Your content and your visitors’ questions are hosted in France and processed in the European Union. Here is what DigiSeer keeps, what it does not keep, and how it protects it.
Where data goes, and for how long
| Data | Where | Retention |
|---|---|---|
| Your site’s indexed content | Scaleway, France | Until 30 days after the contract ends |
| Visitors’ questions | Scaleway, France; Mistral AI, European Union, to write the answer | E-mails and numbers masked before storage; deleted no later than 30 days after the contract ends; 30 days at Mistral AI |
| AI answers and pages cited | Scaleway, France | 12 months |
| Visitors’ IP addresses | Never in clear: only an encrypted fingerprint is kept | 13 months |
| E-mail left with a suggestion | Scaleway, France | 12 months |
| Customer accounts | Scaleway, France; Supabase, Frankfurt, for sign-in | Duration of the contract, then 30 days |
| Billing | Stripe, Ireland | 10 years for invoices, as required by law |
The full list is on the Sub-processors page.
Your site’s visitors
- No cookies are set by the chat, and no visitor profiles are built.
- IP addresses: replaced by an encrypted fingerprint, which changes every month and is only used to limit the number of questions per day.
- Personal data in questions: e-mail addresses, phone numbers and long numbers are masked before storage.
- Automatic deletion: IP fingerprints after 13 months, e-mails left with a suggestion and AI answers after 12 months.
- Right to erasure: from the dashboard, you erase one question or all of a visitor’s questions; visitors can also erase their own questions of the month themselves, with the “Erase my questions” link below the chat (shown by default, can be removed in your settings). The question, answer, pages read, suggestion, e-mail and IP fingerprint are erased; only the figures remain (tokens, times, number of erasures).
Artificial intelligence
- Model: Mistral AI (a French AI), called through its European endpoint, which guarantees processing in the European Union.
- No training: the use of data to train models is turned off. Mistral AI keeps exchanges for 30 days to detect abuse, then deletes them.
- Answers taken from your pages: the model only answers from your site’s indexed content, and says “I don’t know” rather than inventing.
- Protection against misuse: the instructions for the AI refuse links and e-mails, every change is logged, and a set of trap questions is checked before each release.
- Transparency: an “AI-generated answers” notice appears below the chat (EU AI Act).
- Answer cache: an answer already given is kept in memory for 24 hours to answer the same question instantly, then forgotten.
What we never do with your data
- No selling or sharing: your content and your visitors’ questions are never sold, rented or handed over to third parties.
- No reuse: they are not used for our search engine ranking, our own content, or to answer visitors of other sites.
- No advertising: no ads, neither in the chat nor based on your data.
- Limited human access: no one at DigiSeer looks at your data, except at your request (support) or for the security of the service.
- Our own audience measurement: Matomo, hosted in France on our servers. No cookies, truncated IP addresses. No data shared with third parties or sold.
Security measures
- HTTPS enforced on every endpoint
- Request limits: 20 questions per minute per visitor, plus a daily limit set for each site (20 questions per visitor per day on the Free plan)
- Malicious bot blocking and DDoS protection
- Strict security headers, 145/100 on Mozilla Observatory; app with no external or inline scripts
- Sessions in secure cookies, out of reach of page scripts
- Access per site and per role: Owner, Administrator, Reader
- A dedicated API key per site: only the DigiSeer plugin that holds it can send the site’s content (pages, posts, ACF fields); never sent to visitors
- XML-RPC blocked on the digiseer.app website
Architecture
DigiSeer runs in Docker containers at Scaleway, in France: a Traefik reverse proxy, a TypeScript API, a PostgreSQL database and an Angular app for your customer area. Account sign-in is handled by Supabase, hosted in Frankfurt.
Performance
- Document search: about 0.4 s
- Answer writing by the AI model: 2 to 4 seconds, depending on its length
GDPR roles
You remain the controller for your site and the data it collects. DigiStella acts as a processor for the DigiSeer service. A data processing agreement applies to every plan: a data breach is reported to you within 48 hours, and your data is deleted 30 days after the contract ends.
Data processing agreement · Sub-processors · Privacy policy
To go further: Technical side, DigiSeer’s technical architecture; and our guide AI chatbots and the GDPR: 8 things to check.
Last updated: 12 November 2026.