Google Gemini vs. Grok: data protection per plan

not publicly documented (Hub names the Google Terms of Service and Generative AI Prohibited Use Policy; no DPA mentioned, q1)

no for Unpaid Services (according to q3, the DPA applies to Paid Services); special case EEA/Switzerland/UK see details

not publicly documented (Hub names the Google Terms of Service and Generative AI Prohibited Use Policy; no DPA mentioned, q1)

yes (Cloud Data Processing Addendum; according to q2, the Gemini app is a Core Service for most Workspace editions)

yes (Cloud Data Processing Addendum; according to q2, the Gemini app is a Core Service for most Workspace editions)

yes (Cloud Data Processing Addendum, q2)

yes (Cloud Data Processing Addendum; according to q2, the Gemini app is a Core Service for most Workspace editions)

yes (Cloud Data Processing Addendum, q2)

yes ("Data Processing Addendum for Products Where Google is a Data Processor", q3)

yes (Cloud Data Processing Addendum, Google Cloud)

no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms)

no (DPA is part of the Enterprise terms for business customers; consumer use is subject to the Consumer terms)

yes: Enterprise FAQ: 'if you submit personal data to our Services, our Data Processing Addendum (DPA) applies and is automatically incorporated into our Enterprise Terms of Service'; the Grok Business guide refers, for team workspaces, to the 'Terms of Service - Enterprise', which according to their preamble also apply to purchases by 'online purchase confirmation'. The DPA (effective 2026-09-22) provides for the processing of personal data only via the ZDR API.

yes: Data Processing Addendum (effective 2026-09-22) is part of the Enterprise terms for business services; the DPA provides for the processing of personal data only via the ZDR API.

yes: Data Processing Addendum (effective 2026-09-22) is part of the 'Terms of Service - Enterprise', which according to a notice apply to business customers of the API and other business services; SCCs Module Two/Three. The DPA requires personal data to be processed only via the ZDR API; no personal data is to be transmitted to non-ZDR services.

yes: Data Processing Addendum (effective 2026-09-22) as part of the Enterprise terms; the DPA expressly provides for the processing of personal data only via the ZDR API. SCCs Module Two/Three (Irish law).

"Google uses your activity to provide, develop, and improve its services (including training generative AI models), as well as to protect Google, its users, and the public with the help of human reviewers." (Keep Activity on). Can be switched off via "Keep Activity"; temporary chats are not used for improvement with human reviewers (q1). A difference between Free, Plus, Pro and Ultra is not documented in the Hub (same privacy notice for "Gemini Apps").

"When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products ... human reviewers may read, annotate, and process your API input and output." However: "If you're in the European Economic Area, Switzerland, or the United Kingdom, the terms under 'How Google uses Your Data' in 'Paid Services' apply to all Services, including Google AI Studio and unpaid quota in the Gemini API" (q3). Pricing page: "Used to improve our products: Yes" in the Free Tier (q8).

"Google uses your activity to provide, develop, and improve its services (including training generative AI models), as well as to protect Google, its users, and the public with the help of human reviewers." (Keep Activity on). Can be switched off via "Keep Activity"; temporary chats are not used for improvement with human reviewers (q1). A difference between Free, Plus, Pro and Ultra is not documented in the Hub (same privacy notice for "Gemini Apps").

"Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." (q2). Gemini app: "Your chats and uploaded files won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." (q2)

"Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." (q2). Gemini app: "Your chats and uploaded files won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." (q2)

As Workspace Business: "Your chats and uploaded files won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." (q2, applies to "business, education, and public sector customers")

"Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." (q2). Gemini app: "Your chats and uploaded files won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." (q2)

As Workspace Business: "Your chats and uploaded files won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without your permission." (q2, applies to "business, education, and public sector customers")

"When you use Paid Services, ... Google doesn't use your prompts (including associated system instructions, cached content, and files ...) or responses to improve our products, and will process your prompts and responses in accordance with the Data Processing Addendum for Products Where Google is a Data Processor." (q3). Pricing page: "Used to improve our products: No" (q8).

"Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform" (q4).

Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'.

Privacy policy (as of 2026-10-11) and Europe Addendum (effective 2026-08-24): User Content and feedback are used for training and improving the models on the basis of legitimate interests; objection possible in the settings (reference to the Consumer FAQ). Security FAQ: 'improve the model' toggle in the data controls. Training summary Grok 4.7: interactions with Grok may be used for training 'subject to privacy settings, controls, user requests, opt-outs'.

Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide (as of 2026-10-10): team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service' (link to the Enterprise terms). Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train.

Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'; SpaceXSI may use de-identified or aggregated data except with ZDR. Business guide: team workspaces with 'Privacy guarantees as outlined in SpaceXSI's terms of service'. Enterprise FAQ: 'we do not use your business data, including inputs (prompts) or outputs (answers), for training our models'; in some cases SpaceXSI offers free credits in exchange for permission to train.

API documentation (Security FAQ): 'SpaceXSI never trains on your API inputs or outputs without your explicit permission.' Enterprise terms (as of 2026-08-14): SpaceXSI does not use User Content to train foundation models, LLMs or other AI systems, 'subject to disclosures to Customer and Customer-controlled user settings'. Except with ZDR, SpaceXSI may use de-identified or aggregated data for any lawful purposes.

API documentation (Security FAQ): 'SpaceXSI never trains on your API inputs or outputs without your explicit permission.' Enterprise terms: no training on User Content; with ZDR also no creation of de-identified data. With ZDR the 30-day storage does not apply; inputs and outputs are not written to disk. The documentation points out that ZDR is not recommended for most customers.

Google Privacy Policy (Effective 2026-10-12), section Data transfers: "We maintain servers around the world and your information may be processed on servers located outside of the country where you live." A Gemini-specific statement on location or a choice of region is not documented in the Gemini Apps Privacy Hub (q1). Provider: Google Ireland Limited in the EEA and Switzerland, otherwise Google LLC.

not publicly documented for Unpaid Services (for Paid Services, q3 states storage/caching "in any country in which Google or its agents maintain facilities").

Google Privacy Policy (Effective 2026-10-12), section Data transfers: "We maintain servers around the world and your information may be processed on servers located outside of the country where you live." A Gemini-specific statement on location or a choice of region is not documented in the Gemini Apps Privacy Hub (q1). Provider: Google Ireland Limited in the EEA and Switzerland, otherwise Google LLC.

not publicly documented: Workspace Admin Help "Data covered by data regions" (as of 2026-10-09) does not list Business Starter among the editions with Data Regions, so a choice of region is not available; the page does not state a storage location without a Data Regions policy (q14).

Workspace Admin Help "Data covered by data regions" (as of 2026-10-09): prompts and responses of the "Gemini app" and of "Google Workspace with Gemini" are covered data; region USA or Europe. Business Standard and Business Plus include Fundamental Data Regions: only storage (at rest) is in the selected region; processing "in use" (i.e. including Gemini processing) is not covered; this is only provided by Enterprise Data Regions (Enterprise Plus or add-on). Excluded: Gemini Notebook as well as logs and cached content (q14; likewise q2 on Gemini Notebook).

Workspace Admin Help "Data covered by data regions" (as of 2026-10-09): Education Fundamentals is not supported by Data Regions (q14); a storage location for this edition is not otherwise documented.

Workspace Admin Help "Data covered by data regions" (as of 2026-10-09): prompts and responses of the "Gemini app" and of "Google Workspace with Gemini" are covered data; region USA or Europe. Enterprise Starter and Enterprise Standard: Fundamental Data Regions (storage at rest); Enterprise Plus: Enterprise Data Regions, which also cover processing "in use" (alternatively add-on or Assured Controls). Excluded: Gemini Notebook as well as logs and cached content (q14; likewise q2 on Gemini Notebook).

