GDPR & AI
What the General Data Protection Regulation means for AI assistants.
The GDPR (General Data Protection Regulation) governs how personal data may be processed in the EU. For AI assistants it is highly relevant: as soon as a chatbot talks to real users, it processes personal data — often in every message. Principles such as legal basis, purpose limitation, data minimisation, transparency and the rights of data subjects therefore apply.
What matters most with AI
Four points are decisive for AI assistants: EU hosting to avoid third-country transfers; a data processing agreement (DPA) with the provider; controlled retention that doesn’t store data longer than necessary; and the protection of personal data (PII) that users carelessly type into a chat box.
GDPR & AI at Kyros
Kyros is built for the DACH market from the ground up and is German-first. Hosted in Germany: the API and database run in Frankfurt am Main; the provider of the AI model you choose also processes each message, not always in Germany. Moderation withholds personal data before it reaches the model or gets stored; retention is configurable (platform default, disabled or a custom period); an audit log with 21 action types provides traceability; and the chat widget ships with a privacy panel. Whether your deployment meets the GDPR also depends on how you configure it. You’ll find details on the GDPR page and in the article AI chatbot privacy: a GDPR checklist.
Frequently asked question
What does the GDPR mean for AI assistants?
As soon as an AI assistant talks to users, it processes personal data and falls under the GDPR. What matters is EU hosting, a data processing agreement, controlled retention and PII protection. Kyros provides building blocks for this: hosted in Germany (API and database in Frankfurt am Main; the provider of the AI model you choose also processes each message, not always in Germany), a data processing agreement under Art. 28 GDPR, PII moderation, configurable retention and a privacy panel in the widget. Whether your deployment meets the GDPR also depends on how you configure it.
AI that keeps privacy in mind.
Free plan, no credit card. Hosted in Germany.