Privacy Policy

1. What this policy covers

This policy describes how we process personal data as a controller: when you visit our website, register and use the customer account, pay, contact support, join the affiliate program or subscribe to the newsletter.

When our customers use WebChatAgent, for example as a chat widget on their website, as a phone assistant, in their email inbox or in WhatsApp, Messenger and Instagram, we process the data of their visitors, callers and correspondents only on their behalf (Art. 28 GDPR). The respective customer is then the controller, and their privacy policy applies. Section 6 nevertheless describes how this processing works technically and which service providers are involved.

We have not appointed a data protection officer because the legal requirements for doing so are not met. Questions about data protection: hello@webchatagent.com.

2. Your rights

You have the following rights towards us:

• Access to your data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR); the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) in Düsseldorf

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons.

An email to hello@webchatagent.com is sufficient. If your request concerns data we process on behalf of a customer, we forward it to that customer.

We do not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

3. Website

Hosting, backups and Cloudflare

Our servers and databases are operated by netcup GmbH in data centers in Germany. Backups of databases and files are stored encrypted with Google Cloud in Frankfurt (region europe-west3) and deleted after 3 days.

Cloudflare (Cloudflare, Inc., USA) sits in front of our servers. Requests via webchatagent.com, meaning the website, the dashboard and the chat widget, pass through Cloudflare, which protects them against attacks and delivers them faster. White-label instances on a customer's own domain reach our servers directly, without Cloudflare. In doing so, Cloudflare processes your IP address and technical connection data. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR).

Cloudflare privacy policy

Server log files

When you access our pages, the server processes technical access data: IP address, time, requested address, referrer and browser and device information. We use it to keep the service running securely and to find errors (Art. 6(1)(f) GDPR). In normal operation we do not write content from chats, emails or calls into the logs; only when processing fails may short excerpts be included for troubleshooting. Log files are limited in size and continuously overwritten.

Cookies and local storage

Some features store information on your device or read it from there. We use technically necessary storage without consent (Section 25(2) no. 2 TDDDG) and everything else only if you agree in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The categories are analytics, convenience features and marketing. You can change or withdraw your choice at any time via “Cookie settings” in the page footer or in the dashboard account settings.

Necessary:

• nuxt-session: login to the customer account, until the end of the session
• pending_wl_plan: chosen partner plan during sign-up, until the end of the session
• tickets.viewMode and tickets.hideDone: ticket list view, until the end of the session
• cc_cookie: your choice in the cookie banner, 6 months
• locale_explicit and preferred_locale: selected language, up to 1 year
• wca_currency: currency of the price display, 6 months
• nuxt-color-mode: light or dark display, 1 year

Only with consent to analytics: Google Analytics cookies (_ga, _ga_…, up to 2 years) and wca_first_touch (first campaign or referral source, 90 days).

Only with consent to convenience features: our support chatbot remembers visits, triggered prompts and your ratings in local storage (wca_triggers_…, chatThumbRatings_…) and may greet you with an AI-generated message; on the sign-in and sign-up pages Google One Tap loads (cookie g_state, see “Sign in with Google”).

Only with consent to marketing: cookies of Google Ads (_gcl_…, 90 days), Meta Pixel (_fbp, _fbc, 90 days) and affiliate_partner (partner code, 60 days).

In the dashboard's local storage we also remember display settings such as the sidebar, the last opened tab and read news, which setup steps are done (wca_product_event:…) and, on industry pages, the chosen industry (wca_industry_funnel_v1, wca_industry_onboarding_v1); campaign parameters are stored there only with consent to analytics. When connecting WhatsApp, the dashboard loads Meta's Facebook SDK.

Google Tag Manager and Google Analytics 4

Only once you consent to analytics or marketing do we load the Google Tag Manager of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager loads the measurement tools you agreed to.