Workspace Admin Help "Data covered by data regions" (as of 2026-10-09): Education Standard and Education Plus include "Data Regions for Education". This covers prompts and responses of the Gemini app and of Google Workspace with Gemini at rest (region USA or Europe), but not processing "in use" (q14). Not separately reviewed for public sector editions.

"This data may be stored transiently or cached in any country in which Google or its agents maintain facilities." (q3). An EU data residency option for the Gemini Developer API is not documented in q3.

Via jurisdictional multi-region endpoints (e.g. EU), ML processing remains in the region; data at rest remains at the selected location; the EU endpoint covers only EU Member States, not the UK/Switzerland; global endpoints are separate (q5).

Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.'

Europe Addendum (13.3): 'We process all of your personal information in the United States, where we maintain our primary data centers.'

The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. The pricing page mentions data residency only in the Enterprise section; EU region not documented.

The privacy policy does not apply to data processed for business customers. DPA (q10): processing 'on a global basis outside Europe', including in the USA; sub-processors in the US, one subsidiary in the UK. Pricing page (Enterprise): 'Data residency: Control where your data lives' without a region specified; EU region not documented.

Regions documentation (q3): the standard endpoint api.x.ai does not guarantee a processing region; requests may be routed between regions. Optional US endpoint us.api.x.ai: request handling, inference, moderation and stored request data in the USA (only grok-4.7 and grok-4.6, without image, video and voice APIs; Files, Collections and server-side tools may be processed outside the USA; token prices +10 %). DPA (q10): processing 'on a global basis outside Europe', including in the USA. Sub-processors in the US, one subsidiary in the UK. An EU region is not documented.

As API: global endpoint without a region guarantee, US endpoint optional (ZDR also applies there). No EU region documented.

• not publicly documented (Hub names "Google's trained service providers" as human reviewers, q1; no list)

• not publicly documented

• not publicly documented (Hub names "Google's trained service providers" as human reviewers, q1; no list)

• Workspace sub-processor list (as of 2026-10-19, q7): no Gemini-specific entries; Gemini, as a Core Service, falls under the entries for "All Google Workspace Core Services and Cloud Identity Services" (activities Technical Support, Data Center Operations, Security Risk Detection, Service Maintenance; third parties and Google group companies with countries of processing): https://workspace.google.com/terms/subprocessors/

• Workspace sub-processor list (as of 2026-10-19, q7): no Gemini-specific entries; Gemini, as a Core Service, falls under the entries for "All Google Workspace Core Services and Cloud Identity Services" (activities Technical Support, Data Center Operations, Security Risk Detection, Service Maintenance; third parties and Google group companies with countries of processing): https://workspace.google.com/terms/subprocessors/

• Workspace sub-processor list (as of 2026-10-19, q7): no Gemini-specific entries; Gemini, as a Core Service, falls under the entries for "All Google Workspace Core Services and Cloud Identity Services" (activities Technical Support, Data Center Operations, Security Risk Detection, Service Maintenance; third parties and Google group companies with countries of processing): https://workspace.google.com/terms/subprocessors/

• Workspace sub-processor list (as of 2026-10-19, q7): no Gemini-specific entries; Gemini, as a Core Service, falls under the entries for "All Google Workspace Core Services and Cloud Identity Services" (activities Technical Support, Data Center Operations, Security Risk Detection, Service Maintenance; third parties and Google group companies with countries of processing): https://workspace.google.com/terms/subprocessors/

• Workspace sub-processor list (as of 2026-10-19, q7): no Gemini-specific entries; Gemini, as a Core Service, falls under the entries for "All Google Workspace Core Services and Cloud Identity Services" (activities Technical Support, Data Center Operations, Security Risk Detection, Service Maintenance; third parties and Google group companies with countries of processing): https://workspace.google.com/terms/subprocessors/

• not publicly documented for the Developer API (Google Cloud sub-processor list not reviewed)

