Researched 13 August 2026 against vendors’ own terms, privacy policies and pricing pages. Where something could not be verified from a primary source, this guide says so.
DeepL’s plan comparison has a row labelled “No data training.” The free column has a cross in it. Every paid column has a tick.
That is not a clause buried in a privacy policy. It is a product feature, listed first in the cheapest paid plan, priced at 8.99 EUR a month. DeepL has decided that not training on your text is worth money, and put a number on it.
We went through the terms, privacy policies and DPAs of ten tools European businesses use for free, asking one question: what do you give up on the free tier, and does paying give it back?
Paying fixes it at two vendors. At four it changes nothing. And at one, MailerLite, paying makes your position worse.
The short answer on Free AI Tools:
Nothing given up at all: self-hosted Whisper. MIT licensed, runs on your own machine, and OpenAI’s maintainer confirms no audio is uploaded. For transcription of anything sensitive, this is the answer.
Best free tier from a company that does not train on you: Proton. Swiss, adequacy-covered, and no training provision anywhere in its policy.
Best free translation, with a serious catch: DeepL. Excellent output, EEA processing, and a free tier that trains on your text with no opt-out.
The EU-native assistant: Mistral Vibe, formerly Le Chat. French, opt-out on free, paid does not train by default. One caveat below.
Email marketing for a small list: MailerLite or Brevo. Both EU-controlled, both extend a DPA to free users, which is rarer than it should be.
Do not assume paying protects you at ChatGPT, Claude or Gemini. Business contracts do. Individual subscriptions are a different question, and at two of the three the answer appears to be no.
Three patterns
Paying fixes it
DeepL processes free-tier content to train its neural networks, with no opt-out for free users. Paid content is kept only as long as needed to deliver the translation and is not used for improvement. Same company, same country, opposite treatment, openly priced.
Mistral trains on free conversations by default with an opt-out available, and does not train paid conversations by default. Note that this distinction lives in Mistral’s product documentation, not its privacy policy, which does not differentiate by tier. When the docs and the binding legal document disagree, that is worth knowing before relying on it.
Paying changes nothing
At Claude, the privacy policy draws no line between free and Pro on training. Both use the same opt-out in account settings. At Gemini, the same: no distinction between free users and AI Plus, Pro or Ultra subscribers. Everyone sits under Keep Activity and the same human review programme. At Brevo, no source differentiates training by plan.
ChatGPT is split in a way that matters. OpenAI states clearly that Business, Enterprise and API customers are not trained on by default. Whether Go and Plus get that treatment is not documented anywhere we could find. If you pay for a personal plan expecting enterprise data handling, you may not be getting it, and OpenAI does not say either way.
Paying makes it worse
MailerLite’s terms grant it a licence to use your inputs and outputs to improve AI models. That clause sits inside the AI features section, and AI features are not on the free plan. They start at Comfort.
So free users do not grant the training licence, because they cannot reach the features it attaches to. Upgrade, start using the AI writing assistant, and you have opted into something the free tier never touched.
Two qualifications. This is a side effect of feature gating, not a promise to free users, and if AI ever comes to the free plan the licence activates with no policy change. And separately, MailerLite’s privacy policy blocks its third-party AI providers from training on your data. Different entities, different things: the providers cannot train on you, MailerLite itself can, once you are paying.
What each free tier costs you
| Tool | Trains on free content | Opt-out on free | Does paying change it |
|---|---|---|---|
| DeepL Free | Yes | None | Yes, paid does not train |
| Mistral Vibe free | Yes | Yes, in settings | Yes, paid does not train by default |
| ChatGPT free | Yes | Yes, toggle | Business and API yes, Go and Plus undocumented |
| Claude free | Yes | Yes, in settings | No documented difference |
| Gemini free | Yes, via Keep Activity | Yes, toggle or temporary chats | No documented difference |
| Brevo free | Yes, when AI features used | None | No documented difference |
| MailerLite free | No, AI is paid-gated | Not applicable | Yes, and it gets worse |
| Proton free | No | Not needed | No training at any tier |
| Whisper self-hosted | No, structurally cannot | Not applicable | Not applicable |
| Mistral open weights | No, structurally cannot | Not applicable | Not applicable |
Every opt-out here is prospective only. Anything already used in training stays used. Treat it as a day-one account action.
