Is Zapier GDPR-Compliant? Examples, Costs and How to Start

“Is Zapier GDPR-compliant?” usually comes up when the data protection lead opens the Zapier account for the first time and counts: 40 Zaps, each moving names, email addresses and order data from a web form into HubSpot, a Google Sheet and a Slack channel. An automation tool moves personal data between many systems and keeps a copy of every run for weeks. Here is what Zapier offers, what is missing, what it costs and how to start, as of October 2026. Not legal advice - confirm the details with your data protection officer.

Is Zapier GDPR-compliant?

Zapier is not GDPR-compliant or non-compliant on its own: with Zapier’s built-in Data Processing Addendum, clean Zaps and your own documentation, companies can use it in a GDPR-compliant way. Zapier is the processor of the content in your Zaps, you are the controller¹. The open points are the US data location, task history retention, the subprocessors and every app at the other end of a Zap.

Automating with personal data, processed in Europe: Superkind

If you want data moved between your systems without building Zaps, Superkind is one way. Superkind is the AI employee for your team: you write to it in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as HubSpot, Pipedrive, Google Sheets and DATEV. Superkind is hosted in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Put every new web form lead into HubSpot and draft the first reply.” No trigger, no field mapping.

2. 2

   Superkind does it in your systems

   It reads the form entry, checks HubSpot for an existing contact, creates or updates the record and writes the reply with your company knowledge and rules, such as “Leads from Austria go to Nadine”.

3. 3

   Superkind asks before anything goes out

   You get the draft reply with Approve or Reject. Nothing is sent to the customer without your OK, and a colleague can approve in Teams or Slack.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every new lead - into HubSpot, reply drafted, ask me”. Every task adds to your Company Brain.

How personal data flows through a Zap

Follow one new web form lead through a typical Zap.

1. Trigger app - the form tool holds the lead under its own terms. Zapier checks it for new entries; checking does not use tasks⁶.
2. Zapier - the lead passes through Zapier’s systems on AWS in the US. Zapier stores the Zap content and run data for 29 to 69 days in your account, 7 days in logs and up to 4 months in backups¹⁴.
3. AI step (optional) - if the Zap uses an AI step or Zapier Agents, the data goes to one of Zapier’s AI subprocessors, such as OpenAI, Anthropic, Google, Microsoft or AWS, all listed with the location USA³.
4. Action apps - the Zap writes the lead into HubSpot, a sheet and Slack. From here Zapier’s DPA no longer applies; each app needs its own DPA with you².

What Zapier offers today

Seven facts from Zapier’s own pages decide how it fits the GDPR.

1. A DPA without extra paperwork - the Terms of Service incorporate the Data Processing Addendum (effective 27 August 2026); a signed PDF can be generated through Dropbox Sign. Zapier does not sign customers’ own DPA templates¹².
2. Transfers under the Data Privacy Framework - Zapier is certified under the EU-US, UK and Swiss-US DPF, with Standard Contractual Clauses in the DPA as a fallback¹².
3. Data location - Zapier hosts data on AWS servers in the United States. To the question whether data can be stored only within the EU, Zapier answers: “Zapier does not support this option”¹.
4. A published subprocessor list - the version effective 23 October 2026 names 23 subprocessors for infrastructure and operations, eight of them AI providers, plus support tools and five Zapier affiliates. Changes come with 14 days’ notice and a right to object²³.
5. Retention of task history - Zap content and run data stay 29 to 69 days in your account; on Enterprise (and the older Company plan) you can set a custom period of 7 to 30 days. Agents conversations and activity logs stay until you delete the agent¹⁴.
6. AI and training - Zapier’s AI subprocessors do not use Customer Content to train their models, and Zapier uses OpenAI’s zero data retention. Zapier itself may use de-identified “Derived Data” for model training unless you opt out; Enterprise and Company accounts are opted out automatically³⁵.
7. Admin and security features - SOC 2 Type 2 and SOC 3 reports, an EU representative under Art. 27 GDPR in Hamburg, SAML SSO from Team, SCIM and custom retention on Enterprise¹⁶.

What is missing for company use

The contract basics are in place. The gaps come from automation itself and from your plan.

• No EU data location - if your policy requires storage or processing in the EU, Zapier cannot offer it. The US transfer is legal under the DPF but belongs in your record of processing¹⁹.
• Copies of every run - each Zap run keeps the transferred content for weeks, and below Enterprise you cannot shorten that. Test data stays until you delete the Zap⁴.
• A DPA for every app in the chain - Zapier’s DPA ends where the data leaves Zapier. A workflow across a form tool, HubSpot, Google Sheets and Slack means four more contracts to check².
• Training opt-out on smaller plans - on Free, Professional and Team, the Derived Data opt-out is a form you have to submit; only Enterprise and Company accounts are opted out by default⁵.
• No sensitive data - the DPA says the service is not designed for sensitive information, and Zapier does not support regulated health data. Health or other Art. 9 data needs a different route¹².
• Rules, not judgement - a Zap does exactly what it was built to do. Approvals, team rules and customer knowledge have to be built step by step; Zapier lists approval requests as a beta feature⁶.

