Thanks for reaching out! We’re working on getting into full compliance with GDPR by the time it goes into effect this year.
The only information sent to Akismet when a comment is tested for spam is information that the commenter provided: their name, email address, site URL, and comment (plus other non-personal information like the current time, etc.). This information is not transferred to any non-Akismet servers, but we cannot guarantee in which country it will be processed. To that end, we have signed model contract clauses with our Irish subsidiary that cover the transfer of data in and out of the EU for processing.
Let me know if you have any other questions.
(Marking as resolved as it’s not a support question.)