Search this category for data residency and you will find almost nothing. The tools are American, the pricing is in dollars, and the privacy pages say "servers in the United States and other countries" if they say anything at all.
If you are a European studio, an agency handling client work, or anyone whose uploads are not yours to give away, that matters. This is what the question actually means, and what an honest answer looks like, including where ours is uncomfortable.
The question is not one question
"Is it GDPR compliant" collapses four separate things that can each be true or false independently:
- Where the account data lives. Your email, your billing identity.
- Where the uploads and outputs live. The images you send and the meshes that come back.
- Where the processing happens. The GPU that does the inference.
- What the vendor does with any of it afterwards. Training, retention, onward sharing.
A vendor can be honest about one and silent about the rest. Most are.
What to ask, in order
"Where is my data stored, and where is it processed?" These are different questions and the answers are often different. Storage is easy to put in the EU. Inference is not, because the GPU capacity is where it is.
"Do you train on my inputs?" The answer should be no, and it should extend to whoever the vendor buys compute from. A vendor who has not asked their provider that question will not know.
"What happens to my files, and when?" "We keep them" is an answer. "Ninety days, then they go, and we warn you first" is a better one, because it means someone has thought about it. No answer at all usually means forever.
"Can I delete everything myself?" If deletion is a support ticket rather than a button, it is not really a right you hold.
"Who are your subprocessors?" Any vendor sending your data somewhere else is required to be able to tell you where.
Our own answer, including the awkward part
Account data, uploads and generated meshes live in EU object storage. The company is Dutch, the billing is in euros, and VAT is handled properly rather than added as a surprise.
Generation runs at a specialist GPU provider outside the EU. An image you submit is transferred there for the length of the request, under the European Commission's standard contractual clauses. That is a real transfer and pretending otherwise would be the easiest thing in the world. The privacy page said "we do not move data outside the EU" for months before anyone checked whether the pipeline agreed with it. It did not, and the page was wrong, and the page changed.
We do not train on uploads or outputs, and neither does the generation provider, who is contractually bound not to.
Deletion is a button in your profile, not a request. Export is a one-click ZIP. On a free account, meshes are removed ninety days after they are made, with fourteen days' notice first, and the model, its prompt and its thumbnail stay, so your library shows what expired rather than a gap where your work was.
Why the honest version is shorter than the marketing version
A vendor with nothing to hide can answer these five questions in a paragraph. A vendor who cannot is usually not lying; they simply have never had to write it down, because nobody in this category asks.
Ask anyway. The answers tell you as much about how a company is run as they do about where the servers are.