Find Your Tool in 6 Steps
Result: 158

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps
Results: 158
Research Images Video Music Agent Business Marketing Website API

"Multiplayer AI for human-agent collaboration."

Dust is an enterprise platform for AI agents, internal knowledge search, and teamwork. Teams connect data sources, tools, conversations, and company knowledge with agents that can research, analyze, write, and execute workflows.Dust

Multiplayer AI for human-agent collaboration.

7.3/10 Good
Free Free basic version
Limited workspace for initial agents, conversations, and tests Subscription Pro Pro usage for individuals and team members with a higher agent and credit quota.

Max Higher usage capacities for intensive agent and tool usage. Other Enterprise Custom offering with governance, connectors, security features, SSO, SCIM, and enterprise support.

Programmatic Usage Separately billed API and workflow usage for automated agent calls.

Connectors Connection of data sources such as Slack, Notion, Google Drive, GitHub, Salesforce, Microsoft 365, and other systems.
– (0)

Link

GDPR: Partly Dust documents several building blocks on its own website that are relevant for the GDPR in the EU/EEA area: a platform privacy policy based in France, references to GDPR compliance, an EU hosting option for enterprise customers, EU routes under 'eu.dust.tt', DPA/contract references via the documentation, as well as statements that customer data is not used for model training. However, the documentation is not strong enough for fully straightforward GDPR use throughout the entire EU/EEA, because EU data residency is only mentioned as an option for Enterprise, the standard SaaS variant is not clearly described as EU-resident, and a clearly linked AVV/DPA text or a standalone subprocessors overview on the website could not be found unambiguously. Therefore, GDPR-compliant use is plausible under conditions, especially via the Enterprise/EU hosting option.
Positive
Positive aspects include the provider's EU connection with an address in Paris, the explicit references to 'GDPR Compliant', the available EU hosting option, documented EU routes under 'eu.dust.tt', statements about 'no model training' and 'Zero Data Retention' with model providers, as well as the mention of SOC 2 Type II.
Negative
Negative or limiting is that the website does not provide a clearly complete, easily findable DPA/AVV page and no clearly named subprocessors list with locations. In addition, according to the website, EU data residency is only explicitly available for Enterprise; for standard SaaS use, the server location is not documented consistently and unambiguously. An on-prem/self-hosting option is not stated on the website.
Server location
The website mentions an EU hosting option. On the changelog page, it states that since February 7, 2025, there has been a data hosting option on European servers, exclusively for enterprise customers, for databases, files, and vectors. In the Snowflake documentation, EU routes with 'https://eu.dust.tt' are also mentioned. A specific country/data center is not consistently stated on the reviewed pages; in a blog post, servers in the EU or Frankfurt are mentioned as examples, but no generally binding standard server location for all plans is specified.

Link

“Transform your business with modern, AI-first applications.”

Microsoft Power Apps is a low-code platform for creating and deploying business applications.

The product primarily supports canvas apps and model-driven apps, can be used with little or no code, and can also be extended through custom code, components, and integrations. Typical use cases include internal line-of-business applications, mobile data capture, process-oriented business apps, and app-supported workflows based on Dataverse, Microsoft 365, and other data sources.MS Power Apps

Transform your business with modern, AI-first applications

7.4/10 Good
Free Free developer account for building and testing unlimited apps/flows, multiple developer environments, connectors, Dataverse entitlement, and limited flow runs. Subscription Power Apps Premium User license for unlimited Power Apps and Power Pages, prebuilt/custom/on-premises connectors, Dataverse entitlements, and agentic features in apps.

Power Apps Premium with minimum purchase requirement For large organizations with many users; same core features with enterprise procurement. Other Pay-as-you-go via Azure Usage-based billing for apps, Dataverse storage, and Power Platform meters via Azure Subscription.

Dataverse / AI Builder / Power Platform Add-ons Additional capacities, AI Builder, Dataverse Storage, Power Automate, and other Power Platform extensions per usage.

