Data protection
AI tools and the GDPR: what a small business in the EU should check
Before customer data goes into an AI tool: where it is processed, whether the vendor signs a DPA, transfer safeguards and model training — compared for Chatbase, Sintra, Submagic and Taskade.
Updated 14 Oct 2026
An AI tool that answers your customers, writes to them or stores their projects processes personal data on your behalf. Under the GDPR you remain responsible for it. Five questions tell you whether a tool can be used for that at all — and the answers are in the vendor’s own documents, not in its marketing. This guide explains what to look for; it is not legal advice.
Question 1: Does the vendor sign a data-processing agreement?
When a provider processes personal data for you, Article 28 GDPR requires a contract that binds it to your instructions — the data-processing agreement, or DPA. Without one, customer data does not belong in the tool. Look for a page called “DPA” or “Data Processing Addendum”, usually linked from the privacy policy or the footer.
Question 2: Where is the data processed?
Processing outside the EU is allowed, but it needs a legal basis for the transfer: an adequacy decision (for the USA, a vendor certified under the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses (SCCs). The privacy policy or the DPA names the location and the safeguard.
Question 3: Is your data used to train AI models?
Good vendors say plainly that customer content is not used to train models, and that the AI providers they use are bound to the same.
Question 4: Who are the sub-processors?
Most AI tools pass your data on to model providers (OpenAI, Anthropic, Google and others) and to hosting companies. A published sub-processor list, with notice before it changes, lets you see — and object to — who else handles your data.
Question 5: What happens to the data when you leave?
Check how long data is kept after cancellation and whether you can delete or export it.
How the four reviewed tools compare
| Checked | Chatbase | Sintra AI | Submagic | Taskade |
|---|---|---|---|---|
| Company | Chatbase Inc., USA | playOS, Inc., USA | TURBO STUDIO S.A.S., Paris | Taskcade Inc., USA |
| Processing | USA (AWS) | USA “and other countries” | Servers in the USA | USA (AWS US-East) |
| DPA for customers | Yes, applies automatically | Not documented | Not documented | Explicitly not offered |
| Transfer safeguard | SCCs in the DPA | SCCs named in the privacy policy | SCCs | None offered to customers |
| Training on your data | No, regardless of plan | AI providers may not train on personal data | Not addressed | Providers contractually barred; no guarantee given |
Sources: each vendor’s privacy policy, DPA and security page, checked on 13 October 2026 — linked at the end of each review.
What this means in practice
- Chatbase is the only one of the four with a DPA and SCCs in place, so a support bot trained on your help pages is workable — provided your privacy policy names it. See the Chatbase review.
- Sintra AI documents no customer DPA. Use it for marketing drafts and social posts, not for customer records. See the Sintra review.
- Submagic is an EU company, but its servers are in the USA and a customer DPA is not documented. Fine for your own marketing videos; ask before uploading recordings of customers. See the Submagic review.
- Taskade states in its privacy policy that it does not sign a DPA or SCCs. Keep customer personal data out of it. See the Taskade review.
A short checklist
- Will personal data of customers or employees go into the tool? If not, most of this does not apply.
- Is there a DPA, and does it apply to your plan?
- Where is the data processed, and on which legal basis is it transferred?
- Is customer content excluded from model training?
- Is there a sub-processor list?
- Is the tool named in your own privacy policy?
When in doubt, ask the vendor in writing and keep the answer. If you handle sensitive data, talk to a data-protection adviser before you sign up.