In all likelihood, they are held in the U.S., but these are all held on Google servers in Google server farms, which are arguably some of the safest places anywhere to hold data.
Google doesn't take just privacy seriously, it also takes security seriously. The protocols and innovation that we apply to securing our physical presence and our digital data are, as you might imagine, world-leading. Right down to the access that is permitted to that data, the hardware that the data sits on, and how we process the flow or the traffic of data, it is all highly structured, highly regulated, and industry-leading.