Per-app license No longer available for new customers since January 2, 2026; existing customers must check status and renewal.
– (0)

Link

GDPR: Partly From the perspective of a user in Europe, using MS Power Apps in compliance with the GDPR is generally possible, but it depends on specific configurations and contractual arrangements. The Microsoft website provides a DPA, information on subprocessors, data residency options for Power Platform, and the EU Data Boundary for Power Platform. At the same time, Microsoft itself points out that data can be replicated within a selected geo, that certain user actions may expose data outside the geo, and that classification within the EU Data Boundary depends on tenant and environment deployment.
Positive
Positive aspects include the published Microsoft Products and Services Data Protection Addendum (AVV/DPA), the documented subprocessor structure, the ability to choose a data location or geo for Power Platform, the EU Data Boundary for Power Platform, and documented data subject rights and export functions. For Copilot/AI features, Microsoft also documents that customer data is not used to train Microsoft or third-party models unless the customer opts in to data sharing.
Negative
A negative or limiting aspect is that GDPR-compliant use does not automatically follow from standard use. Microsoft itself describes limited exceptions for transfers outside the EU Data Boundary, the dependency on billing address, tenant geo, and environment deployment, as well as the possibility that users or connected services may expose data outside the geo. The website does not specify whether Power Apps is available as a fully local deployment as a complete product.
Server Location
Microsoft lists several global data centers and geographic locations for the Power Platform. For EU/EEA-relevant use, Microsoft specifies the EU Data Boundary with data centers in EU and EFTA countries, including Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, the Netherlands, Norway, Poland, Spain, Sweden, and Switzerland. According to the website, the specific assignment for Dynamics 365 and Power Platform depends on the billing address as well as the deployment of the tenant and all environments within a geo location inside the EU Data Boundary.

Link

"Always the best, without switching tools."

Bolt is an AI-powered builder for websites, web apps, and mobile apps. Users describe their project via prompt, and Bolt generates a working project from it in a short time.

In addition, Bolt bundles Bolt Cloud Hosting, databases, domains, authentication, file storage, analytics, and Edge Functions directly in the interface.Bolt.new

Always the best, without switching tools

6.3/10 Solid
Free Free entry point for building initial projects with limited token/usage scope. Subscription Pro / individual plans More tokens, private projects, website hosting, no Bolt branding, private sharing features, file uploads, custom domains, SEO features, databases, and AI image editing.

Teams For teams with collaborative work, higher limits, and team-oriented usage. Other Enterprise Custom offering for organizations with advanced requirements.

bolt.diy Official open-source version for local/self-hosted use with your own LLM providers such as OpenAI, Anthropic, Ollama, Gemini, Mistral, xAI, DeepSeek, Bedrock, and others.
– (0)

Link

GDPR: Partly For the EU/EEA region, GDPR-compliant use is plausible only under certain conditions. Positive aspects include the enterprise options listed on the website for deployment in a user’s own AWS/Azure tenant with full infrastructure isolation, as well as the statement that code and prompts do not leave the user’s own infrastructure. However, for standard SaaS/Bolt Cloud usage, the website lacks essential, reliable information regarding EU data residency, specific server locations within the EU/EEA, the Data Processing Agreement (DPA), and subprocessors. Therefore, there is no verifiable, fully clear GDPR approval for standard use; the best-documented option is the Enterprise/BYOK variant.
Positive
The website mentions BYOK deployment or deployment within the user’s own AWS/Azure tenant, full infrastructure isolation without shared compute, the statement “Your code and prompts never leave your infrastructure,” and SOC 2 information. In addition, the Trust page describes client-side execution as a security feature.
Negative
The website does not specify any concrete EU/EEA server locations for the standard service. Also missing are a privacy policy, an AVV/DPA, a list of subprocessors, an explicit EU data residency for Bolt Cloud, and a clear, contractually documented no-training/opt-out rule for standard use. The support documentation also mentions external platforms such as Netlify and Supabase as the basis for Bolt Cloud.
Server Location
Not specified on the website. For Bolt Cloud, only “secure, high-performance servers” and partner platforms such as Netlify and Supabase are mentioned. A specific EU/EEA data center location or a binding EU data residency requirement is not mentioned on the pages found. For Enterprise, deployment within the customer’s own AWS/Azure tenant is described; the specific location there apparently depends on the customer’s target environment.

Link

“A platform for all your company’s knowledge—search, assistant, agents.”

amber connects internal corporate systems and makes their content accessible via a central AI search. amberAI answers questions based on internal data and cites the sources used. amberAgents automates recurring, multi-step tasks and can trigger actions in other systems via interfaces.amber

A platform for all your company's knowledge – Search, Assistant, Agents

7.5/10 Good
Subscription SmartWebsite Basic Domain, SSL certificate, email accounts, limited website size, and AI website generator.

