Data processing note
Last updated: 14 October 2026
Draft, pending legal review. This note describes how AI Support Chat works today, but it hasn't been reviewed by a lawyer yet and may change before launch.
This note is for customers in the EU, the UK and other places with similar laws. It describes how AI Support Chat processes personal data on your behalf when your chat widget talks to your visitors, in the terms of Article 28 of the GDPR. It forms part of our terms of service.
Roles
You, the website owner, are the controller of your visitors' data. AI Support Chat is your processor and handles that data only to run your chat, on your instructions as set in the dashboard.
What we process
- Data subjects
- Visitors of your website who use the chat, and anyone named in the content you give the bot.
- Personal data
- Visitors' questions and the bot's answers (which may contain anything a visitor types), a random visitor id, the page address where the chat was opened, ratings, and, when a visitor fills in the contact form, their email address and optionally name and question. Personal data that appears in your website pages, files or Q&A.
- Purpose
- Answering visitors' questions from your content, collecting leads for you, and showing you conversations and usage.
- Duration
- For as long as you use the service. Conversations are kept for 12 months by default; you can delete conversations, leads or a whole bot at any time.
Our commitments
- We process your visitors' data only to provide the service, and never sell it or use it for advertising.
- People who can access it are bound by confidentiality.
- We protect it with appropriate technical and organizational measures: encrypted connections, access limited to the service, secrets kept out of code, and each customer's data kept apart.
- We help you answer your visitors' requests: you can find, export and delete conversations and leads in the dashboard, and we'll help with anything else.
- We tell you without undue delay if we become aware of a personal data breach affecting your data.
- When you delete a bot, its pages, conversations and leads are deleted. [Describe deletion of backups and of account data after closure.]
- We'll give you the information you need to show compliance, and answer reasonable audit questions.
Sub-processors
You authorize these sub-processors. We'll announce changes by email before they take effect, so you can object.
| Company | What it does | Data it receives |
|---|---|---|
| Anthropic | Writes answers (Claude) | Questions, recent conversation messages, excerpts of your content |
| OpenAI | Embeddings for search | Your content and visitors' questions |
| Resend | Email delivery | Lead notifications to you (visitor's name, email and question) |
| Railway | Hosting and database | All data stored by the service |
| Cloudflare | DNS and content delivery | Network traffic |
Polar is our merchant of record for payments and acts as its own controller for billing data; it doesn't receive your visitors' data.
International transfers
Some sub-processors are in the United States. [Name the transfer mechanism, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, for each one once confirmed.]
Your part
Tell your visitors about the chat in your own privacy policy, including that it's AI-powered and that their messages are processed by AI Support Chat and the sub-processors above. Don't ask the bot to collect special categories of data, such as health details.
Contact
For a signed data processing agreement or any question about this note, write to [email protected].