With consent to analytics, Google Analytics 4 records how you use the website: pages viewed, time spent, approximate location, device and browser, linked to a pseudonymous identifier. If you complete a white-label purchase, we additionally report it (amount, currency, product) server-side with this identifier to Google Analytics; we do not transmit your name or email address. Google may process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google Analytics deletes event data and user-level data after 2 months; a further visit restarts the period for user-level data.

Google privacy policy

Google Ads and Meta Pixel

With consent to marketing, we use Google Ads (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) to measure whether our ads lead to visits and sign-ups. Google and Meta receive your IP address, device information, the pages viewed and identifiers from cookies. Both may link this data to an account you have with them and use it for their own purposes.

We are joint controllers with Meta for collecting and transmitting data via the Meta Pixel (Art. 26 GDPR). Under that agreement we provide information about this processing, and Meta is solely responsible for any further processing; you can exercise your rights with us and with Meta. Data may be transferred to the USA; Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Joint controller addendum with Meta · Meta privacy policy

Sign in with Google

You can register and sign in with your Google account. If you consented to convenience features, Google also shows a sign-in prompt on the sign-in and sign-up pages (One Tap); your browser loads a script from Google, so Google learns your IP address and the page visited. The script sets the cookie g_state, with which Google remembers whether you closed the prompt. The legal basis for this is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you sign in, we receive your name, email address, Google ID and, where applicable, your profile picture. The legal basis is the contract or its initiation (Art. 6(1)(b) GDPR) and our legitimate interest in simple sign-in (Art. 6(1)(f) GDPR). Google LLC is certified under the EU-US Data Privacy Framework. You can remove the link in your Google account at any time.

Our support chatbot

On our website we use our own WebChatAgent chatbot so you can ask questions about operation and features. We process your messages as described in Section 6, but here as controller on the basis of our legitimate interest in fast support (Art. 6(1)(f) GDPR).

Contact by email

If you email us, we process your email address, name, subject and content as well as our reply. Draft replies are created by our own AI email assistant using the AI providers named in Section 6; a person reviews and sends every reply. The legal basis is handling your request (Art. 6(1)(b) GDPR) and our legitimate interest in efficient support (Art. 6(1)(f) GDPR). We keep the correspondence until your request is resolved and statutory retention periods have expired.

Partner inquiry (white label)

Via the form on our white-label page we process your name, company, email address, the estimated number of your end customers, your message and the origin of the inquiry (page visited, language, campaign parameters where applicable). We use your IP address briefly to limit abuse. The purpose is to answer you and prepare a possible contract (Art. 6(1)(b) and (f) GDPR). The inquiry is sent to our team by email; we do not use it for advertising. If no contract is concluded, we delete it no later than six months after the communication ends; otherwise we keep it as business correspondence (Section 257 HGB, up to six years).

Newsletter

For the newsletter we need your email address and your consent (Art. 6(1)(a) GDPR). As proof of the double opt-in we store the time and IP address of sign-up and confirmation. We delete never-confirmed sign-ups without a customer account after 30 days; for sign-ups via a customer account, storage ends when the account is deleted. We delete records of unsubscriptions after three years. You can unsubscribe via the link in every issue.

With your consent (Art. 6(1)(a) GDPR) we store for each recipient address whether and when a newsletter was opened and which links were clicked, to improve the content. Sending is handled by Amazon Simple Email Service of Amazon Web Services EMEA SARL (38 avenue John F. Kennedy, 1855 Luxembourg) in the Frankfurt region; Amazon acts as our processor. We delete the open and click values together with the unsubscription record or your customer account.

Affiliate program

If you take part in the affiliate program, we process your account data, your partner code, the sign-ups and revenue referred via your link and your payout details to calculate and pay commissions (Art. 6(1)(b) GDPR).

If you reach us via a partner link, we remember the partner code for this visit without storing anything on your device. Only with your consent to marketing do we store it in a cookie for 60 days. If you sign up, we assign your account to the partner.

The assignment is based on our legitimate interest in calculating commissions correctly (Art. 6(1)(f) GDPR). In their account the partner only sees the date of your sign-up, your plan and a shortened ID, not your name or email address. We keep the assignment as long as your account exists.