Gemini carries a caveat the others do not. Even with Keep Activity off, Google states it still uses your chats to respond and protect its services, including with human reviewers. Chats already reviewed are retained up to three years after you delete them.
Whisper is structural rather than contractual. The vendor does not promise not to train on you. Nothing ever leaves your machine.
Where your data lives, and whether you get a DPA
Article 28 expects a data processing agreement whenever a processor handles personal data for you. Most free tiers do not offer one.
| Tool | EEA controller | DPA on free tier | Processing location |
|---|---|---|---|
| DeepL | DeepL SE, Cologne | No, paid only | EEA |
| Mistral | Mistral AI SAS, Paris | No, commercial customers only | Not stated |
| Proton | Proton AG, Geneva | Yes | Switzerland, plus Macedonia and Taiwan |
| Brevo | Sendinblue SAS, Paris | Yes, in the terms | Not stated by country |
| MailerLite | MailerLite Ltd, Dublin | Yes | EU, hosted in the Netherlands |
| ChatGPT | OpenAI Ireland Ltd | No, Business and API only | United States |
| Claude | Anthropic Ireland Ltd | Not documented for consumer plans | United States |
| Gemini | Google Ireland Ltd | No | Not specified |
| Whisper self-hosted | You are the controller | Not applicable | Your hardware |
The pattern is stark. The three EU-native business tools all extend a DPA to free users. The four consumer AI assistants offer none at any consumer tier, paid included.
If you process customer or employee personal data through ChatGPT, Claude or Gemini on a consumer plan, you are doing it without a processor agreement. That is a compliance gap no amount of careful prompting fixes, and it is the most common one we see in European small businesses. See our guides to AI tools with EU data residency and whether ChatGPT is GDPR compliant.
The tools
DeepL Free
The best free translation available, and the clearest illustration of this article’s argument.
DeepL SE is German, in Cologne, and processes translation data exclusively on EEA servers. That is a stronger position than any assistant here.
Free gives you 50,000 characters a month, one file translation at up to 5 MB, one saved translation, and one glossary with five entries. No tone control, no full-page translation. ISO 27001 and TLS apply at every tier, but SOC 2 Type 2 starts at the first paid plan, and so does “No data training.”
At 50,000 characters, roughly twenty pages, a business translating regularly hits the ceiling before the privacy question forces the decision anyway. The free tier is a sampler, not a tool.
Paid: Individual 8.99 EUR a month, Team 29.99 per user, Business 59.99 per user. Annual saves about 16 percent. Prices show in euro with a country selector and VAT included, which is rare here. The page opens on the Annual tab, so check the toggle before subscribing.
Why you might not use it: anything confidential. There is no way to switch the training off.
Mistral Vibe, formerly Le Chat
Mistral renamed Le Chat to Vibe on 28 May 2026, folding the assistant, work automation and coding into one product. Same product, same accounts.
Mistral AI SAS is in Paris, making this the EU-native assistant, and the training position is the best of the four: opt-out on free, no training on paid by default, SCCs named for non-EU transfers.
Free gives you web and mobile access, limited messages, web searches and coding sessions, image generation, Studio model testing, 100-plus connectors and 10 USD a month in API credits.
The caveat. Mistral’s EU consumer terms grant access in a personal capacity and reportedly limit Studio and API to business customers. Read strictly, the free tier is not for running your business on. That sits awkwardly against a pricing page offering Studio access and API credits on the free plan. Both cannot be straightforwardly true, so read the current terms before building on it.
Also unverified: where Mistral actually processes data, which its privacy policy does not state.
Paid: Pro 17.99 EUR a month, taxes included. Team 29.99 per user with a two-user minimum.
ChatGPT free
Training is on by default, and the opt-out is a real toggle under Settings then Data Controls, available on free and even to signed-out users. Output ownership is clean.
