GDPR-compliant live chat and AI chatbots: what you need, and what ZChat gives you

Updated November 9, 2026

No chat tool makes you GDPR-compliant on its own. What a live chat or AI chatbot has to let you do — export, erase, limit retention, control who sees what — and exactly what ZChat provides and does not.

Searching for a GDPR-compliant live chat or chatbot usually means one of two things: you need to pass a privacy review before putting chat on your site, or you want conversations kept somewhere you control. Both are reasonable. Neither is answered by a badge on a vendor's homepage, because under the GDPR the obligations sit with you as the controller. The tool's job is to make those obligations possible to meet.

What GDPR actually asks of your chat setup. You need a lawful basis for collecting what visitors type, you must tell them in your privacy notice that chat exists and who processes it, you must be able to hand a person their data and delete it when they ask, you should keep it no longer than you need, and you must limit who can read it. If an AI model answers, the model provider is another processor in that chain and belongs in your records too.

The five things to check in any chat tool. Can you export everything a workspace holds? Can you erase one person's conversations and contact record on request, completely? Can you set how long conversations are kept? Can you control which teammates see conversations, with sign-in protection and an audit trail? And for AI: which provider processes the messages, and can you choose it?

Export. ZChat lets a workspace owner export the workspace's data at any time from the dashboard, and conversation events can also be sent to your own systems through webhooks as they happen. That covers both a full copy for a data-access request and keeping your own record outside the tool.

Erasure. An admin can erase a contact by email address: their contact record, conversations and related data are removed together, rather than leaving fragments in tickets or logs. That is the request you will actually receive — someone writes in asking to be forgotten — so test it in a trial before you rely on it.

Retention. Each workspace has a data-retention setting, 365 days by default, so old conversations are not kept forever by accident. Pick a period you can justify in your records of processing; shorter is easier to defend if you do not need the history.

Access. Teammates sign in with single sign-on, Google sign-in or a password with two-factor authentication. Roles limit who can see and change what, a read-only Viewer role exists for people who only need to look, and audit history records changes. Country blocking can keep the widget off in regions you do not serve.

The AI provider. If you use ZChat-managed AI, messages the AI answers are processed by the AI provider ZChat uses for that. If you bring your own key, they go to your own provider account under your own contract and data settings — useful when your organisation has already approved one provider. Either way, list the provider as a processor and say in your notice that an AI assistant answers chats.

What ZChat does not claim. ZChat is a hosted service: conversations are stored on ZChat's servers, not on yours. ZChat has no SOC 2 report and no data-residency guarantee to publish today. If a contract requires every conversation to stay on infrastructure you operate, a hosted chat tool — ZChat included — is the wrong fit, and the trade-offs of self-hosting are worth reading before you commit.

A practical launch checklist. Add chat to your privacy notice, naming the processors. Decide what the AI may and may not answer, and keep sensitive topics with a person. Set the retention period. Restrict roles to the people who answer chats. Run one export and one erasure end to end before launch. Then tell visitors, in the widget greeting, that an AI answers first and a person can take over.

On consent banners. A chat widget that only loads when a visitor opens it, and stores what they choose to type, is usually handled under your existing privacy notice rather than a separate cookie consent — but the answer depends on your own cookie setup and legal advice, not on the chat vendor. Check what the widget stores in the browser during your trial.

The useful question is not whether a tool is GDPR-compliant. It is whether you can answer an access request, an erasure request and a privacy reviewer's questions with it in an afternoon. Test exactly those three things before you choose.

GDPR obligations sit with you; a chat tool must make export, erasure, retention and access control possible.

ZChat provides workspace export, erase-by-email, a retention setting, roles with audit history, and a choice of AI provider.

ZChat is hosted and has no SOC 2 report or residency guarantee; if data must stay on your own servers, a hosted tool is the wrong fit.