Social media profiles and videos

In the footer we link to our profiles on Facebook, Instagram and YouTube. Only when you click a link do you switch to the respective provider; its privacy policy applies there.

For our Facebook page we are jointly responsible with Meta Platforms Ireland Ltd. insofar as Meta creates statistics about the page (Page Insights, Art. 26 GDPR). Under the agreement Meta assumes primary responsibility, including for your rights, which you can assert directly against Meta. The legal basis for our presence is our legitimate interest in communicating with prospects and customers (Art. 6(1)(f) GDPR).

We embed tutorial videos via youtube-nocookie.com from Google Ireland Ltd. The video only loads when you click it; Google then receives your IP address and may store data on your device. The legal basis is your consent by clicking (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google and Meta may transfer data to the USA; Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework.

Page Insights addendum · Google privacy policy

4. Customer account, contract and payment

Registration and customer account

On registration we process your name, email address, password (only as a hash), language, IP address and time, as well as the time and version of the accepted terms and data processing agreement. During operation we store the time, IP address and approximate country of your last access to detect abuse. If you consented to analytics, we assign the first campaign or referral source to your account.

The legal basis is the contract (Art. 6(1)(b) GDPR) and, for abuse detection and campaign analysis, our legitimate interest (Art. 6(1)(f) GDPR). We keep the data until the account is deleted, afterwards only what we must retain for up to ten years for tax and commercial reasons. You can delete your account yourself in the customer account.

By email we inform you about important changes to the service and send service messages about your account, for example about your allowance (Art. 6(1)(b) GDPR). We also send occasional tips during setup and around the end of the trial, for example on the next step or a suitable plan (Art. 6(1)(f) GDPR, Section 7(3) UWG). You can unsubscribe from these tips at any time via the link in each of these emails or in the account settings.

We need your name, email address and password to create an account; registration is not possible without them. Paid plans additionally require billing details.

System emails

Confirmations, password links and notifications, for example about new leads, calls or emails that need review, are sent via Fastmail (Fastmail Pty Ltd, Australia) with servers in the USA. Notifications contain the details you need to act, for example a caller's name and phone number. The transfer is safeguarded by standard contractual clauses. We delete a send log with recipient, subject and time after 90 days. Announcements to all customers are sent like the newsletter via Amazon SES, without open and click tracking.

Payments via Stripe

We process paid plans via Stripe (Stripe Payments Europe, Ltd., Ireland; for certain processing Stripe, Inc., USA). Processed are name, email address, billing address, company and VAT ID, payment methods in tokenized form (e.g., card brand, last four digits), transaction data, device and risk data for fraud prevention, your ID with us and, if you consented to analytics, your first campaign or referral source. We do not store full card numbers.

The legal basis is the contract (Art. 6(1)(b) GDPR), our legitimate interest for fraud prevention (Art. 6(1)(f) GDPR) and the legal obligation for accounting (Art. 6(1)(c) GDPR). Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. We keep invoice data for up to ten years (Section 147 AO, Section 257 HGB).

Stripe privacy policy

Accounting

For invoices and accounting we transfer name, email address, billing address, VAT ID and invoice amounts from Stripe to Lexware Office (Haufe Group, Freiburg; processing in Germany). The legal basis is the statutory retention obligation (Art. 6(1)(c) GDPR); retention lasts up to ten years.

Connected accounts and integrations

If you connect an account, such as Google Calendar, Google Drive, Microsoft (SharePoint, OneDrive or a mailbox), Notion, Confluence, Nextcloud, an SFTP server or your own email inbox, we store credentials and tokens encrypted and access only the calendar, folder or inbox you select. The legal basis is the contract (Art. 6(1)(b) GDPR). We process the content as a processor (Section 6). Disconnecting ends the access.

For Google Calendar we read free/busy times and create or cancel events in the calendar you choose. Our use of data from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data to train AI models.