• Google Cloud sub-processor list (q15), AI-specific entries for "All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services" with the activity Data Labeling ("Human labelers apply labels to datasets submitted by Customer based on instructions provided by Customer"): Cognizant Worldwide Limited, GlobalLogic Technologies Private Limited, GlobalLogic Inc., Innodata Inc, Teleperformance Global Business Private Limited, Uber Technologies
• In addition, the entries for all Google Cloud services apply (Technical Support, Data Center Operations, etc.): https://cloud.google.com/terms/subprocessors

• Europe Addendum (q8): service providers as per the sub-processor page (q11, see API plan); Brave Software, Inc. receives parts of the inputs for search results; payment processing by Google Payments, Apple Pay and Stripe

• Europe Addendum (q8): service providers as per the sub-processor page (q11, see API plan); Brave Software, Inc. receives parts of the inputs for search results; payment processing by Google Payments, Apple Pay and Stripe

• According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
• SpaceXSI subsidiary (services and support): located in the UK (q11)

• According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
• SpaceXSI subsidiary (services and support): located in the UK (q11)

• According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
• SpaceXSI subsidiary (services and support): located in the UK (q11)

• According to the sub-processor list (q11): AWS, Google Cloud, Oracle (cloud infrastructure), Vercel (web hosting), MongoDB, Inc. (cloud database), Cloudflare and Hive (content delivery), LiveKit (real-time media), Axiom, Chronosphere, ClickHouse, Elasticsearch, GrowthBook, Hubspot, Okta, Twilio, Wiz, WorkOS, Zendesk (services and support), Sentry (error monitoring), Stripe and PayPal (Braintree) (payments), SpaceXSI affiliates (cloud infrastructure), each located in the US
• SpaceXSI subsidiary (services and support): located in the UK (q11)

0 (Free, q6)

0 (Free Tier, input/output "Free of charge", q8)

Google AI Plus 4.99 USD/month; Google AI Pro 19.99 USD/month; Google AI Ultra from 99.99 USD/month (second tier 199.99 USD/month); US version of the subscriptions page (gemini.google/us/subscriptions). German version (q6): Plus 4.99 EUR/month; Pro 21.99 EUR/month; Ultra 99.99 EUR/month (5x usage limits) or 219.99 EUR/month (20x) (q6, retrieved 2026-10-14)

6.80 EUR per user/month with monthly billing (excl. taxes). Introductory discounts for 3 months apply to new customers (q9)

Per user/month with monthly billing (EUR, excl. taxes): Standard 13.60; Plus 21.10. Introductory discounts for 3 months apply to new customers (q9)

0 ("Free for eligible educational institutions" (translated), self-service sign-up, q17)

On request (pricing page: Enterprise via sales, q9)

Education Plus: 5.10 EUR per user per year (comparison table at the same time 'price on request' (translated)), sales; Google AI Pro for Education: 14.40 EUR per user/month with a one-year contract term or 23.04 EUR with monthly payment (q17); public sector prices not publicly documented

Usage-based per 1M tokens (Paid Tier, pricing page as of 2026-10-14), e.g. Gemini 4 Argon Standard 2.00 USD input / 10.00 USD output until 2026-11-30, from 2026-12-01 4.00 / 20.00 USD; Gemini 3.8 Flash Standard 0.75 / 3.75 USD until 2026-12-31, from 2027-01-01 1.50 / 7.50 USD; Gemini 3.8 Flash Priority 1.35 / 6.75 USD until 2026-12-31, from 2027-01-01 2.70 / 13.50 USD (q8). For other models see the pricing page.

Usage-based per 1M tokens (Agent Platform pricing page, retrieved 2026-10-18, USD; "Prices are listed in US Dollars (USD)"), e.g. Gemini 4 Argon until 2026-11-30 (promotional price via 50 % credit): input USD 2 global / USD 2.20 non-global, output USD 10 / 11; from 2026-12-01: input USD 4 / 4.40, output USD 20 / 22; Gemini 3.8 Flash introductory price USD 0.75 / 3.75 (input/output) until 2026-12-31, from 2027-01-01 USD 1.50 / 7.50 (q18). For other models, see the pricing page.