Zapier plans and alternatives compared

As of October 2026. Where each option stands on the points that decide GDPR fit, based on the vendors’ own pages^1345678. Not a compliance sign-off.

In short: Zapier gives you the contract and a clear list of subprocessors, but no EU location, and below Enterprise you cannot shorten the task history. For a full list of options, see Zapier alternatives and the comparison of AI automation platforms.

Examples: Zapier and the GDPR in practice

Four situations and what each needs to stay compliant, starting with the European route.

1. Superkind: Best Overall Choice for Teams in Germany and the EU

Daniel asks Superkind in Teams to process every new contact form lead. Superkind checks HubSpot for duplicates, creates the contact and shows Daniel the reply before it goes out. The data is processed in Europe, there is no training on it, and the DPA comes through the Trust Center. See the AI sales rep for how this runs day to day. The verdict rests on criteria you can check:

• Works where you already work - Outlook, Gmail, Microsoft Teams, Slack and the web app.
• Does the task in your programs - 1,500+ integrations such as HubSpot, Pipedrive, Google Sheets, DATEV and Personio.
• Asks for approval - before anything is sent, booked or changed outside the team.
• Learns and keeps your knowledge - customers, prices and processes stay in your Company Brain.
• EU-first - hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act, no training, DPA.
• Unlimited users - from EUR 50 per month for the whole company, as of October 2026.
• Grows into your own apps - custom solutions on the same platform when it gets more complex.

2. Marketing on Zapier Team with lead Zaps

Marketing runs web form leads into HubSpot and Slack on Zapier Team. The DPA applies and the US transfer runs under the DPF¹². Still to do: the Derived Data opt-out⁵, the DPAs of the form tool and Slack, and an entry per Zap in the record of processing.

3. A colleague’s private Zapier account

Someone built a Zap in a free account that copies every new order with name and address into a private spreadsheet. Nobody has an overview, and when that person leaves, the Zap keeps running. Make the rule explicit: company data only in company accounts.

4. HR automates applications

HR wants applicant data from the careers page sent to Personio and Slack. Applications can contain health data, Zapier’s DPA says the service is not designed for sensitive information, and a DPIA under Art. 35 GDPR may be due²⁹. See DPIA for AI agents.

What a compliant Zapier setup needs (and what it costs)

Four points, none of which happens by itself.

• An inventory of Zaps - which Zaps move personal data, between which apps, in whose account.
• Contracts along the chain - Zapier’s DPA plus the DPA of every connected app (Art. 28 GDPR)²⁹.
• A decision on retention and training - delete old test data, shorten history where your plan allows it, submit the Derived Data opt-out⁴⁵.
• Record of processing and DPIA - add Zapier and the US transfer to your record (Art. 30), run a DPIA (Art. 35) where the risk is high, and train staff who build AI steps (Art. 4 EU AI Act)⁹¹⁰.

What Zapier costs

As of October 2026. Zapier list prices in US dollars, excl. tax, billed annually (monthly billing costs more)⁶. Zapier charges by tasks: each successful action in a Zap counts as one task.

At the task limit, Zapier pauses your Zaps or switches to pay-per-task billing at a higher rate⁶. The real price depends on how many actions your Zaps run, not on the number of users.

Data protection and EU hosting

For leads, orders or applicant data that move between your CRM, your accounting and your inbox, the personal data is processed in Europe from the first task, with approval before anything leaves the team.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and connection.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

Three steps for this week:

From the first task to your own app

With Superkind, the data stays in Europe from the first task to your own app. Four stages, on the lead example:

1. 1

   Ready in minutes

   Sign up for free, forward the first web form lead in Teams or by email and watch Superkind put it into HubSpot.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example every new lead processed within the hour. Before any reply goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Your customers, prices and who handles which region end up in your Company Brain, and that knowledge is never lost.

4. 4

   Your own app, without starting over

   When it gets more complex, you build custom solutions, apps and integrations on top of what Superkind already knows, for example your own lead app with scoring and follow-up dates: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

Zapier can be used in a GDPR-compliant way: the DPA is built into the terms, transfers run under the Data Privacy Framework, and the subprocessor list is public. The open points are the data location in the US, task history that stays for weeks, the training opt-out below Enterprise and a DPA for every app in each Zap. If you want the same work done in Europe, with approval before anything goes out, Superkind connects to HubSpot, Pipedrive, DATEV and 1,500+ integrations from EUR 50 per month for unlimited users (as of October 2026). List your Zaps with personal data this week, then send Superkind the first of them as a task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.