Quillbot

GDPR overview

GDPR compliance is claimed explicitly. The Trust Center states that Quillbot works to comply with the GDPR, and the claim comes with concrete, checkable mentions: certification under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension, adherence to the CCPA, PCI DSS, and CASA Tier 2 verification. An Article 27 representative is named for the EEA and UK, Privacy Rep Office Limited in Dublin, reachable at learneo@rep-office.com. Learneo, Inc. is identified as data controller, with a privacy contact at privacy@learneo.com and a dedicated rights-request webform. Transfers outside the EEA rest on the Data Privacy Framework, adequacy decisions and standard contractual clauses, and users may complain to their supervisory authority. Note that the policy consulted is the version taking effect on 21 August 2026.

Who owns the data?

Learneo, Inc. is the data controller for personal data processed through Quillbot. Ownership of the text itself stays with the user: the vendor states that your writing belongs to you and that you retain all rights to it, and that it sells neither your content nor your data. Personal data is shared with service providers acting as processors or subprocessors, with payment processors, and with affiliated Learneo entities, under contracts restricting what those parties may do with it. No third-party provider is permitted to train its own AI models on customer data.

Reuse rights

Users keep the rights to the text they produce and may reuse Quillbot output without asking permission, as the vendor claims no ownership of it. On the vendor's side, inputs and usage data serve to deliver the service, improve it generally and personalize it, including sampling inputs and tracking which suggestions users accept. Input storage is on by default. Extension users on version 4.37.0 or above get two controls: one stopping input storage, and one, for account holders, stopping inputs being used to train the models. Text inputs from Team Plan users are never used for training, and Quillbot does not access sensitive fields such as passwords or card numbers.

Data retention & training

Hosting summary

Quillbot does not disclose where user data is hosted. No hosting country, region or cloud provider is named on the site or in the privacy policy, so no data-residency commitment can be relied on. What the documents do give is corporate geography: Learneo reports offices in the United States, India, the Netherlands, Germany and Canada, and service providers in the United States and throughout the world, while the Trust Center narrows this to offices in the United States and India. Cross-border transfers are explicitly contemplated and are covered by certification under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension, by European Commission adequacy decisions, and by data protection agreements incorporating standard contractual clauses. The domain resolves to a Cloudflare anycast address, which says nothing about where the data actually rests. Buyers with data-residency obligations should treat hosting location as unanswered and raise it with the vendor directly.