GDPR & Chat4Agent

What is the GDPR

The General Data Protection Regulation is the European Union's privacy law. It gives people in the EU control over their personal data and applies to any organization that is established in the EU or that handles the personal data of people who are. If you put a chat on a website that people in Europe can use, it applies to you, and it applies to us as your provider.

Is Chat4Agent GDPR compliant

Yes. Chat4Agent is operated from France and built to the GDPR from the start:

• Everything is hosted and stored in the EU, in Amsterdam. See where data is stored.
• Data is encrypted in transit. Requests between your chat and your agent are signed with a secret only you hold.
• You decide how long conversation logs are kept, and you can export or delete your data yourself, at any time.
• Your visitors can be shown a consent notice, in your words, before their first message is sent.
• A data processing agreement is part of our terms, so every customer has one.

Data processing agreement

The data processing agreement is included in our Terms & Privacy. You accept it when you create your account, so there is nothing to sign. If your own compliance process needs a countersigned copy, write to support@chat4agent.com.

What happens with chat data

When a visitor writes in your chat, Chat4Agent forwards the message to the agent you connected, your Make.com scenario, n8n workflow, Zapier zap or any other webhook, and shows the reply. For that data, you are the data controller and Chat4Agent is your processor. You decide why the chat exists, what your agent does with the messages and how long the logs are kept.

What we keep, and for how long

• Conversation logs (messages, timestamps, the visitor's IP address and browser) are kept for the retention period your organization sets: 24 hours on Free and Pro, and on Expert anything from 24 hours up to the platform ceiling of 90 days, 7 days by default. Logs older than that are deleted automatically, every hour.
• The message history sent to your agent with each request is the number of past messages you configured. It is a copy of the live conversation, not a separate store.
• Media you upload for a chat (header and intro images) is kept until you replace or remove it, or delete the chat.
• Deleting a chat deletes its configuration, its logs and its media. Deleting an organization deletes everything it owned.

What your own agent does with the messages after it receives them is governed by your agreement with that platform. Make.com, n8n, Zapier and the others are your subprocessors, chosen by you, not ours.

How we use your personal data

For the data you give us to run your account, your email address, your organization's name, your billing details and the record of what you do in the app, Chat4Agent is the data controller. We use it to provide the service, to bill you, to send you the emails the service needs (login codes, invoices, invitations) and to keep the platform secure. We do not sell personal data and we do not use it for advertising. The full notice is in our Terms & Privacy.

Protecting your visitors

The app gives you the tools to meet your own obligations towards the people who use your chat:

• Consent notice. Turn on the GDPR consent message and write it in your own words. It is shown before the first message is sent.
• Allowed origins. List the domains your chat may run on. Anywhere else, it does not answer.
• Private chats. Put a chat behind an access password when it is meant for a team, a client or a course.
• Retention. Choose how long conversation logs are kept, or keep none beyond the 24 hours the live screens need.
• Export and deletion. Export your configuration and logs, or delete a chat, whenever a visitor or an auditor asks.

Subprocessors

These are the companies that process data on our behalf to run Chat4Agent. Each one is bound by the GDPR, by a data processing agreement with us and, where data leaves the EU, by the European Commission's standard contractual clauses. The last column says whether the provider can see the content of your visitors' chats.

We will update this list before adding a subprocessor. If you have subscribed to a paid plan we notify the organization owner by email, and you may object within 30 days.

Where data is stored

Chat4Agent runs on DigitalOcean in Amsterdam, the Netherlands: the application servers, the database and the media storage. Backups of the database stay in the same region and are rotated within 30 days. Stripe holds your billing address, VAT number and payment method; we never store card numbers.

Your rights

Under the GDPR you can ask us for access to the personal data we hold about you, for its correction or deletion, for a restriction of how it is used, for a copy in a portable format, and you can object to a processing. For your account data, most of this is a button in the app: your details on the Account page, exports under Privacy & Data, deletion in the Danger Zone. For anything else, email support@chat4agent.com and we answer within 30 days.

If a visitor of your chat contacts us directly about their data, we will point them to you as the controller and help you answer them. You also have the right to lodge a complaint with your supervisory authority; in France that is the CNIL.