Crisp

GDPR overview

GDPR implementation is concrete and documented. Crisp IM SAS is established in France, so no Article 27 representative is required or named. A Data Protection Officer is reachable at dpo@crisp.chat, at the Nantes head office and by phone. The privacy statement, last updated 15 July 2026, is published in English and French and names Crisp as an Article 28 processor for customer contacts; the Data Processing Agreement is part of the terms and downloadable from the account. Transfers outside the EU are covered by Chapter V and Standard Contractual Clauses. A dated sub-processor list is public. Data-subject rights are enumerated, exercisable from the account page or via the DPO, with the CNIL named as supervisory authority and the Nantes courts as forum. Breach notification and EU AI Act roles are also addressed in the terms.

Who owns the data?

The terms of service are explicit: the customer retains all rights, title and interest in its Customer Data, and is recognised as the party owning or controlling it, including the right to access, modify, disclose or delete information about its contacts. Crisp owns the platform itself, its features, its software and its AI agent infrastructure, but that ownership expressly excludes Customer Data and AI outputs. For end-customer conversations, Crisp acts as a data processor under Article 28 GDPR on behalf of its business customers; it is a data controller only for its own marketing, sales and recruitment data. The software is licensed, never sold. Suggestions and product feedback, however, may be freely reused by Crisp without compensation or attribution.

Reuse rights

Customers can reuse their own data freely: they hold the rights to it, can read the full transcript of any conversation, export it, and reach it programmatically through the REST API and the Chat SDKs, without asking Crisp for permission. What Crisp may do with it is fenced in. The terms state that, unless expressly agreed in writing, Crisp does not use Customer Data, AI inputs or AI outputs to train or fine-tune its AI models, and the privacy policy repeats that it never trains its model on customer data and does not sell or resell user data. Access is limited to five stated purposes: running and monitoring the service, passing data to third parties the customer has designated, maintaining security and performance, providing support, and meeting legal obligations. AI outputs belong to the customer, who is nonetheless solely responsible for reviewing and validating them before publishing or acting on them. Use is restricted to the customer's own business, and automated scraping of the platform is prohibited. Exporting before deleting an account is the customer's responsibility: Crisp declines liability for data irreversibly lost that way.

Data retention & training

Hosting summary

Crisp states that it deliberately keeps data in Europe and uses Amsterdam for its core infrastructure. The published sub-processor list, dated 15 July 2026, is specific about both the vendor's own country and where customer data actually sits. Main servers and most data run on DigitalOcean, a US company, with data in the EU (Netherlands and Germany). Encrypted backups sit on AWS in Ireland. Scaleway, a French provider, hosts infrastructure in France, and Crisp's own AI runs there. Vultr handles email relay and Cloudflare handles DNS, CDN and DDoS protection, both holding no data. Stripe processes cards from Ireland with data in the US, while PayPal Europe holds none. Firebase push notifications and Microsoft Azure translation are optional and hold no data. OpenAI, Gemini, Anthropic and Mistral are optional, disabled by default, enabled only on documented customer instruction, and process data transiently without retaining it. Transfers outside the EU rely on Chapter V of the GDPR and Standard Contractual Clauses.