SmartWebsite Plus Basic features plus significantly more subpages, AI text generator and optimizer, AI SEO assistant, and marketingRadar.

SmartWebsite Pro Plus features, larger page quota, and rankingCoach for advanced search engine optimization.


Smart AI Phone Assistant Unlimited AI phone service with monthly cancellation option, featuring unlimited calls, call forwarding, appointment scheduling, and advanced API integration. Other AI Email Assistant Optional add-on for STRATO plans that include an email account; features drafts, summaries, replies, rephrasing, and translations.

WordPress Hosting with AI Setup WordPress hosting with AI-powered initial setup of websites and content.



SmartWebshop E-commerce packages with website/shop creation and integrated AI support for setup and content.

V-Server for LLM Hosting Virtual servers for independent operation of small and medium-sized open-source language models.

Dedicated Servers for LLM Hosting Dedicated hardware for larger models, custom AI services, agents, and controlled enterprise applications.

OpenClaw and n8n Hosting Server offerings for self-hosted AI agents and workflow automations.
– (0)

Link

GDPR: Yes The website demonstrates, for the best available user experience, a generally clear alignment with the GDPR for EU/EEA users: amber describes itself as “EU data protection compliant,” mentions “Privacy by Design & Default,” incident reporting in accordance with GDPR Articles 33 and 34, DPA documentation, hosting in Germany, and the statement that interactions are not used to improve AI models without explicit consent. For the European region, Germany as a server location within the EU/EEA is a positive factor. Limitation: A complete list of subprocessors available on the website or publicly accessible detailed documentation regarding the AVV/DPA is not provided on the website; therefore, the assessment is based on the provider’s explicit product and security statements.
Positive
Confirmed positives include hosting and processing in Germany, T Cloud data centers in Germany with virtual network isolation per customer, ISO 27001 and other mentioned security standards, a reference to the AVV/DPA, Privacy by Design, deletion upon request, and an explicit opt-in for training rather than use without consent.
Negative
A negative or incomplete aspect is that the website does not provide a freely accessible list of subprocessors or links to fully publicly available AVV/DPA details. Likewise, there is no explicit description of EU data residency outside of Germany; Germany is primarily specified. On-premises/self-hosting of the amber product itself is not clearly offered on the website.
Server Location
The website states on multiple occasions that development and processing steps take place on servers in Germany and that the platform and index run in T Cloud data centers in Germany. In the context of the EU/EEA, Germany falls within the relevant legal jurisdiction.

Link

Alibaba Cloud Qwen is Alibaba Cloud's LLM/multimodal model family. Through Model Studio / DashScope, developers can use Qwen models via API, including text models, multimodal models, reasoning models, coding models, translation models, and open-source/open-weight variants. The API is OpenAI-compatible and can be used via different endpoints depending on the region.Alibaba Cloud Qwen API

LLM “one-stop model service platform”,

7.2/10 Good
Free Free quotas for certain models/regions; Free Quota applies only to real-time inference and not to batch calls, context cache, fine-tuning, deployment, or custom models. Other Pay-as-you-go / Model Invocation Usage-based billing by model, input/output tokens, thinking/non-thinking mode, region, and deployment mode.

Batch Calls Separate processing of large workloads; not covered by the Free Quota.

Context Cache Cache function to reduce repeated context costs; not covered by the Free Quota.

Fine-Tuning / Deployment / Custom Models Model customization and deployment of proprietary or fine-tuned models; billed separately and not covered by the Free Quota.

OpenAI-/Responses-compatible API Qwen models support OpenAI-compatible interfaces and the Responses API for agentic applications.
– (0)

