AI chatbots and the GDPR: what to check before you go live
A checklist of the questions to settle with your data protection officer before you put an AI chatbot on your website, and how Kyros answers them. Not legal advice.
Whether you can run an AI chatbot on your website in a way that holds up under data protection law can’t be answered in general terms. It depends on what data the chat collects, which vendors process it and where, what contracts are in place, and what your visitors are told. This page collects the questions to settle with your data protection officer (DPO) before launch, then shows how Kyros answers them. It’s a working aid, not legal advice.
What ends up in the chat window
A chat is a free-text field. Visitors type whatever is on their mind: names, email addresses, order or contract numbers, sometimes health or financial details nobody asked for. On top of that come technical connection data and the conversation history many systems store. You have limited control over what people type. What you can control is who processes it, how long it’s kept and what you tell visitors up front.
More than one vendor is involved
Behind almost every AI chatbot there are at least two vendors: the chatbot platform that runs the widget, knowledge base and conversation history, and the provider of the AI model that writes the answers. Visitors’ messages go to that model. Other services often join in, for moderation or search, for example. The same questions apply to each of them: what they process, where, under which contract and for how long. A label like “hosted in Germany” usually answers that for the platform only, not for the whole chain.
The same questions for any ChatGPT alternative
If you’re looking for a ChatGPT alternative with the GDPR in mind, whether for your team or your website, you end up with the same questions. What matters is less the name of the tool than the chain behind it: which platform, which model, which contracts, how long data is kept and whether inputs are used for training.
Who makes the call
Whether a vendor’s answers are good enough for your use case is for your DPO or legal counsel to judge, not the vendor. Ask each vendor to answer the checklist in writing and to send you the contract documents. Then your DPO can assess your actual deployment instead of chatbots in general.
A GDPR checklist for your chatbot: data, vendors, contracts
Questions to put to the chatbot vendor and talk through with your data protection officer.
What data does the chat collect?
Visitors’ free text, conversation history, technical connection data, ratings, form entries. Ask what is stored, what is only passed through, and where you can review stored conversations.
Who processes the data?
Get a list of everyone involved: the chatbot vendor, the AI model provider and any other services, for moderation or search, for example. Work out with your DPO what role each one plays, such as processor or subprocessor.
Where is the data processed?
Ask about the location for each party separately. Check whether a statement like “hosted in Germany” covers only the platform or also the AI model and the other services.
Is there a DPA?
Ask whether the vendor offers a data processing agreement, which plan it applies to, and whether it comes with a list of subprocessors. Whether the agreement fits your use case is for your DPO to review.
Is chat content used for training?
Settle this for the chatbot vendor and, separately, for the AI model provider. Check where the commitment is written down: in the contract, in the privacy policy or only on a product page.
Website chatbots and the GDPR: retention, notices, access
Questions about day-to-day operation, settled partly with the vendor and partly in your own setup.
How long are conversations kept?
Can you set the retention period yourself, ideally per chatbot? Is data actually deleted automatically, and how often? Who can change the setting, and what happens to backups?
What do visitors see in the chat window?
Is there a privacy notice in the widget itself that visitors can open directly? Does it match your privacy policy, and does your privacy policy mention the chatbot and its vendors?
Is it clear that an AI is answering?
Check whether the widget shows at all times that answers come from an AI and may contain mistakes, not just in a greeting that disappears after the first message.
What happens to sensitive details?
Visitors sometimes type health data, account numbers or ID details into a chat. Ask whether messages are screened before the AI model sees them, what happens to withheld messages, and how you can ask visitors up front to hold back.
Who on your team sees the conversations?
Work out who can read chat history and change settings, whether permissions can be set per person, whether teams or clients are kept apart, and whether changes are logged.
How Kyros answers these points
Kyros is a platform for AI assistants that answer from your organization’s web pages, as a chat widget or via REST API. Here are our answers to the checklist, limits included.
Hosted in Germany, the model at its provider
Kyros runs its API and database in Frankfurt. The AI model you choose for an assistant, however, is run by its provider, which processes the message, and not always in Germany. Kyros also uses external services for moderation and search.
DPA and training
A data processing agreement (DPA) under Art. 28 GDPR is available. According to its privacy policy, Kyros does not use customer data to train AI models. Ask separately about the provider of the model you choose.
Retention per assistant
For each assistant, you choose the platform default, Never delete or your own number of days without activity. Only owners and admins can change it. Messages and conversations past their retention period are deleted daily.
Privacy panel and AI notice
Every widget has a “Privacy” menu leading to “Using our chatbot,” covering data and purpose, legal basis, retention and data processing. It also shows at all times that answers are AI-generated and may be inaccurate. Compare the text with your privacy policy.
Moderation before the model
Incoming messages are screened before the model sees them; this is on for every new assistant. Withheld messages do not reach the model. You set categories and threshold in Studio. No automated check catches every sensitive detail.
Workspaces, roles, audit log
Workspaces keep teams and clients apart. The Owner, Admin and Member roles, plus custom roles built from 15 permissions, set who can do what. An audit log is available on the Business plan.
Whether that’s enough is for your DPO to judge
AI chatbot privacy FAQ
Is an AI chatbot on a website compatible with the GDPR?
There’s no blanket answer. It depends on what data the chat collects, which vendors process it and where, what contracts are in place, how long data is kept and how you inform visitors. Settle these points with your data protection officer before launch; the checklist on this page helps you prepare. It isn’t legal advice, and Kyros can’t make that assessment for you either.
Which vendors process an AI chatbot’s messages?
Usually at least two: the chatbot platform that runs the widget, content and conversation history, and the provider of the AI model that visitors’ messages go to. Services for moderation or search are often added. Kyros is no different: it is hosted in Germany, the model you choose is run by its provider, and Kyros uses external services for moderation and search. Ask every vendor to name all parties and their locations.
Where does Kyros process chat data?
Kyros is hosted in Germany: the API and database run in Frankfurt. That doesn’t describe the whole chain, though. The AI model you choose for an assistant is run by its provider, which processes the message, and not always in Germany. Kyros also uses external services for moderation and search. Ask Kyros for the specific providers and locations before your data protection officer makes a decision.
Is chat content used to train AI models?
Settle this separately for each party: the chatbot vendor and the AI model provider. Check where the commitment is written down: in the contract, in the privacy policy or only on a product page. According to its privacy policy, Kyros does not use customer data to train AI models. What applies to the provider of the model you choose belongs on your list as well.
What happens if visitors type sensitive data into the chat?
You can’t fully prevent it, because a chat is a free-text field. In Kyros, content moderation screens incoming messages before the model sees them; it is on for every new assistant, and withheld messages do not reach the model. No automated check catches every sensitive detail, though. Where you need contact details, an Interactive Card (Beta) can ask for just the fields you need, for a callback request, for example. Submissions are stored per Card.
What should I look for in a ChatGPT alternative with the GDPR in mind?
The same points as with any AI chatbot: who processes the inputs and where, whether a DPA is offered, how long content is kept, whether it is used for training and who on your team has access. Kyros isn’t a general-purpose chat for any topic; it’s an assistant that answers from the web pages you choose and the Golden answers you write. Here too, the provider of the chosen AI model processes the messages, not always in Germany.
Check Kyros against your own checklist.
The Starter plan is €0, permanently, with no credit card required. It includes one assistant with a chat widget.