0 USD (pricing page)

Plus 8 USD; Premium 30 USD; Super 100 USD; Ultra 200 USD per month, each excl. taxes; subscriptions are sold via X Subscription Corp. and include X features (pricing page). The Consumer FAQ still names 'SuperGrok' and 'SuperGrok Heavy'.

from 30 USD per user per month ('$30+/user/month'; seat types combinable), excl. taxes (pricing page)

Custom (pricing page: 'Custom', contact sales; payment by invoice/bank transfer only in the Enterprise plan)

Per 1M tokens, in USD, below / from 200k prompt tokens (pricing page): grok-4.7 and grok-4.6 input 2.00 USD / 4.00 USD, cache 0.50 USD / 1.00 USD, output 6.00 USD / 12.00 USD; grok-4.5 input 2.00 USD / 4.00 USD, cache 0.30 USD / 0.60 USD, output 6.00 USD / 12.00 USD; grok-4.3 and grok-4.20 variants input 1.25 USD / 2.50 USD, cache 0.20 USD / 0.40 USD, output 2.50 USD / 5.00 USD; grok-build-0.1 input 1.00 USD / 2.00 USD, cache 0.20 USD / 0.40 USD, output 2.00 USD / 4.00 USD. Tools: web search, code execution, file search 5 USD per 1,000 calls each; X search 5 USD per 1,000 posts or 10 USD per 1,000 profiles; Collections search 2.50 USD per 1,000 calls. US endpoint 10 % surcharge.

As API (ZDR surcharge not stated in the documentation)

yes (Gemini app with basic usage limits, q6)

yes (Gemini models via API, Free Tier with limits)

yes (Gemini app; higher usage limits with Plus/Pro/Ultra, q6)

yes (Gemini app and Gemini in Gmail, Docs, Sheets, Slides, Meet, Drive; scope per edition, q9)

yes (Gemini app and Gemini in Gmail, Docs, Sheets, Slides, Meet, Drive; scope per edition, q9)

yes (Gemini for Education and Gemini Notebook; Gemini in Workspace only to a limited extent, q17)

yes (Gemini app and Gemini in Gmail, Docs, Sheets, Slides, Meet, Drive; scope per edition, q9)

yes (Education Plus: additionally Gemini in Docs, Sheets, Slides, Vids and Forms; add-on Google AI Pro for Education: full Gemini in Workspace access incl. Gmail, Meet, Drive, q17; according to q2, Gemini app for education and public sector customers with a Workspace agreement)

yes

yes

yes (limited chat, agent, image and Build usage according to the pricing page)

yes (from Plus: Grok Chat, Voice, Imagine, Build, API access and Cursor; from Premium: Grok Bot, latest models, video and image generation, 4x usage compared with Plus; Super/Ultra with 15x and 50x usage respectively compared with Plus)

yes (according to the Teams comparison table: Grok Chat, Imagine, video generation, Build, API access, Grok Bot, Cursor agent, pooled usage, team management, central billing, team-wide privacy settings, custom chat retention, SAML/OIDC SSO, combinable seat types; self-service by card. Business guide: connectors to Google Drive, Outlook, SharePoint, Teams, Salesforce, among others)

yes (as Teams; additionally, according to the pricing page, SCIM, audit logs and service accounts, spend controls, group settings, purchase on invoice, custom rate limits, dedicated infrastructure, 'Data residency', among others)

yes (models grok-4.7, grok-4.6, grok-4.5, grok-4.3, grok-4.20, grok-build-0.1; tools such as web and X search, code execution; image, video and voice APIs)

yes (as API; without functions that require storage: Files, Collections, Batch API, stateful Responses API, among others)