Link

GDPR: Partly For use within the EU/EEA, the provider’s website offers clear building blocks for a configuration that may be more GDPR-compliant: Model Studio offers an explicit “European Union” deployment mode, in which data storage is tied to the Germany (Frankfurt) region and, according to the documentation, inference is limited to the EU. In addition, there is a published privacy policy and a Data Processing Addendum referencing the GDPR and EU Standard Contractual Clauses. At the same time, the documentation is not robust enough to warrant a fully positive assessment: A verifiable list of subprocessors was not found on the website; no explicit ISO 27001 certification for Model Studio was documented on the pages reviewed; and, according to the product pages reviewed, the service does not offer a clearly documented on-premises/self-hosting option for the commercial API. Therefore, “conditional” seems to be the most appropriate rating for the entire EU/EEA region.
Positive
Positive aspects include a separate privacy policy for Alibaba Cloud International, a published DPA, an explicit EU deployment mode for Model Studio with data storage in Germany (Frankfurt) and EU-restricted inference, as well as the statement that customer data is not used for model training. Additionally, the product documentation mentions SOC 2 for Model Studio and specifies that no conversation data is stored during direct API calls.
Negative
A negative or limiting aspect is that, while cross-border processing is addressed in the privacy and product documentation, no reliable subpage with a list was found on the website for the specific point of interest, “subprocessors.” For the Assistant API path, the documentation also mentions that conversation history is stored with no current expiration date. A clear on-premises/self-hosting option for the commercial API was not specified on the website.
Server Location
The website specifies for the “European Union” deployment mode that the associated data region is Germany (Frankfurt) and that model inference is limited to the EU. The model and pricing documentation also states that, in EU mode, endpoints and data storage are located in Germany (Frankfurt). For Global/International, however, cross-border computing paths are described.

Link

"Building AI to Simulate the World"

Runway is an AI platform for generative media production with a focus on AI video, image generation, video editing, performance capture, audio/voice features, workflows, and API access.

The tool is aimed at creators, marketing teams, film/media production, agencies, developers, and companies that want to create or edit visual content with AI.Runway

Building AI to Simulate the World

6.9/10 Solid
Free Free entry with a one-time credit allocation; suitable for testing and for initial generations. Subscription Standard More monthly credits, access to core Runway apps and generative video/image features; for individuals and small teams.

Pro More credits, access to all apps, workflows, generative video models, third-party models, more storage, and advanced creative features.

Unlimited Everything in Pro plus Explore Mode for unlimited image and video generations at a relaxed speed; additionally, monthly credits for features without Explore Mode. Other Enterprise Custom enterprise offering with SSO, custom credits, configurable organization and team spaces, Advanced Security, onboarding, success program, and priority support.

Credits / Additional Credits Runway uses credits for many generation features; additional credits are available for paid plans.
– (0)

Link

GDPR: Partly For users in the EU/EEA, GDPR-compliant use of Runway is only partially demonstrable. Positive aspects include a published privacy policy with a section for the EEA, an expressly incorporated DPA for Enterprise customers, a published subprocessor reference, SOC 2 Type II evidence, as well as contractual assurances for Enterprise customers that 'Customer Content' is not used as training data. Negative aspects are that the website does not specify EU data residency or concrete EU/EEA data center locations for standard SaaS use, while the privacy policy expressly refers to transfers to the USA and other countries. This means that privacy-compliant use appears more feasible via the Enterprise route with a DPA and contractual safeguards, but not clearly and straightforwardly for all usage variants.
Positive
The website includes a privacy policy with EEA relevance, a DPA incorporated into the Enterprise terms, a reference to subprocessors, SOC 2 Type II, private default visibility for uploaded assets, and for Enterprise the contractual statement that 'Customer Content' may not be used as training data for the services. In addition, Enterprise admins can disable third-party models; according to the FAQ, Runway then does not send any data to these model providers.
Negative
No concrete EU/EEA server location is specified on the website. EU data residency is not stated. The privacy policy expressly mentions international transfers to the USA and other countries. On-premise, self-hosting, or local operating options are not specified on the website. An ISO 27001 certification is not stated; it is only described that elements from ISO 27001 and NIST are incorporated into the security program.
Server location
Not specifically stated on the website. Several physically separate data centers are mentioned for redundancy, but without specifying countries or regions. The privacy policy also states that Runway is based in the USA and that information may be transferred to the USA and other countries.

Link

“The World’s #1 AI Home Design Tool.”

HomeDesignsAI generates new designs for interiors, exteriors, gardens, and real estate presentations based on uploaded photos. Users select the room type, style, and scope of changes; the AI then generates visual variations. Additional features include virtual staging, material changes, furniture removal, room composition, and, in some cases, 2D-to-3D or video outputs.HomeDesignsAI

The World’s #1 AI Home Design Tool

4.1/10 Limited
Free Free trial designs Limited free credits or trial access for initial design creations; a fully-featured, permanently free plan is not clearly indicated. Subscription Individual Plan Monthly design quota, more than 40 styles and room types, interior, exterior, and garden design, color and texture changes, redesign, Fill Spaces, Furniture Finder, and Design Transfer.

