Simple Chat

GDPR overview

GDPR treatment is unusually detailed for a product of this size. The publisher is established in Italy, which removes the need for an Article 27 representative, and both the privacy policy and the data processing agreement are dated 6 May 2026. The DPA is public and binding on use, with three annexes covering data categories, Article 32 technical measures and eight sub-processor categories. Legal bases are named article by article, visitor IP addresses are stored only as salted SHA-256 hashes, transfers outside the EEA rely on the 2021/914 Standard Contractual Clauses, and breaches are notified within 72 hours. Data subject rights, including portability as a downloadable archive, are listed with the Italian Garante as supervisory authority. No data protection officer has been appointed, and the reasoning for that choice is set out openly.

Who owns the data?

The terms of service state that the customer keeps ownership of everything they put into the product: knowledge base, system prompts, chatbot configurations, captured leads and visitor conversations, together called Customer Content. The vendor receives only a worldwide, non-exclusive licence to host, process and transmit that content as needed to run the service. Roles are split: the vendor is data controller for the account holder's own data, and processor for visitor data, where the website operator is the controller. The data processing agreement explicitly rules out joint controllership. Everything can be exported as a ZIP archive or CSV from the dashboard, and an account deletion wipes chatbots, conversations and leads.

Reuse rights

Customers can reuse what the product produces without asking permission: conversation transcripts, captured leads and analytics belong to them, are exportable as CSV or as a full ZIP archive from the dashboard, and can be deleted individually, in bulk, or all at once from the account settings. The vendor commits not to train AI models on Customer Content, and states that the inference provider it routes through does not train on API traffic either. Its only reserved use is anonymised, aggregated usage metrics to improve the product. Visitors, however, do not deal with Simple Chat directly: they exercise their rights through the website operator, who remains the controller of that data and answers for the lawfulness of its collection.

Data retention & training

Hosting summary

The service states that it is hosted in the European Union, and the data processing agreement locates application hosting — servers and database — in the EU, alongside electronic invoicing. No individual country is named. Eight categories of sub-processor are disclosed with their purpose and location: AI inference, authentication, transactional email, CDN and CAPTCHA, and error tracking sit in the United States under Standard Contractual Clauses, payment processing spans the EU and the United States, while application hosting and e-invoicing stay in the EU. The named list of providers is supplied only on request by email, and customers are notified of any addition or replacement thirty days in advance. Declared safeguards include TLS 1.2 or above in transit with HSTS on all subdomains, filesystem-level encryption at rest where the hosting provider supports it, salted SHA-256 hashing of visitor IP addresses, daily database snapshots retained for thirty days with point-in-time restore, and stated targets of 24 hours for both maximum tolerated outage and maximum tolerated data loss.