GDPR & Data Privacy

WebChatAgent provides technical and contractual controls that can support a GDPR-compliant deployment. Compliance still depends on your purpose, legal basis, configuration, privacy information and selected providers. This page explains the platform hosting, the agreement for processing and which third parties may receive chat messages.

Data Hosting

The primary WebChatAgent platform, database and backups are hosted in Germany (EU). Chat-message processing can additionally involve the AI, telephony or integration providers selected in your configuration.

Note: When processing chat messages, data is sent to your selected AI provider (e.g. Google Gemini, OpenAI, xAI Grok, Mistral) for generating responses. Additionally, if you have configured API Connectors, data may be sent to the respective external APIs. These third-party services may process data outside the EU depending on their own infrastructure.

Data Processing Agreement (AVV)

A Data Processing Agreement (Auftragsverarbeitungsvertrag / AVV) is available for all users:

Go to Settings > Data Privacy.
Review the AVV document.
Click Agree to accept the data processing terms.

You can revoke your AVV agreement at any time from the same page.

Data Ownership

You own your data — All content, conversations, and chatbot configurations belong to you
Provider-dependent processing — Chat data is sent only to the providers and integrations needed for your configured features. Review the AVV and subprocessors before choosing a model or integration.

Data Retention

Configure retention to match your purpose and legal obligations.
Dashboard deletion controls and contractual deletion requests must be assessed against the current product behavior.
Do not promise end users immediate or irreversible deletion unless your selected workflow and contractual process provide it.

LLM Provider Data

When your chatbot processes a message, the conversation is sent to your selected AI provider (OpenAI, Gemini, xAI Grok, or Mistral). Review your provider's data processing terms for details on how they handle this data.

Data subjects may have rights to access, rectify, erase, restrict or export their personal data. The website operator remains responsible for handling requests and can contact WebChatAgent under the AVV where assistance is required.

The embedded widget separates functional chat storage from optional persistent personalization. Anonymous proactive triggers run locally without a consent signal; returning-visitor features and proactive analytics remain disabled until the host website supplies one. See Cookie Consent and Anonymous Proactive Triggers.