AI assistants & search

ChatGPT

ChatGPT (Free / Go / Plus / Pro / Business / Enterprise / Edu / API)

Provider: OpenAI · Based in: According to the privacy policy · Provider website

Plans
9
Sources
21
As of
18 Oct

As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.

Incomplete. 7 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.

At a glance

Hosting
mixed: Free, Go, Plus, Pronot publicly documented: Business, ChatGPT for TeachersEU option: Enterprise, Edu, API
Training on inputs
opt-out available: Free, Go, Plus, Prono: Business, ChatGPT for Teachers, Enterprise, Edu, API
DPA
not publicly documented: Free, Go, Plus, Pro, ChatGPT for Teachers, Eduyes: Business, Enterprise, API
Provider
OpenAI (entities according to the sub-processor list: OpenAI, OpCo, LLC and OAI International, Inc. in the USA; OpenAI Ireland Ltd. in Ireland; OpenAI UK Ltd.; OpenAI Japan Ltd.)
Based in
According to the privacy policy (Europe, 2026-08-24), section 12: for the EEA/Switzerland OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; other countries OpenAI OpCo, LLC, 1455 Third Street, San Francisco, California 94158, USA. DPA: the contracting party for customers established in the EEA/Switzerland is OpenAI Ireland Ltd.

Values from 9 plans, each listed with the plans it applies to. Details and evidence are in the plan table.

Compared plan by plan with other tools in the category AI assistants & search:

Details per plan

Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.

Compare with another tool

Price and scope

differs by plan
0 EUR/mo
differs by plan
yes

Contract and data use

differs by plan
not publicly documented
differs by plan
opt-out available
differs by plan
Chats remain stored until deleted

Hosting and sharing

differs by plan
mixed
list available

Evidence

differs by plan
6 sources

not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.

Third-country transfers

DPA (Effective 2026-01-01), section 4.1: insofar as OpenAI Ireland Limited transfers EEA/Swiss data to other OpenAI companies or third parties outside the EEA/Switzerland, this takes place "on the basis of agreements containing SCCs ... or an adequacy decision issued by the European Commission under Article 45 GDPR". Section 4.2: UK data under SCCs with UK Addendum. Annex: Module Two and Module Three. Sub-processor list: standard contractual clauses between OpenAI group companies. Consumers (privacy policy Europe, 2026-08-24, section 10): processing on servers outside the EEA/Switzerland/UK, including in the USA; basis: adequacy decisions under Art. 45 GDPR or SCCs under Art. 46(2)(c) GDPR and UK Addendum. Data Privacy Framework: a search for "OpenAI" in the participant list on dataprivacyframework.gov on 2026-10-18 returned no result among either active or inactive participants; the evaluated OpenAI sources do not mention DPF participation either.

Certifications (as stated by the provider)

The Trust Portal (trust.openai.com, as of 2026-10-18) lists under Compliance: SOC 2 Type 2, SOC 3, PCI DSS v4.0.1, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, ISO/IEC 42001:2023, CCPA, CSA STAR, GDPR, TX-RAMP, FedRAMP 20x. According to the portal, the ISO/IEC 27001 certificate (with controls under 27017, 27018 and 27701) applies to "OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu services" and is publicly viewable there; the SOC 2 Type 2 report for 2025-07-01 to 2026-06-30 is available only to signed-in users of the portal. Security page: SOC 2 Type 2 ("Security, Availability, Confidentiality, and Privacy for its API and ChatGPT business product services"); ISO/IEC 42001:2023 AI Management System "covering OpenAI's consumer and business AI products and models"; PCI DSS for payment components of ChatGPT; CSA STAR Level 1 for business products and API. Enterprise privacy page: SOC 2 Type 2 for Enterprise, Edu, Healthcare and Business.

Sources:

AI Act

Functions: Generative AI assistant (text, image, voice, video voice chat), Deep Research, Custom GPTs, Projects, Memory, agent/work features (ChatGPT Work, Dot), Codex (coding agent), plugins; API for own applications.

