+ apps, router & filter, support, and a longer minimum interval. Subscription Core Everything in Free plus unlimited active scenarios, more granular scheduling, higher data limits, and the Make API.

Pro Everything in Core plus Priority Scenario Execution, Custom Variables, and Full-Text Execution Log Search.

Teams Everything in Pro plus Teams, team roles, and sharing of scenario templates. Other Enterprise Custom Functions Support, Enterprise App Integrations, 24/7 Enterprise Support, Value Engineering, Overage Protection, and Advanced Security.

Credits / AI Agents Credit-based usage for scenarios and AI automation; scope of features varies by plan.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, Make is conditionally to well suited, especially for European companies, if a DPA and an appropriate data region are used.

Positive is that Make provides a Privacy & GDPR page, a Data Processing Agreement, subprocessors/SCC documents, as well as SOC 2 Type II and SOC 3. Also positive is the European provider/Celonis connection and the ability to control automations very closely.

Negative is that, depending on the connected apps, modules, AI providers, and third parties, data may be transferred to additional systems; for AI functions, the respective model providers must also be reviewed separately.

Server location: Make does not publicly state in all sources a clear blanket server location for all accounts; Enterprise/regions/subprocessors should be checked specifically. Further link: Make Privacy & GDPR, Security, DPA.

Privacy & GDPR

Link

“AI for scientific research.”

Elicit is an AI-powered research assistant designed to search for, review, evaluate, and synthesize scientific literature. The tool supports basic literature searches, automated research reports, and systematic reviews, including screening, data extraction, and citation management. All key AI statements are to be linked to text passages from the underlying publications.Elicit

AI for scientific research.

7.9/10 KIFOX Score – Good
Free Limited Research Agent, monthly limited automated reports, unlimited search across more than 138 million publications, unlimited abstracts, Paper-Chat when full text is available, source display, and Zotero import. Subscription Plus Includes Basic features plus expanded access to the Research Agent, more automated reports, export to RIS, CSV, BIB, PDF, and DOCX, larger extraction tables, and clinical trial search.

Pro For systematic reviews; includes an advanced Research Agent, a dedicated review workflow, higher screening and report quotas, research alerts, custom extraction from uploads, explanations for AI responses, output templates, and API access.

Scale For collaborative research teams; includes Pro features plus full Research Agent access, image interpretation, real-time collaboration, larger reports and tables, and an admin panel with usage and seat management.

Enterprise For corporations, universities, and research institutions; includes SSO/SAML, 2FA, domain verification, user analytics, custom deployments, single-tenancy options, custom data sources and templates, higher review limits, unlimited alerts and API usage, and no training on customer data by default. Other Elicit API API access is available starting with the Pro plan; reports and reviews generated via the API count toward the respective workflow quota. According to the documentation, systematic reviews via the API are reserved for Enterprise plans.

Institutional Agreements Custom contracts for universities, research groups, and companies, including onboarding, training, customer success, and customized data sources.
– (0)

Link

GDPR: Yes Overall assessment:
Conditionally to well suited for GDPR compliance, particularly in the enterprise contract. A positive aspect is that Elicit provides a public Data Processing Addendum that governs the processing of customers’ personal data as a data processor. The DPA incorporates the EU Standard Contractual Clauses, supports controller-to-processor and processor-to-processor transfers, requires subprocessors to implement comparable safeguards, and mandates notification of data breaches within 72 hours of discovery at the latest. Elicit also publishes a list of subprocessors and enables notifications regarding changes.

Other positive features include SOC 2 controls, encryption in transit and at rest, regular penetration tests and vulnerability scans, as well as security monitoring via AWS GuardDuty and Cloudflare WAF. Elicit explicitly states that it does not use enterprise user data for model training; contracts with external providers such as OpenAI are also intended to preclude the use of this data for training.

A negative aspect is that Elicit is operated by the U.S.-based Elicit Research, PBC, and international data transfers may be required. No binding EU data residency or publicly documented European standard data center location was found: no verified information is available. The DPA uses SCCs for limited third-country transfers and designates Irish law and Irish courts for the EU standard contractual clauses.

For Basic, Plus, Pro, and Scale, the official pricing page does not include a general non-training commitment as clear as that for Enterprise. No reliable information is available as to whether all uploaded content from all standard plans is generally excluded from training. Particularly sensitive, unpublished, or personal research documents should therefore preferably be processed via contractually verified Enterprise access.

Conclusion: Elicit can be used in compliance with the GDPR through a DPA, SCCs, an Enterprise contract, access controls, and vetting of subprocessors. For health data, unpublished research, trade secrets, or special categories of personal data, a data protection impact assessment and documented approval should also be conducted.