OpenAI Ireland is the EEA controller, processing is in the US, transfers rely on SCCs and adequacy decisions, and sub-processors are published.
No DPA for free or individual paid users. And the unresolved question: Business, Enterprise and API are protected by default, but nothing published covers Go or Plus.
OpenAI does not publish numeric free-tier limits. The pricing page says limited without saying limited to what.
Paid: ChatGPT Go at 8 USD a month.
Claude free
Session limits reset every five hours, with no published number and the amount varying by demand.
Anthropic Ireland is the EEA controller, processing is in the US, SCCs and adequacy decisions both named, output assigned to the user. Training is on by default with an opt-out in settings.
Two details. Even with the opt-out on, material is still used if you submit feedback on it or it gets flagged for safety review. And retention runs long: de-identified training data up to five years, safety classification scores up to seven.
No documented free-versus-Pro difference on training, and no DPA documented for consumer plans.
Paid: Claude Pro at 20 USD a month, 17 on annual.
Gemini free
The most generous free tier here on features: Gemini app access, image generation and editing, Deep Research, Gemini Live, Canvas, Gems, limited Google Flow, Gemini Notebook and 15 GB of storage. Context window is 32,000 tokens against 128k on AI Plus.
Google Ireland is the EEA controller. Training runs through Keep Activity, and the opt-out works, either by switching it off or using temporary chats.
The caveats are heavier here than anywhere else. Google still uses chats to respond and protect its services with the setting off, including human review. Reviewed chats are kept up to three years after deletion. Default auto-delete is eighteen months, temporary chats 72 hours.
No consumer DPA, no consumer sub-processor list, and no stated transfer mechanism for EEA consumer data, which for a company this size is striking.
Paid: AI Plus 4.99 EUR a month, AI Pro 21.99, AI Ultra from 99.99.
Brevo free
300 emails a day with no monthly cap, up to 100,000 contacts, one user, Brevo branding on every email. No card, no time limit.
Sendinblue SAS in Paris is the controller, and the DPA is incorporated into the terms, so it covers free users.
Two things against that. The content licence is broad: irrevocable, worldwide, sublicensable and assignable for the duration of the relationship. And Brevo may use content and usage data to train its AI features when you use them, with no opt-out documented, while describing its fraud and spam AI as an essential component that cannot be disabled. Where the line falls between those is not spelled out.
Brevo requires professional use and prohibits consumer use outright, the exact inverse of Mistral’s terms. Its data centre locations are not published, which is a real gap for a tool chosen on European grounds.
Paid: Starter from 9 USD a month.
MailerLite free
Restructured on 13 August 2026 to 250 subscribers and 2,500 emails a month, with two seats and three automations. If you signed up earlier, check what you are on now, because this is a substantial reduction.
MailerLite Limited is in Dublin, storage is in the EU hosted in the Netherlands, and the DPA applies to anyone processing client personal data, which is effectively everyone including free users. That is the strongest free-tier compliance package here.
Commercial use is required rather than permitted: personal and household use is prohibited.
And then the inversion. AI features are gated to Comfort, the training licence attaches to those features, so free is currently the more protected tier.
Paid: Comfort at 12 USD a month.
Proton free
Not an AI tool, included because it completes the picture: 1 GB mail storage, one address, three calendars, 5 GB total, and VPN with one connection across ten automatically chosen countries with unlimited bandwidth.
Proton AG is in Geneva, and Switzerland holds an EU adequacy decision, so transfers need no SCCs. Group entities in Macedonia and Taiwan also process data, and US processors like Zendesk and Stripe sit under SCCs.
On training this is the cleanest answer here. Proton Scribe does not use your data to train its models and runs locally by default, there is no training provision elsewhere in the policy, and end-to-end encryption means Proton cannot read message content anyway.
Free accounts inactive for twelve months face suspension with notice, and the terms prohibit running many free accounts for one organisation. This is a personal-scale free tier.
Paid: Mail Plus 4.99 EUR a month, 3.99 on annual.
The genuinely free option: run it yourself
Two entries here are free in a different sense. No vendor, no account, no terms governing your data, because nothing leaves your machine.
