AI agents and GDPR: seven criteria, one DPA

Seven criteria decide whether AI agents can be used under the GDPR: EU storage location, own container, no use for model training, a DPA under Art. 28, deletion deadlines, cancellability and an open price from €25.99 a month; for every criterion our sourced answer stands here.

Whoever wants to use AI agents in a business likes to hear a statement such as “we handle everything in a data-protection compliant way” at this point. Check that statement. The privacy policy, terms and legal notice of a provider stand publicly on the web, and whatever is missing there does not belong in a quote.

This page contains a criteria table with seven points and, next to every point, our sourced answer. You can verify every answer against our legal texts at smartragents.ai. This text describes how we handle it; the legal assessment of your individual case belongs to your law firm.

Why the GDPR review runs differently with AI agents

With conventional software you ask the provider about the storage location and about a data processing agreement. With an AI platform a third point joins in. The language models often run on different servers than your data. A model can be called at a service in the USA, and then your input text leaves the European Union, as far as the mode provides for it.

That is why three questions belong to the sentence “our servers are in the EU”. What sits in the EU? What may run outside, and on which legal basis? What can you configure so that the processing stays entirely within the provider’s infrastructure? Our criteria below follow that outline.

A second difference concerns your role. If you use the platform as a business and process personal data through it, you are the controller, and the platform becomes a processor under Art. 28 GDPR. Duties follow from that for you, such as documentation, which a provider should name clearly to you.

The seven-point criteria table

The seven points are the questions that controllers ask us most often before an order. The right column shows where you can read up on every answer.

No.	Criterion	Our sourced answer	Reference
1	German legal notice	A legal notice with owner, address and phone number exists, operator SMarTrAgents, Karl Heinz Marko, Am Kirchle 11, 86637 Binswangen, Germany, phone +49 8272 6095003	https://smartragents.ai/impressum/, retrieved on 31.08.2026
2	German VAT	Small business rule under § 19 UStG, no VAT charged and none shown, all prices are final prices	Terms, July 2026 edition, § 8 para. 2
3	EU server location	Hosting with Hetzner Online GmbH in a data centre certified to ISO/IEC 27001 inside the European Union, currently Helsinki, Finland. Accounts, chats and files sit on servers in the EU. Depending on the chosen mode the language models run with providers in the USA. Whoever needs the processing entirely in their own house takes SMarTrHybrid	Privacy policy, July 2026 edition, sections 4, 8, 10
4	Data processing agreement	DPA under Art. 28 GDPR with a sample from the document repository, available on request to [email protected]	Terms, July 2026 edition, § 14 para. 2
5	Deletion deadline	After the contract ends the content data is provided for export for 30 days, then deleted. Backups are deleted in the rolling cycle after 14 days. Invoicing data follows statutory deadlines of usually 8 or 10 years under § 147 AO and § 257 HGB	Privacy policy, July 2026 edition, section 14
6	Monthly cancellability	Contract for an indefinite term, monthly or yearly billing in advance, cancellation with 14 days to the end of the billing period, for consumers the statutory right of withdrawal of fourteen days on top	Terms, July 2026 edition, § 8 para. 3, § 9 para. 2, withdrawal notice
7	Open price	All prices public in the shop, Cloud Starter €25.99, Cloud Professional €36.99, SMarTrBusiness €74.99, €99.99 and €179.99 a month, setup fee €0.00	Price list in the shop, as of 30.08.2026

Criterion 1: a German legal notice with name and address

The first and fastest test is the least popular one. If a platform carries no legal notice with the full owner, address and reachability, that is a knockout criterion for a controller in Germany. A German legal notice shows you who stands behind the contract and where an information request can be sent.

With us the legal notice names the owner with his full name, Karl Heinz Marko, the address Am Kirchle 11, 86637 Binswangen, Germany, a German phone number, +49 8272 6095003, and an email address for contact enquiries, [email protected] (legal notice at smartragents.ai, retrieved on 31.08.2026). It is a sole proprietorship, so there is a clear contracting party that sits in Germany and answers under German law.

Whoever lets an assistant take calls checks the same points: the AI phone assistant SMarTrPhone has its own page with the details on servers and processing.

Criterion 2: the VAT on your invoices

The second point sounds mundane and yet decides your bookkeeping. Our invoices show no VAT because we are a small business under § 19 UStG. No VAT is charged and none is shown, all quoted prices are final prices (terms, July 2026 edition, § 8 para. 2). In your bookings our amounts appear exactly as they stand in the shop.

A price of €25.99 a month is therefore an amount of €25.99 in your booking, with no calculation item that only appears on the invoice. When comparing, watch how other providers quote: net figures do not line up with final prices.

Criterion 3: where your data really sits

Our answer here, word for word, is this: accounts, chats and files sit on servers in the EU. Depending on the chosen mode the language models run with providers in the USA. Whoever needs the processing entirely in their own house takes SMarTrHybrid.

We write this sentence deliberately in full, because the shortened version would be dishonest. The platform runs with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen in Germany; processing takes place in a data centre certified to ISO/IEC 27001 inside the EU, currently Helsinki, Finland (privacy policy, July 2026 edition, section 4). That is the EU, but it is not Germany, and we write it as it is.

Language models run in two categories. Self-hosted models run through the Ollama software on our own infrastructure hosted with Hetzner inside the EU; in that variant inputs and outputs never leave our infrastructure. External models run, when needed, through the API service OpenRouter, Inc. in the USA, supported by the EU standard contractual clauses under Art. 46 para. 2 lit. c GDPR, and only if you use external models (privacy policy, section 8). In the platform you set whether an agent uses local or external models.

