What a chat widget collects
- The conversation itself, including anything the visitor types
- Contact details, where they choose to give them
- Which pages they were on
- Basic technical information, as any website does
None of that is unusual. What matters is that it is disclosed and that retention is decided rather than accidental.
Update your privacy notice
One paragraph: that you use a chat assistant, what it stores, how long for, and who processes it on your behalf. That is usually the whole obligation and it takes ten minutes.
Decide retention deliberately
- Long enough to follow up an enquiry — usually weeks, not years
- Long enough to review quality — a month is generous
- Then delete, automatically rather than by intention
Tell visitors not to type sensitive things
A short line in the greeting — not to share card details, passwords or medical information — prevents most of the problems.
People will occasionally type things they should not. A clear prompt reduces it substantially.
Handling a data request
If someone asks what you hold about them, the chat conversations are part of it. Know how to find and export them before you are asked.
Similarly for deletion. Both are straightforward when planned and awkward when discovered under a deadline.