Whisper, self-hosted
OpenAI released Whisper’s code and weights under the MIT licence and still updates it. Commercial use is unrestricted. The maintainer has confirmed audio is not uploaded and the package runs without an internet connection once the weights are downloaded, and the code is open to audit.
Models run from tiny at around 1 GB of VRAM to large-v3 at around 10 GB, with a turbo model at roughly 6 GB running about eight times faster than large.
For a European business this is the strongest position available anywhere in this guide. Meeting recordings are among the most sensitive data most companies handle, often containing personal data of people who never agreed to processing by a US vendor. Self-hosting removes the question: you are the controller, there is no processor, no DPA is needed.
One note. GitHub states MIT for code and weights while the Hugging Face card for large-v3 is tagged Apache 2.0. Both are permissive, so the practical difference is nil, but cite GitHub.
Mistral open weights
Mistral publishes model weights, and this is where the trap is.
Apache 2.0 models can be self-hosted commercially with no fee. Models under the Mistral Research Licence cannot. That licence limits use to non-profit personal, scientific or academic research, and explicitly reaches employees and contractors doing work tasks, including proof-of-concept testing. An employee evaluating one of those models for the company is outside the licence.
If that sounds familiar, it is the same pattern we found with FLUX in our guide to AI image generators. Open weights and free for business are not the same thing, and the difference is per model, not per company.
Mistral has also moved models between licences in both directions. Check the licence on the specific version you intend to run, on the day you run it, rather than trusting any list including this one.
So what should you use?
Transcribing anything sensitive: self-hosted Whisper. Nothing else comes close.
Translating public copy: DeepL Free. Anything confidential, DeepL Individual, because free trains on it and cannot be told not to.
A general assistant, non-sensitive data: any of the four, with the opt-out switched on the day you sign up. Mistral if EU jurisdiction matters, subject to the personal-use question.
A general assistant, sensitive data: none of them on a consumer plan. You need Business or Enterprise for the DPA, and then it is not free.
Email marketing: MailerLite under 250 subscribers for the strongest compliance package. Brevo for frequent sending to a larger list.
Privacy infrastructure: Proton, the only vendor here that does not train on your content at any tier.
Frequently asked questions
Does free always mean my data trains the model?
No. Six of these ten train on free content by default. Proton does not at any tier. MailerLite does not on free, because the training licence attaches to paid-only AI features. Self-hosted tools cannot, because nothing is transmitted.
If I pay, does the training stop?
Sometimes. At DeepL and Mistral, yes. At Claude, Gemini and Brevo there is no documented difference. At ChatGPT it depends which paid product: Business, Enterprise and API are protected, while Go and Plus are not addressed anywhere published. At MailerLite, paying introduces a training licence the free tier never had.
Can I get a DPA on a free plan?
At Brevo, MailerLite and Proton, yes. At DeepL, Mistral, ChatGPT and Gemini, no. Claude does not document one for consumer plans either way. If you handle customer personal data, this matters more than any feature comparison.
Is a training opt-out retroactive?
No, at every vendor here that offers one. It stops future use. Anything already absorbed stays there, which is why it is a first-day task.
What is the safest free AI tool for a European business?
Self-hosted Whisper, because there is no vendor to assess. Among hosted tools, MailerLite and Proton: EU or adequacy-covered processing, a DPA reaching free users, and no training on your content.
Can I use free-tier output commercially?
Usually, but check the access terms rather than the output terms. ChatGPT, Claude and Mistral all assign output ownership to the user. The restrictions, where they exist, are on who may use the service: Mistral’s consumer terms grant personal-capacity use, and Proton prohibits organisational bulk use of free accounts.
Do these tools comply with the EU AI Act?
Transparency obligations fall mainly on providers, though deployers have disclosure duties. None of the consumer free tiers here publishes the kind of training data summary we found from some image model providers. See our guide to what changed on 2 August 2026.