Google API Services User Data Policy

5. Data security

We transmit data only encrypted (TLS), store passwords as hashes and credentials encrypted, apply security updates promptly and limit access to what is necessary. Details are set out in the technical and organizational measures of our data processing agreement.

6. Processing on behalf of our customers

The following describes the technical processing when a customer uses WebChatAgent. The customer is the controller (see Section 1) and determines the legal basis towards visitors, callers and correspondents.

AI processing

For the assistant to reply, we send the request, matching excerpts from the knowledge base, the conversation so far and the customer's instructions to a language model. If a request contains names, contact details or customer numbers, or if the customer's website passes such details, they are sent to the model as well. The customer decides which model replies:

• Microsoft Azure OpenAI (Microsoft Ireland Operations Ltd.): default model for calls, plus translations, call summaries, helper functions of the email channel (e.g. detecting topics) and AI text suggestions in the dashboard. Processing in the EU Data Zone; for abuse monitoring Microsoft may store inputs for up to 30 days in Germany.
• Google Vertex AI (Google Cloud, EU): Gemini models, helper functions of the knowledge search (e.g. rephrasing search queries) and the embeddings for knowledge search in the EU multi-region; Claude models by Anthropic run in region europe-west1 (Belgium), Claude Haiku 5.5 in the EU multi-region; Claude Haiku 5.5 is currently the "Auto (EU)" default model for new chatbots and plans the knowledge search on the phone channel.
• Google Gemini API (global): individual models without EU availability, Gemini Live on the phone channel, a customer's own API keys and the embeddings of older chatbots whose knowledge base has not been re-indexed yet (older chatbots may also use OpenAI for this). Data may go to the USA; Google LLC is certified under the EU-US Data Privacy Framework.
• OpenAI (USA), xAI (USA) and Mistral AI (France): only if the customer chooses a model from these providers. Standard contractual clauses apply to the USA.

We use the providers' paid business APIs; under their terms the data is not used to train the models. Where a customer uses their own API keys, their own contracts apply. In the knowledge optimizer, the customer can send test questions with matching knowledge excerpts to several models at once, including providers in the USA.

Microsoft · Google · Anthropic · OpenAI · xAI · Mistral AI

Chat widget, inline chat and team wiki

Processed are messages and replies, time, language, IP address, approximate country, the page on which the chat is opened and a random session ID. Contact details, customer numbers or files are added if the visitor provides them or the customer's website passes them.

The widget sets no cookies. In the browser's local storage it keeps the session ID, the state of the window and a list of the last up to 20 conversations so the visitor can continue them. This is necessary for the chat the visitor requested (Section 25(2) no. 2 TDDDG). Optional data such as trigger history and ratings is stored only with consent. If the visitor ends a conversation via the close icon, the widget removes it from local storage.

We delete uploaded files after 7 days; file name, type and size remain in the conversation. We keep conversations until the customer deletes them or their automatic retention period applies (30 days for new accounts, adjustable). On deletion we remove content, IP address and files; an empty counting record remains for billing the message allowance.

If the customer chooses a Google font for the widget, the visitor's browser loads it from servers of Google Ireland Limited. The customer is responsible for this integration.

Phone assistant

If a customer has activated the phone channel, an AI assistant answers calls on their number. At the start of every call the caller is told that they are speaking with an AI assistant. Processed are:

• the caller's phone number, if transmitted
• what is said, in real time to generate the replies
• a text transcript, only if the caller agrees to it being stored
• an automatically generated summary and the call outcome
• time, duration and language of the call

We do not store audio recordings. Involved are Twilio (Twilio Ireland Ltd. and Twilio Inc.; European numbers run via the Ireland region; if the voice pipeline fails, Twilio takes over speech recognition and speech output), Deepgram (speech recognition, EU region), Microsoft Azure OpenAI (default language model and summary, EU), ElevenLabs (default speech output, USA) and Google Vertex AI (preparing the knowledge search, EU). Depending on the settings, Google Gemini Live, OpenAI Realtime, xAI Grok (voice agent in the USA, speech recognition and output in the EU region) or Cartesia (speech output, USA) are added. Transfers to the USA are covered by standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

If the caller withdraws consent, we delete the transcript. We keep the phone number, summary and call data until the customer deletes them or their retention period applies. The system emails call notifications with phone number, name and summary to the customer.

