Our servers are in Germany, the data processing agreement (DPA) comes ready-made, and new chatbots answer by default with an AI that runs in the EU. This page shows exactly which data goes where.
Visitors often type names, email addresses or order numbers into a chat. That means your chatbot processes personal data, and you should have an answer to three questions.
Where is the data stored?
On servers in Germany. By default, the AI runs in the EU.
Learn moreWho receives it?
Only the service providers listed in the DPA, such as Cloudflare and the AI model.
Learn moreIs there a contract?
Yes, the DPA. It’s ready-made and readable online.
Read the DPAFeatures
Conversations, knowledge and settings are stored with netcup in Germany. The encrypted backups are also kept in Germany.
The data processing agreement the GDPR requires for services like this comes ready-made from us. You can read it before you sign up.
We don’t use conversations or your website content to train AI models.
In the dashboard you set a period after which older conversations are removed from your account automatically. You can delete single conversations yourself anytime.
Without consent, the chat window doesn’t recognize anyone. Only once visitors agree in your cookie banner does it remember, for example, who has visited before.
We show you which data goes to which service provider. That also helps if you need a data protection impact assessment (DPIA).
Use Cases
Patient data enjoys special protection. Let the chatbot explain opening hours, procedures and appointments, but not make diagnoses, and agree on its use with your data protection officer first.
Client data is covered by professional secrecy. A DPA and servers in Germany help, but they don’t replace a review by your professional body or your data protection officer.
Financial supervisory rules apply on top, for example on outsourcing. You carry out that review yourself; we provide the information you need for it.
Hosting in the EU is often mandatory here. Associations and nonprofits also get 30% off Standard and Premium.
Where data is processed depends on two things: our servers and the AI model you choose.
A visitor asks a question
Every request travels encrypted through Cloudflare, which protects against attacks and keeps the site fast. Traffic may pass through servers in the USA, covered by standard contractual clauses.
Conversations, knowledge and settings are stored with netcup in Germany, the encrypted backups also in Germany.
New chatbots answer with "Auto (EU)" by default, currently Claude Haiku 5.5 via Google Vertex AI in the EU. You can choose other EU models, for example from Microsoft (Azure OpenAI) or Mistral.
If you pick, for example, OpenAI, Google AI Studio or xAI, data can go to countries outside the EU. The same applies to telephony and some integrations. The model picker shows where each model runs.
The chat window doesn’t replace a cookie banner, but it can be connected to one.
We provide the technology and the contract. You settle these points for your website:
FAQ
We provide the building blocks: servers in Germany, a DPA, open data flows and an EU-based AI by default. Whether your use is lawful depends on what you use the chatbot for and how you set it up, for example what your privacy policy says. You check that yourself or with your data protection officer.
Yes. The DPA is public, you can read it anytime, even without an account.
Conversations, knowledge and settings are stored with netcup in Germany, the encrypted backups also in Germany. On the way there, every request travels encrypted through Cloudflare. For each answer, the chatbot sends the question to the selected AI model. New chatbots use one that runs in the EU by default. If you pick a provider outside the EU, the model picker shows it.
We don’t train AI on your data. With the default "Auto (EU)", currently Claude via Google Vertex AI in the EU, Google doesn’t use the inputs for training either, per its cloud terms. What applies to other providers is listed in the service provider list in the DPA.
For anyone handling sensitive requests, for example medical practices, law firms, tax advisors, insurance brokers, associations and public institutions. The more sensitive the data, the more carefully you should decide upfront which questions the chatbot may answer.
You decide. In the dashboard you set a period after which older conversations are removed from your account automatically. You can delete single conversations yourself anytime.
Set up the chatbot for free and read the DPA at your own pace first.