Method and limitations
Every claim comes from the vendor’s own terms, privacy policy, DPA or pricing page, read on 13 August 2026. Blog posts and review sites were not treated as sources for legal or commercial claims. Where a figure could not be verified it is reported as missing rather than estimated. Several vendors publish no free-tier numeric limits at all, and that absence is itself a finding.
On currency and tax. DeepL, Mistral, Google and Proton show euro to European visitors. DeepL and Mistral state that tax is already included, which makes their figures the only ones you can budget against directly. The rest quote dollars until checkout, where VAT is added by billing location. This guide quotes euro where the vendor publishes euro, and dollars as listed where it does not, rather than converting, because a converted figure dates faster than the source one.
This guide does not carry our usual Sovereignty and Usability scores, which are reserved for tools we have used hands-on for the task under review. This is a survey of terms across a category, not a tested comparison.
Terms here change fast. MailerLite restructured its free plan on the day this research was done. Check before relying on anything above.
Sources
All checked 13 August 2026.
DeepL
- Privacy Policy, Sections 3, 4 and 10: training on free content, non-training on paid, EEA processing
- DeepL Pro Terms and Conditions, Sections 3.3.1, 3.3.2, 7.4, 7.5 and 8.1.4: licence, storage, output rights, DPA availability
- Pricing and plan comparison, free tier limits, “No data training” feature row, euro pricing, VAT inclusion
- API Free discontinuation notice
Mistral
- Privacy Policy, effective 27 July 2026: training basis, retention, controller, transfers
- EU Consumer Terms of Service, personal-capacity restriction, output ownership, content licence
- Privacy and data controls documentation, free versus paid training defaults, opt-out mechanism
- Data Processing Addendum, effective 27 July 2026: scope limited to commercial customers
- Pricing, free tier contents, Pro and Team prices, currency selector
- Vibe product page, rename from Le Chat
- Mistral Research Licence, commercial use prohibition
OpenAI
- EU Privacy Policy, updated 4 June 2026: EEA controller, transfer mechanisms
- Privacy Policy, updated 18 May 2026: training by default, retention
- Terms of Use, output ownership, content licence
- Enterprise privacy, Business, Enterprise and API non-training default
- Data Processing Addendum, effective 1 January 2026
- Sub-processor list, updated 9 July 2026
- Data controls FAQ, free-tier opt-out mechanism
Anthropic
- Privacy Policy, effective 8 July 2026: training, controller, transfers
- Consumer Terms of Service, output assignment, materials licence, feedback and safety carve-outs
- Pricing, free tier description, Pro pricing
- Data retention article, updated 1 July 2026
- Gemini Apps Privacy Notice, updated 10 August 2026: Keep Activity, human review, retention
- Gemini plan limits, context windows, reset periods
- Google AI plans pricing, free tier contents, AI Plus, Pro and Ultra prices
- Terms of Service, effective 30 July 2026: content licence
- Privacy Policy, effective 26 May 2026: processing locations
- Cloud Data Processing Addendum, scope excludes consumer Gemini
Brevo
- Terms of Use, Sections 1.3, 6.7, 7.1, 7.4 and 13: professional use requirement, AI training, content licence, DPA reference
- Privacy Policy, controller, retention, transfer mechanism
- Free plan limits
- Pricing
MailerLite
- Terms of Service, Sections 2.3, 17.3, 23.1 and 27.1: commercial use requirement, AI training licence, content ownership, DPA incorporation
- Privacy Policy, Sections 3.6, 9.2 and 11.1 to 11.7: third-party AI restriction, EU storage, retention
- Data Processing Agreement, SCCs, sub-processors
- Pricing
- Free plan update FAQ, effective 13 August 2026
Proton
- Terms of Service, Sections 2.9, 3, 4 and 9: free account restrictions, inactivity, consumer versus business plans
- Privacy Policy, Sections 1, 2.11, 4.1 and 4.2: controller, Scribe non-training, sub-processors, transfers
- Data Processing Agreement
- Plans and pricing
Whisper
- MIT Licence
- Repository README, model sizes, VRAM requirements, licence statement
- Maintainer confirmation that audio is not uploaded
- OpenAI audio API pricing, cost comparison for the hosted alternative