Twilio · Deepgram · ElevenLabs · Cartesia

Registration of phone numbers

In some countries the regulator requires the holder of a phone number to be registered before activation. For this we send the holder's name and address, company and register details and uploaded documents (e.g., commercial register extract, ID, proof of address) to Twilio, which checks them according to the regulatory requirements, also in the USA (standard contractual clauses, EU-US Data Privacy Framework). We do not store the documents permanently. Address suggestions in the form come from the Photon service of komoot GmbH (Germany); the address you type is sent to komoot. The legal basis is the contract with the customer (Art. 6(1)(b) GDPR) and the telecommunications provider's legal obligation (Art. 6(1)(c) GDPR). For address suggestions while typing, we send only the typed address text via our server to the Photon service of komoot GmbH (Potsdam, Germany); komoot does not receive your IP address or any other details (Art. 6(1)(f) GDPR).

WhatsApp, Messenger, Instagram and comments

If a customer connects WhatsApp Business, Facebook Messenger or Instagram, we process messages, media, timestamps, phone numbers or profile IDs, profile names and delivery status via the interfaces of Meta Platforms Ireland Ltd. At the customer's request, the assistant also replies to public comments on Facebook posts and Instagram media; we then process the comment text and the name and ID of the person commenting.

Voice messages go directly to the AI model or are first converted to text via Deepgram in the EU. We delete media after 7 days. Meta may process data in the USA (standard contractual clauses, EU-US Data Privacy Framework). With WhatsApp, end-to-end encryption ends at Meta's servers, which forward the messages to our interface.

WhatsApp privacy policy · Meta privacy policy

Email channel and email workspace

If a customer connects an inbox (via IMAP/SMTP or sign-in with Microsoft), the system continuously retrieves incoming emails, including emails from third parties, and replies automatically or creates drafts for review. Processed are sender and recipients, subject, content, headers and the replies created. On a sender's first contact, the system once adds earlier correspondence with that address to the conversation history as context. It reads the text of up to two document attachments per email and passes it to the language model; the text is stored with the email in the conversation history and deleted with it.

In the email workspace we store copies of the emails (without attachment content) from the period the customer sets per inbox (by default the last twelve months), build a private search index from them and analyze threads, for example summaries, open questions and commitments. To reply in the usual tone, the model receives up to three earlier emails from the inbox to the same person. If phone or WhatsApp is active, the model learns whether the same person recently made contact there; call content only if the caller agreed to storage.

Automatically sent emails contain a visible note on AI generation and the header X-AI-Generated. Addresses that should no longer receive automatic replies are kept on a block list. We store credentials and tokens encrypted; when the inbox is disconnected, we delete the copies. Copies follow the customer's retention period; emails used as a source by an active private search stay stored as long as that search exists. Answered emails remain as a conversation until the customer deletes them or their retention period applies. The customer is responsible towards the correspondents.

Knowledge base, interfaces and notifications

Websites are read by our own crawler, files are processed on our servers. We split the texts into sections and calculate their embeddings via Google Vertex AI in the EU; older chatbots that have not been re-indexed still use the Gemini API or OpenAI for this.

If a customer sets up REST API connectors or MCP servers (Model Context Protocol), the assistant sends the data defined by the customer to these systems. The customer is responsible for selecting them and for the lawfulness of the transfer.

If a user enables browser notifications, for example for live chat requests, the encrypted notifications run via their browser's push service (e.g., Google, Apple or Mozilla).

7. Changes to this policy

We update this policy when our service or the legal situation changes. The version published here applies.