Directory › AI agent builder › Gumloop
Is Gumloop UK GDPR compliant?
In plain English
Gumloop is a US-hosted AI workflow builder with SOC 2 Type II. Watch out: its privacy policy says it may use Self-Serve tier content to develop and train its AI models, and only the Enterprise tier is excluded. We found no public DPA or sub-processor list.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | No UK/EU region Privacy policy: data, including personal data, is transferred to and processed in the United States. No EU or UK region is published. | www.gumloop.com/privacy-policy |
| DPA and UK GDPR transfer terms | Not published No public DPA found. The privacy policy relies on the EU-US Data Privacy Framework and UK Extension for personal data transfers. | www.gumloop.com/privacy-policy |
| SOC 2 | Yes SOC 2 Type 2 'Compliant'. Report covering Oct 2025 to Apr 2026 available on request. | trust.gumloop.com/ |
| ISO 27001 | Not published Not listed in the trust centre. | trust.gumloop.com/ |
| Self-hostable | Not published No self-hosted option documented. | trust.gumloop.com/ |
| Sub-processor list | Not published No public sub-processor list found in the trust centre or privacy policy. | trust.gumloop.com/ |
| AI model providers | OpenAI, Anthropic Privacy policy says Gumloop has agreements with OpenAI and Anthropic not to train on data sent via its API. | www.gumloop.com/privacy-policy |
| Customer data used for training? | Partly / conditional Section 21: Enterprise tier content is not used for training unless requested in writing. 'We may use Self-Serve Tier Content to develop, train, and improve our AI models.' | www.gumloop.com/privacy-policy |
Questions UK buyers ask
Is Gumloop UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Gumloop does not offer UK or EU data residency on its hosted service; its DPA status is "Not published"; SOC 2: Yes; ISO 27001: Not published. AgentSafe UK readiness score: 17/100 (Limited).
Does Gumloop store data in the UK?
Privacy policy: data, including personal data, is transferred to and processed in the United States. No EU or UK region is published.
Does Gumloop use my data to train AI models?
Section 21: Enterprise tier content is not used for training unless requested in writing. 'We may use Self-Serve Tier Content to develop, train, and improve our AI models.'
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.