Privacy Policy

Data Processing Addendum

Link

Robotics

“The future of home care is here”

Figure AI develops electrically powered humanoid robots designed to perform human tasks in industrial, logistics, and—in the future—domestic environments. Figure 02 was tested at BMW Spartanburg in a real production environment; Figure 03 is more focused on domestic use, Helix AI, safety, and mass production.Figure.AI

The future of home help is here

3.6/10 KIFOX Score – Insufficient
Other Enterprise/pilot/partner projects on request. Industrial and commercial partnerships, such as BMW and Catalyst Brands, are documented; public purchase, rental or leasing conditions are not guaranteed.
– (0)

Link

GDPR: Unclear Overall assessment:Figure AI is a U.S.-based provider headquartered in San Jose, California. On the positive side, Figure provides an up-to-date Privacy Policy, describes data protection rights, lists physical, technical, organizational, and administrative security measures, and explains that data may be used in anonymized or aggregated form for analysis, to develop and improve services, without directly identifying users.

On the negative side, depending on usage, Figure may also collect sensory data, including photos, videos, or recordings of individuals and/or their surroundings. The Privacy Policy also lists service providers, hosting/technology providers, analytics providers, advertising partners, support providers, and parties that users authorize. For EU customers, no publicly available information was found regarding a GDPR DPA, EU representative, standard contractual clauses, a complete list of subprocessors, or EU data residency: No verified information available.

Server location: No verified information regarding EU hosting is available. The Terms state that the service is controlled, operated, and administered from the U.S.

Conclusion:
For industrial pilot projects such as BMW, Figure is technically very relevant, but from a data protection perspective, it is only suitable for the German market after a case-by-case review. If used in Germany, at a minimum, an AVV/DPA, third-country transfer assessment, robot sensor concept, camera/audio concept, deletion/retention rules, access controls, CE/machine safety assessment, and company agreements would be required.

Privacy Policy

Link

“Industrialize Enterprise AI. Make Enterprise AI work.”

Celonis connects data from enterprise systems to create a dynamic, context-aware view of business processes. Companies can analyze workflows, identify causes of delays or policy violations, run simulations, and automate actions. AI capabilities such as Process Copilot, machine learning, predictions, and agent integration make process knowledge accessible through natural language and operational applications.Celonis

Industrialize enterprise AI. Make enterprise AI work.

8.1/10 KIFOX Score – Very good
Free Celonis Free Plan
An officially promoted free option designed to help you get started with the platform and for limited process mining applications. Current self-service availability may be restricted based on your account or region and should be verified in advance. Subscription Custom Celonis Subscription
Enterprise contracts are based on platform scope, data volume, applications, users, processes, and support requirements; there is no public standard price list. Other Celonis Process Intelligence Platform Data Core, process data model, process mining, analytics, action and business apps, and integrations.

Process Copilot Natural language queries, process analytics, charts, summaries, and context-aware insights.

AgentC Suite for building, connecting, orchestrating, and governing AI agents with process context.

AI API / Intelligence API Integration of Celonis process knowledge and Copilot features into external applications, communication platforms, and agent systems.

Marketplace and Business Apps Preconfigured applications and process solutions for finance, supply chain, procurement, sales, manufacturing, and other areas.

Premium and Premier Plus Support Extended support, service, and maintenance models for mission-critical installations.

Consulting and Partner Services Implementation, process modeling, data integration, consulting, and industry-specific solutions provided by Celonis and its partners.

Celonis Academy Training and certification programs for users, analysts, developers, and implementation teams.
– (0)

Link

GDPR: Yes Overall assessment: Well-suited for GDPR compliance, subject to specific implementation and data sources. Celonis SE is headquartered in Munich and publicly provides a Data Processing Agreement, Standard Contractual Clauses, technical and organizational measures, an Information Security Annex, and an up-to-date list of subprocessors. According to official documentation, the platform is certified to ISO 27001, ISO 27701, and ISO 9001; current SOC 1 Type 2 and SOC 2 Type 2 reports are available via the Trust Center.

A positive aspect is that, according to Celonis, data from European customers is generally hosted in a data center within the EU. Transmissions are secured with at least TLS 1.2, and stored data is encrypted with AES-256. Personal data is not strictly required for process analysis—with the exception of account and log data. If it is needed, Celonis offers pseudonymization features; pseudonymization can be performed on the local extractor prior to upload. A clear rule applies to AI functions: Celonis does not use customer data, prompts, inputs, or outputs itself, nor does it allow third parties to use them to create, train, or improve generative AI models, unless the customer expressly consents in writing. The AI features are optional and can be disabled. They are operated in the same region as the respective Celonis platform instance; for an EU instance, this means that the associated AI features and models are also hosted in the EU.