Provider’s statement: OpenAI Global Affairs, "A Primer on the EU AI Act" (update of 2025-07-11): "Today, we are announcing our decision to sign the Code of Practice and use it to demonstrate compliance with our relevant obligations under the EU AI Act." In addition: joining the three core commitments of the EU AI Pact on 2024-09-25; OpenAI is said to be "committed to complying with the Act" and announces technical documentation for downstream providers and deployers of its GPAI models.

Classification (for review, not legal advice): For review: the customer is typically a deployer (Art. 3 No. 4), and where integrated via the API possibly the provider of its own AI system; OpenAI as provider of GPAI models (Art. 53 et seq.) to be reviewed. Check Art. 50 when publishing AI-generated texts/images (para. 2 provider, para. 4 deployer); assess agent features (Codex, ChatGPT Work, Dot) separately. Not legal advice.

Sources:

Current notes 2026

Europe privacy policy last updated 2026-08-24; it mentions personalised advertising for Free and Go users, and the pricing page states for Go: "This plan may include ads" (Help Center on Go: "We may start testing ads in ChatGPT Go in the future"). DPA Effective 2026-01-01. Data residency in ten regions, inference residency (Europe EEA+Switzerland, USA, UAE) for Enterprise/Edu. Sub-processor list as of 2026-10-14, with a section on ChatGPT Sites for Plus/Pro. The Trust Portal and the security page mention ISO/IEC 42001:2023. Pro in three tiers (Pro 100, Pro 200, Pro 500; Ultrafast only in Pro 500). ChatGPT for Teachers free for verified US K–12 teachers. ChatGPT for Healthcare (announcement 2026-01-08, q21): workspace for healthcare organisations with options for data residency, audit logs, customer-managed encryption keys and a Business Associate Agreement (BAA) under HIPAA; according to the announcement, content is not used for training; no price stated.

Open points of the review

  • Sub-processors for consumer plans (Free, Go, Plus, Pro): the sub-processor list (as of 2026-10-14) applies only to API, ChatGPT Enterprise, Edu and Business and mentions Plus/Pro only for ChatGPT Sites; OpenAI does not publish a list for the remaining processing of the consumer plans. ChatGPT for Teachers is not named in the list either.
  • DPA under Art. 28 GDPR for consumer plans: neither offered nor expressly excluded in the evaluated sources (the Enterprise privacy page mentions the DPA only for Business, Enterprise and API; the Help Center articles on Go and Plus refer only to the Privacy Policy, Terms of Use and Data Controls FAQ). For Edu and Teachers it is open whether a DPA can be concluded in addition to the Student Data Privacy Agreement.
  • Storage location for Business (and Teachers) not stated; the sub-processor list names only possible processing locations. Consumers: only a general statement in the privacy policy (USA and other countries), no specific locations.
  • Prices: the euro amounts on chatgpt.com/pricing are loaded client-side and are not in the delivered HTML, so they cannot be retrieved by machine; they were read in the browser for Germany, without a statement whether VAT is included. The page does not show euro amounts for Pro 200 and Pro 500; for Go the Help Center states no USD amount. Usage-based API prices not evaluated; Edu price not published.
  • SOC 2 Type 2 report available only to signed-in users of the Trust Portal; content and exact product scope of the report therefore not checked.
  • ChatGPT for Healthcare not recorded as a separate plan: the announcement (2026-01-08) states no price, and neither the sub-processor list nor the DPA statements on the Enterprise privacy page name Healthcare separately.
  • ChatGPT for Teachers: retention period not stated in the Help Center; the Help Center (June 2028) and the pricing page (June 2027) state different end dates for free use.

Frequently asked questions

Where does ChatGPT store data?

mixed (plans: Free, Go, Plus, Pro); not publicly documented (plans: Business (formerly Team), ChatGPT for Teachers); EU hosting selectable (plans: Enterprise, Edu (ChatGPT Edu), API (OpenAI API Platform)). Based on our research, as of 18 Oct 2026.

Is there a DPA for ChatGPT?

not publicly documented in: Free, Go, Plus, Pro, ChatGPT for Teachers, Edu (ChatGPT Edu); yes in: Business (formerly Team), Enterprise, API (OpenAI API Platform). Based on our research, as of 18 Oct 2026.

