An AI chatbot on your site receives your visitors’ questions. Those questions sometimes include a name, an e-mail address, a phone number or details about their situation. You remain responsible for that data towards your visitors: the choice of provider matters.
Here are eight things to check before installing one. They do not replace advice from your data protection officer, but they cover the essentials.
1. Where is the data processed?
Two places matter: where the service is hosted (your content, the questions, the statistics) and the AI model that writes the answers. A service hosted in Europe may still send every question to an AI model in the United States. Ask where both are, and whether any data leaves the European Union.
2. Is there a data processing agreement?
The provider processes data on your behalf: under the GDPR it is your processor, and Article 28 requires a contract between you. Check that a data processing agreement exists, that it covers your plan, and what it says about data breaches.
3. Who are its own sub-processors?
Hosting, AI model provider, sign-in service, payment provider: the provider itself relies on other companies. A public list, with each one’s role and location, is a good sign of transparency.
4. Are your content and the questions used to train the AI?
Some services use conversations to improve their models. Ask whether training is turned off, and how long the model provider keeps conversations, for example to detect abuse.
5. Does the chat set cookies?
A chat that sets tracking or analytics cookies on your visitors’ devices may require their consent, and changes to your cookie banner. A cookieless chat spares you that question.
6. What happens to personal data typed in questions?
Visitors sometimes type their e-mail or phone number in the chat. A good tool masks them before storing anything. The same goes for IP addresses: there is no reason to keep them in clear.
7. How long is data kept?
Questions, answers, IP addresses, statistics: each piece of data should have a retention period and be erased automatically afterwards. Be wary of “as long as the account exists” with no further detail.
8. Can you handle your visitors’ requests?
A visitor may ask you to erase their data. Check that the tool lets you find and erase their questions. Think about information too: your privacy policy should mention the chat, and the EU AI Act requires visitors to know they are talking to an AI.
What about DigiSeer?
We built DigiSeer, our WordPress plugin, with this list in mind:
- answers written by Mistral AI, a French AI, in the European Union, and data hosted in France by Scaleway;
- a data processing agreement on every plan, and a published list of sub-processors;
- training turned off: your content and the questions are not used to train any model;
- no cookies for your visitors, IP addresses never stored in clear, e-mails and numbers masked in questions;
- answers erased after 12 months, and a visitor’s data erased on request from the dashboard;
- an “AI-generated answers” notice below the chat.
Every detail, piece by piece: security and privacy, and the data processing agreement.