A negative aspect, or one requiring review, is that Celonis typically processes extensive ERP, financial, HR, supply chain, and event data. Depending on the use case, this may include employee, customer, or supplier data. The customer remains responsible for data minimization, legal basis, purpose limitation, and configuration.

Deletion: Data can be deleted upon request; audit log retention periods are configurable. The customer database is deleted by default within 30 days of contract termination.

Conclusion: Celonis offers a very strong foundation for GDPR and enterprise compliance. Key factors include data-minimal data modeling, pseudonymization prior to upload, role-based access controls, and a data protection impact assessment for employee or behavioral analytics.

security and data privacy

Link

“The World’s #1 AI Home Design Tool.”

HomeDesignsAI generates new designs for interiors, exteriors, gardens, and real estate presentations based on uploaded photos. Users select the room type, style, and scope of changes; the AI then generates visual variations. Additional features include virtual staging, material changes, furniture removal, room composition, and, in some cases, 2D-to-3D or video outputs.HomeDesignsAI

The World’s #1 AI Home Design Tool

6.0/10 KIFOX Score – Solid
Free Free trial designs Limited free credits or trial access for initial design creations; a fully-featured, permanently free plan is not clearly indicated. Subscription Individual Plan Monthly design quota, more than 40 styles and room types, interior, exterior, and garden design, color and texture changes, redesign, Fill Spaces, Furniture Finder, and Design Transfer.

Pro Plan Significantly higher design quota, more than 80 styles and room types, as well as expanded use of design and editing features. Other Universal Credits Shared credit balance for redesign, video, virtual staging, material swap, furniture removal, and other modules; additional credits can be added. Business Add-ons Advanced tools such as material swap, paint visualizer, and other professional design features. Additional professional features, including advanced room composition and more comprehensive design tools. White-Label Widget Embeddable design interface for websites and platforms, combining interior design with usage-based billing. API Custom usage-based model for integrating design features into your own products. Enterprise Custom agreement with higher volume and the option to exclude customer data from model training.
– (0)

Link

GDPR: Partly Overall assessment:
On the positive side, HomeDesignsAI provides a privacy policy that outlines users’ rights to access, rectify, erase, and transfer their data, as well as their rights to restrict processing and object to it. The provider states that it does not sell personal information, employs appropriate security measures, and deletes or anonymizes data once the purpose of processing no longer applies.

On the negative side, account data, device and usage data, as well as uploaded photos and generated designs, are processed. These images may contain interior spaces, personal belongings, individuals, security features, and sensitive information about living conditions. According to the privacy policy, international data transfers, including to the U.S., are possible. A publicly accessible GDPR DPA, EU Standard Contractual Clauses, a complete list of subprocessors, and a guaranteed EU data residency were not found: No verified information is available. The official API privacy policy is particularly concerning: Inputs and outputs may be used to improve the models. The policy explicitly states that only Enterprise customers have the option to opt out of model training. AWS and Google Cloud are mentioned among other infrastructure partners.

Server location: No specific hosting region publicly confirmed. The provider describes international data transfers and the use of global cloud providers.

Conclusion: For ordinary, non-confidential interior and garden design, HomeDesignsAI is a viable option. People, documents, family photos, alarm systems, and other private details should be removed before uploading. For commercial client projects, the Enterprise opt-out, DPA/AVV, data region, and deletion must be clarified in the contract.

Privacy Policy

Link

“The secure AI ecosystem to boost your creativity and productivity.”

Mindverse is a German all-in-one AI platform for text, research, images, audio, video, internal knowledge bases, assistants, and automated workflows. It provides various AI models through a single interface and is designed for individual users, teams, and businesses. Higher-tier plans enable custom agents, processes, integrations, and team management.Mindverse

The secure AI ecosystem to boost your creativity and productivity

7.7/10 KIFOX Score – Good
Free Trial Access / Start for Free Trial access with time or feature limitations; the current pricing page does not clearly indicate whether a permanent, free full plan is available. Subscription Content Suite Lite AI chatbot, text editor, document upload, and AI editing with a limited monthly request quota.

Content Suite Basic Text and image generation with an expanded request quota and limited AI image requests.

Content Suite Premium More extensive use with fair-use text generation and an increased image quota.

Content Suite Premium Plus Highest Content Suite quota, fair-use text generation, more images, and prioritized support.

Studio Starter AI chat, images, video, and Canva, unlimited internal knowledge, unlimited custom assistants, and Standard and Advanced models.

