Deutsch
English
GDPR-compliant chatbots in your store: what really matters
An AI chatbot processes your customers' personal data – which puts it under the GDPR. What you as a Shopify merchant need to watch for to keep it clean, and which questions to ask every provider.
Why the chatbot is GDPR-relevant
As soon as a visitor types into the chat, personal data can arise: name, email, order number, sometimes sensitive concerns. This data is processed, stored and partly passed on to AI services. That makes you as the store operator the controller in the sense of the GDPR – regardless of which provider you use.
The five points that really count
1. Hosting location
Is the data processed in the EU? US hosting means extra effort (standard contractual clauses, transfer impact assessment). A provider with EU hosting – ideally in Germany – makes your life considerably easier.
2. Data processing agreement (DPA)
You absolutely need one. A reputable provider gives you a DPA that spells out exactly how your data is processed.
3. No training data to third parties
Ask explicitly: is your chat data used to train other AI models? The answer should be a clear no. Your customer data belongs to you.
4. Data minimisation & deletion concept
Only the data needed for the answer should be collected – and there must be a clear way to delete it.
5. Transparency towards the customer
Your privacy policy must reflect the use of the chatbot. Link it visibly – see our privacy page for orientation.
The questions to ask every provider
- Where is the data hosted and processed?
- Do I get a DPA – and which subprocessors are involved?
- Is my data used for training?
- How long are conversations stored, and how do I delete them?
If a provider dodges these questions, that's a warning sign.
How Alpheris handles it
Alpheris hosts in the EU (Germany), provides a DPA, passes no training data to third parties and offers a complete deletion concept. Details are on the security page and in the list of subprocessors.
Conclusion
GDPR compliance is no black magic, but it doesn't happen on its own. With EU hosting, a DPA and clear deletion rules your chatbot is on the safe side – and you can even use data protection as a trust argument externally. What matters for AI quality itself is covered in AI support without hallucinations.