Last but not least, we do not use your content, inputs and outputs to train or fine-tune AI models (privacy policy, section 9). For many controllers that is the decisive line of the review.

Criterion 4: the data processing agreement as a sample

If you process personal data of third parties through the platform, such as customer enquiries or application documents, you are the controller and we become a processor under Art. 28 GDPR. In that case the parties conclude a data processing agreement, and the provider makes a sample available that can be requested at [email protected] (terms, July 2026 edition, § 14 para. 2).

In practice this means you can look at the DPA before you sign. The sample sits in our document repository and contains the list of our sub-processors, currently Hetzner Online GmbH and Cloudflare Germany GmbH for operations, Ollama Inc. for language model processing in normal operation, plus OpenRouter, Inc. and the respectively chosen model providers when external models are used, ElevenLabs Inc. for speech output, Deepgram Inc. for speech recognition, Features and Labels Inc. for image and video generation, and Stripe Payments Europe, Ltd. for payment handling (privacy policy, section 10). With Hetzner we have already concluded our own DPA under Art. 28 GDPR (privacy policy, section 4).

The sample is available as a DPA template (PDF); we send you the currently valid version on request to [email protected].

Criterion 5: deletion deadlines you can read up on

What is asked is when deletion happens and whether you get your data out beforehand. Our privacy policy regulates that in section 14 (July 2026 edition) with three rules.

First rule, for customer account and contract data the duration of the contract relationship applies. After the contract ends the content data is provided for export, for 30 days, after which it is deleted. So you have one month to take over your configurations, chats and files. Second rule, backup copies are deleted within the rolling backup cycle of 14 days. Third rule, invoices and accounting records fall under statutory retention deadlines, usually 8 or 10 years under § 147 AO and § 257 HGB; these deadlines bind us as the invoice issuer, not your content data.

Otherwise the same holds: data is stored only as long as necessary for the respective purposes or as statutory retention duties exist (privacy policy, section 14).

Criteria 6 and 7: cancellability and the price lying open

The last two criteria are questions of contract. The contract runs for an indefinite term, subscriptions fall due monthly or yearly in advance depending on the chosen billing period, you cancel with 14 days to the end of the billing period, we with one month (terms, July 2026 edition, § 8 para. 3 and § 9 para. 2). For consumers the statutory rules apply on top, and cancellation runs through the function provided for it in the customer account or in text form. A monthly billing period means you decide anew every month.

The price is fully open. The shop lists every plan with every amount, Cloud Starter €25.99, Cloud Professional €36.99, SMarTrBusiness Starter €74.99, Professional €99.99 and Complete €179.99, and token packages can be added individually (price list in the shop, as of 30.08.2026). The setup fee was dropped on 23.07.2026 and stands at €0.00. The lowest entry is Cloud Starter for €25.99 a month, and every condition stands openly in the shop. What is in the business plans is listed in detail on the page the complete package SMarTrBusiness.

AI agents under the GDPR for the mid-sized business

The seven points above are written for a legal department that many firms do not have. When adopting AI agents, a mid-sized business usually gets two offers, a consulting package with deadlines measured in weeks or a tool with no recognisable contracting party. Both are expensive, one in fees, the other in risk. Our answer is a business with a tangible owner under German law whose legal texts you read before the contract.

One step stays with you, and it is quickly done. If you process personal data of employees or customers in agent workflows, you need a documented procedure, and we provide the legal texts and the DPA for it. For data that needs particular protection you choose local processing, because you set per agent whether it uses local or external models. Customer data that you keep as tickets in the AI ticket system with CRM SMarTrDesk falls under the same DPA.

Whoever wants to keep the processing entirely in their own house finds the route there on the page AI agents on-premise. If you meet a provider advertising with terms such as “Made in Germany”, check the same seven points. The word does not matter to us, the facts do: a German operator with German legal texts, a data centre inside the European Union and a verifiable DPA. That is exactly what stands above, with reference lines instead of advertising slogans. The difference between a marketing term and evidence is that you can open evidence and read it.

Your checklist for any other provider

Take the seven points along as a review sheet, whoever you turn to.

1. Is there a legal notice with the full owner, address and a way to reach them?
2. In which country does the operator sit, under which law are the contracts concluded?
3. Which data sits in the EU, which does not, and on which legal basis?
4. Is there a DPA under Art. 28 GDPR, can you see the sample before ordering?
5. Which deletion deadlines apply after the contract ends, how long can you export your data?
6. Which cancellation period applies, how long is the billing period?
7. Does the whole price stand openly on the web, the way you will find it again on invoices?

A provider with real legal texts links you to these points in minutes, paragraph by paragraph. A provider without them answers with sentences such as “we are working towards it”.

What you should watch out for legally

Two things belong here, because we keep finding them in enquiries. First, the duty to obtain consent or to adapt your privacy policy lies with you, not with us; we process as a processor. Second, AI agents in HR or with other special categories under Art. 9 GDPR demand a careful review, and our privacy policy recommends not processing special categories in inputs unless this is expressly agreed by contract (July 2026 edition, section 8).

The legal assessment of your individual case belongs to your law firm. What you get from us is the reference: every answer from the table stands in our published texts. The claim of the seven points is exactly this: you can read up on every point yourself.