Studio Pro Starter features plus Expert and Sovereign models, custom agents, custom processes, and more than 500 integrations.

Studio Team Team sharing, role-based access, shared credit wallet, teams, and shared knowledge, assistants, agents, and processes. Other AI Credits Monthly credit for chat, models, images, videos, and other features; additional usage depends on the model.

Custom / Enterprise Custom AI environment with chat and voice bots, knowledge management, agents, workflows, API, integrations, branding, your own domain, and custom hosting.
– (0)

Link

GDPR: Yes Overall assessment: Mindverse is operated by Relativity GmbH in Berlin and has appointed an external data protection officer.

Positive aspects include development and hosting in Germany, a commitment not to train on customer data, encryption, MFA, role-based access, vulnerability assessments, and the option to request a data processing agreement. According to the provider, enterprise customers can receive a dedicated and logically or physically isolated LLM instance. Mindverse specifies processing in Germany or the EU for various language models, including offerings from OpenAI, Google, and Anthropic, as well as independently operated models such as GPT OSS and DeepSeek. For image and video models, however, providers with global processing may also be involved. The specific data protection assessment therefore depends on the selected model and the activated feature.

A negative aspect is that the website and individual services utilize various external providers, including analytics, payment, video, security, and marketing services. The privacy policy lists, among others, AWS, Google, Cloudflare, Webflow, Vimeo, Stripe, Hotjar, and Microsoft. International data transfers may occur in this context. A complete, publicly accessible list of product sub-processors, a directly accessible DPA, and uniform retention periods for all prompts and uploads were not found: No verified information available.

Server location: According to Mindverse, the core platform and sovereign models are operated in Germany. Other models may be processed in Germany, the EU, or—particularly in the case of selected media models—globally.

Conclusion: Mindverse is generally well-suited for German companies. For data protection-critical use, only approved sovereign/DE models should be used, the T&C should be concluded, external media models should be restricted, and deletion, role, and integration rules should be documented.

Privacy Policy

Ethical Principles

Link

“Engineering-Grade Agentic AI for Electrical Design Calculations.”

ELEK is a suite of professional calculation programs for electrical power systems. It covers, among other things, low-voltage cables, high-voltage cables, grounding systems, cable pulling, protection coordination, and other electrical engineering calculations. ELEK AI enhances selected applications with natural language, agent-based support and automated data extraction.ELEK AI

Engineering-Grade Agentic AI for Electrical Design Calculations

6.6/10 KIFOX Score – Solid
Free ELEK AI offers a free plan with a limited number of monthly credits. In addition, there are free calculators and trial options available. The full professional engineering products are not offered as permanently free full versions. An active, compatible product is required for AI calculations. Subscription ELEK AI Individual Personal access with a regular AI credit allowance for one person.

ELEK AI Team Shared credit allowance for multiple employees.

Cable Pro Web Cloud-based license with monthly or annual renewal. Other AI Credit Top-ups One-time additional credit packages; active subscription required.

PC Software Licenses Licenses for Cable High Voltage, SafeGrid, Cable Pulling, Protection Coordination, and Line Rate.

SELEK Power Bundle Bundle of multiple programs for electrical networks, cables, grounding, and protection calculations.

Network License Shared use of selected PC packages in larger or distributed teams.

Updates and Support Optional maintenance, update, and support services for PC software after the first year of licensing.
– (0)

Link

GDPR: Partly Overall Assessment:
A positive aspect is that ELEK has published a globally applicable privacy policy that explicitly addresses the GDPR, Australian Privacy Principles, and other international regulations. The company designates a data protection contact, a DPO, and an EU contact person. Third-party providers are required to enter into Data Processing Agreements.

For ELEK AI, the provider explicitly states that third-party AI services are not permitted to use project data for model training. Project inputs and calculation results must remain within the controlled ELEK software environment.

A negative aspect is that ELEK Software is based in Sydney, Australia, and uses third-party providers outside of Australia and the EEA. According to the Security Policy, the primary cloud location is at AWS in Sydney. No EU data residency is specified. ELEK merely states that it adheres to ISO/IEC 27001 principles; this does not constitute proof of ISO 27001 certification.

Deletion: Users can modify, export, or delete data. Following a request to close an account, cloud user data is to be deleted within 90 days.

DPA: According to its own policy, ELEK requires DPAs from its service providers. No public DPA for customers was found: No verified information available.

Conclusion: For EU companies, local PC software is more privacy-friendly than Cable Pro Web or other cloud features. When using cloud and AI services, international data transfers, data processing agreements, AWS regions, and retention periods should be documented.

Privacy Policy

Link