Does ChatGPT use inputs for AI training?

opt-out available in: Free, Go, Plus, Pro; no in: Business (formerly Team), ChatGPT for Teachers, Enterprise, Edu (ChatGPT Edu), API (OpenAI API Platform). According to the provider, as of 18 Oct 2026.

Where is the provider based?

According to the privacy policy (Europe, 2026-08-24), section 12: for the EEA/Switzerland OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; other countries OpenAI OpCo, LLC, 1455 Third Street, San Francisco, California 94158, USA. DPA: the contracting party for customers established in the EEA/Switzerland is OpenAI Ireland Ltd. According to the provider, as of 18 Oct 2026.

All sources

  1. 01OpenAI Help Center: How your data is used to improve model performanceHelp Center · retrieved 14 Oct 2026
  2. 02Enterprise privacy at OpenAI (Updated 2026-01-08)Privacy notice/Trust · retrieved 14 Oct 2026
  3. 03OpenAI Data Processing Addendum (Effective 2026-01-01, Updated 2025-12-01)DPA · retrieved 14 Oct 2026
  4. 04OpenAI Sub-processor list (Last updated 2026-10-14)Sub-processor list · retrieved 18 Oct 2026
  5. 05OpenAI Help Center: Data residency and inference residency for ChatGPTHelp Center · retrieved 18 Oct 2026
  6. 06ChatGPT PricingPricing page · retrieved 18 Oct 2026
  7. 07OpenAI Help Center: Deleting and archiving chats in ChatGPTHelp Center · retrieved 14 Oct 2026
  8. 08Security and privacy at OpenAITrust/Security · retrieved 14 Oct 2026
  9. 09OpenAI Europe privacy policy (Updated 2026-08-24)Privacy notice · retrieved 14 Oct 2026
  10. 10OpenAI: A Primer on the EU AI Act (update of 2025-07-11)Provider statement · retrieved 14 Oct 2026
  11. 11OpenAI: Business data privacy, security, and compliancePrivacy notice/Trust · retrieved 14 Oct 2026
  12. 12OpenAI Trust PortalTrust Center · retrieved 18 Oct 2026
  13. 13Data Privacy Framework List (U.S. Department of Commerce), search "OpenAI"Official register · retrieved 18 Oct 2026
  14. 14OpenAI Help Center: What is ChatGPT Plus?Help Center · retrieved 18 Oct 2026
  15. 15OpenAI Help Center: About ChatGPT Pro tiersHelp Center · retrieved 18 Oct 2026
  16. 16OpenAI Help Center: What is ChatGPT Go?Help Center · retrieved 18 Oct 2026
  17. 17OpenAI Help Center: ChatGPT Business: General FAQHelp Center · retrieved 18 Oct 2026
  18. 18OpenAI Help Center: ChatGPT for TeachersHelp Center · retrieved 18 Oct 2026
  19. 19OpenAI Student Data Privacy AgreementDPA · retrieved 18 Oct 2026
  20. 20OpenAI API docs: Data controls in the OpenAI platformDocumentation · retrieved 18 Oct 2026
  21. 21OpenAI: Introducing OpenAI for Healthcare (2026-01-08)Press release · retrieved 18 Oct 2026

More tools in AI assistants & search with an EU hosting option (in at least one plan)

  • Aleph Alpha · Based in: Speyerer Straße 14, 69115 Heidelberg, Germany
  • DeutschlandGPT · Based in: DeutschlandGPT GmbH, Gabriele-Münter-Straße 3, 82110 Germering, Germany
  • Gemini Notebook · Based in: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Google Gemini · Based in: Provider according to the Gemini Apps Privacy Hub: Google Ireland Limited in the EEA and Switzerland, Google LLC everywhere else

All tools in AI assistants & search · Tools with an EU hosting option

Further reading

All tools in the category: AI assistants & search. ChatGPT has at least one plan with an EU hosting option; see also AI tools with an EU hosting option. Figures across all tools: Data report.