Pro Plan Significantly higher design quota, more than 80 styles and room types, as well as expanded use of design and editing features. Other Universal Credits Shared credit balance for redesign, video, virtual staging, material swap, furniture removal, and other modules; additional credits can be added. Business Add-ons Advanced tools such as material swap, paint visualizer, and other professional design features. Additional professional features, including advanced room composition and more comprehensive design tools. White-Label Widget Embeddable design interface for websites and platforms, combining interior design with usage-based billing. API Custom usage-based model for integrating design features into your own products. Enterprise Custom agreement with higher volume and the option to exclude customer data from model training.
– (0)

Link

GDPR: Unclear For the EU/EEA region, it is not clearly demonstrable based on the website documentation that the service is used in compliance with the GDPR. Positive aspects include a general privacy policy, the mention of data subjects’ rights, and an API/Enterprise notice regarding an enterprise opt-out for model training. On the negative side, the website mentions international data transfers, including to the U.S., but does not specify a concrete EU/EEA server location, EU data residency, a publicly accessible Data Processing Agreement (DPA), or a list of subprocessors. As a result, the legal and hosting situation is insufficiently documented for users in Europe.
Positive
The website includes a privacy policy with information on the data collected, data subject rights, and international data transfers. The API/Enterprise documentation mentions security measures such as AES-256 and SSL/TLS. Additionally, the API documentation specifies an Enterprise opt-out for the use of data in model training.
Negative
The website explicitly states that personal data may also be processed outside the user’s country of residence, including the United States. No specific server location or EU/EEA data center is mentioned. A publicly available Data Processing Agreement (DPA), a list of subprocessors, binding statements regarding EU data residency, and on-premises/self-hosting options are not provided on the website. Regarding the API, it also states that inputs and outputs can be used for training by default, unless a specific “Enterprise Privacy” plan applies.
Server Location
Not specifically stated on the website. The general privacy policy mentions international data transfers, including to the U.S. The API privacy policy lists AWS and Google Cloud as examples of cloud hosting providers, but without specifying a region or data center location.

Link

“The freedom AI stack.”

Open WebUI is a self-hosted AI portal for teams and organizations. The platform connects local or external LLMs with team chat, RAG, document knowledge, tools, MCP, role-based permissions, and integrations.Open WebUI

The freedom AI stack.

7.5/10 Good
Free Community Edition
Free self-hosted AI portal with chat, RAG, local models, cloud models, tools, and team use. Other Enterprise Custom enterprise support, architecture consulting, scaling, SSO, governance, and professional support.

Self-hosting Costs for servers, GPU, storage, databases, backups, and operations.

External model providers Usage costs for OpenAI, Anthropic, Azure, Bedrock, or other model providers.

License notice Current components are available under multiple licensing models; for larger deployments, branding requirements of the current Open-WebUI license apply.
– (0)

Link

GDPR: Yes Open WebUI documents on its own website a clear self-hosting/on-premise path, including private cloud, air-gapped, and hybrid operation. For users in the EU/EEA, this provides a straightforward path to GDPR-compliant use, because according to the documentation, data processing can take place within their own infrastructure and the operator determines where data is physically located. At the same time, the website also makes it clear that compliance responsibility lies with the deploying company; a blanket GDPR commitment for a provider SaaS is not evident on the website.
Positive
Positively documented are self-hosting, on-premise, private cloud, air-gapped and hybrid deployment, as well as control over data residency. The website explicitly states that data remains in the organization's own infrastructure by default, provided no external model providers are configured, and that organizations themselves can determine where data is physically stored. In addition, a publicly auditable codebase is described.
Negative
Negative or limiting is that the website does not appear to provide its own privacy policy, no AVV/DPA, no subprocessor list, no specific EU data center indication for a provider-operated service, and no contractual statement excluding model training. The documentation also emphasizes that compliance certifications and regulatory obligations for the specific deployment lie with the operating organization.
Server location
No specific provider server location is stated on the website. Instead, the documentation for self-hosting and private cloud describes that the operator chooses the physical storage location of the data and that the data remains in the organization's own infrastructure by default. EU/EEA data residency is therefore possible via own deployment, but no provider-designated EU data center is stated on the website.

Link