Summary
A GDPR-compliant chatbot needs a lawful basis, clear notices, limited data, security, processor terms, retention rules, a process for privacy requests, and safeguards for transfers outside the EEA.
EU hosting covers where the database sits. Model requests, logs, backups, support access, and integrations each need their own evidence of where they are processed.
From August 2, 2026, Article 50 requires providers to ensure people are told when they are interacting with AI by the first interaction, unless that is already obvious.
Wonderchat, an AI customer service agent and AI helpdesk in one, is EU-hosted in Frankfurt. Its privacy policy says third parties can process data outside the EU, and its public subprocessor list names US model providers, including OpenAI.
For a support team, GDPR comes up at the buying stage. Legal or security sends a list of questions, and the product team has to explain where each conversation goes after a customer presses Send.
A certificate is useful evidence, but it can’t answer the whole question. You still need to trace the message through storage, model processing, logs, backups, support access, and connected tools.
Together, these checks turn GDPR Articles 5, 12, 17, 28, and Chapter V into a practical evidence request.
Certifications do not show the data path
A certificate covers a named set of controls and an audit scope. The certificate doesn’t show every system that receives a customer message.
Wonderchat’s published security line is “SOC 2 Type II, GDPR, EU-hosted in Frankfurt, HIPAA BAA available.” The SOC 2 report itself comes with the Enterprise plan, so ask for it early if your legal team wants to read the audit.
Use the security line to open a vendor review, then ask where each message, log, backup, model request, and support action is processed.
A founder or first support hire can run this vendor review before connecting any docs. When you compare EU-hosted AI chatbots, start with where each vendor hosts the data.
EU data residency describes where selected data is stored or processed. Data residency isn’t another name for GDPR compliance.
Three questions make the review concrete.
Where does data rest, and where is it processed?
Data at rest is data saved in a database or backup. Processing covers every action performed on it, from model inference to a support employee opening a chat record.
EU hosting answers where the active conversation database sits. The other five processing steps need their own evidence.
A Frankfurt database alone doesn’t settle the processing question. Model inference, analytics, connected tools, or staff access can create another route that needs its own evidence.
GDPR doesn’t require all personal data to stay inside the EU or European Economic Area. The GDPR rules for transfers outside the EEA allow transfers under set legal conditions.
An adequacy decision or Standard Contractual Clauses may provide a safeguard, but you must still check the route, purpose, and risk.
Which processors and subprocessors touch the conversation?
A controller decides why personal data is used and how the main decisions are made. A processor handles that data for the controller.
A subprocessor performs part of the processor’s work. The roles depend on the setup and contract.
A model provider may be a subprocessor when it receives personal data for the chatbot vendor, but the role isn’t automatic.
The EDPB guidance on processors and subprocessors supports a clear record of the processing chain. Ask for each company’s name, purpose, data fields, country, retention, transfer basis, and required or optional status.
A head office address isn’t proof of processing location.
The same distinction applies to knowledge controls. Grounding answers in approved company content limit which sources an AI agent uses. Where the customer’s message travels while the answer is created stays a question for the vendor.
What happens when a person asks for deletion?
Article 17 of the GDPR gives people a right to erasure in set cases, with legal exceptions. The right doesn’t promise that every copy disappears at once.
Under Article 12(3), the controller normally has one month to explain what action it has taken. The controller may extend that period by two more months, depending on how complex the requests are and how many arrive.
The person must be told about the delay within the first month.
The controller handles the request, and the processor must provide the help required by Article 28 and the contract. A usable deletion process should answer five separate questions:
How is the person matched to the right conversation?
Which databases, logs, backups, and connected tools are searched?
What is deleted or restricted first?
Which copies expire later, and on what schedule?
How is deletion by a downstream processor confirmed?
A no-training statement doesn’t answer these questions. Model training and day-to-day storage are different uses of data, so a vendor should explain both.
What EU AI Act Article 50 requires for support chatbots
Article 50 of the EU AI Act applies from August 2, 2026. For AI systems built to interact directly with people, the provider must design the system so the person knows they are speaking with AI.
The rule has an exception when the AI use is already obvious to a reasonably informed and careful person in that situation.
The notice must be clear, easy to tell apart, accessible, and shown no later than the first interaction. The European Commission transparency guidance supports a direct first-message notice.
A line such as “You are chatting with an AI assistant” gives the user more information than a vague assistant label or a note hidden in a privacy policy.
In Wonderchat’s study, co-founder Vera Sun describes what happens once the notice is in place.
“We expected people to disengage when the agent says it is an AI. What we see is the opposite, as long as the next sentence tells them what it can actually do and how to reach a person. What loses confidence is not the disclosure. It is discovering it three messages in, after you have already explained your problem twice.”
How do you show the AI notice and a human path?
Wonderchat’s configurable greeting appears at the start of each chat and can carry that notice.
The greeting is a setting you write, and it opens every chat, so the AI notice can be the first thing a visitor reads.
Wonderchat also documents live support and email escalation for the moments a visitor needs a person. When the agent can’t answer, it can open the handover form, and the conversation reaches your team as a ticket with the full chat, in Wonderchat’s own help desk or in Zendesk or Freshdesk (up to 50 tickets on Basic, unlimited from Scale).
In a setup that works, “Occasional queries are escalated to a human,” says Luke Tan, CTO and co-founder of Wonderchat, and the team answers them from Wonderchat’s inbox.
Article 50 doesn’t create a general human-handoff rule for every support chatbot. Wonderchat still recommends a visible human path because support teams need a clear way to handle edge cases, restricted actions, and requests the AI can’t finish.
Wonderchat’s study of 5,848,078 conversations across more than 1,000 businesses between March 2023 and August 2026 recommends five steps for teams serving EU customers:
Disclose at the first message.
Make the human path visible at any point.
Keep the transcript.
Document the routing rules.
Check the retention position.
Those steps support implementation, but they don’t replace the wording of Article 50.
A GDPR-compliant chatbot vendor checklist
Ask each vendor to show how the exact plan, model, region, and integrations you want will handle personal data, since a yes to “Are you GDPR-compliant?” proves none of it.
Say legal sends this checklist before launch. For Wonderchat, two of the seven route questions already have published answers.
Chat and user data are stored in Frankfurt (question 1), and the subprocessor list names each company, its country, and whether it is required or optional (question 4). The model provider (question 5) is the one to ask about, because the privacy policy says third parties may process data outside the EU.
Which questions should you ask about the data route?
Seven questions cover the route a customer message takes.
Map every stored copy. Request the regions used for active chats, form responses, logs, backups, analytics, and connected tools.
Trace each processing step. Include model inference, retries, failover, retrieval, tool calls, monitoring, and remote support access.
Check who can open a conversation. Ask which employees or contractors have access, why they need it, and which countries they work from.
List every processor in the route. Record the company, purpose, data received, country, retention period, and whether its service is required or optional.
Confirm the selected model provider. Ask which provider serves your setup and what happens to prompts and outputs. Check retention, training use, abuse checks, and failover separately.
Read the Data Processing Agreement. Article 28(3) of the GDPR lists eight points a processor contract must cover, including documented instructions, approval of subprocessors, and deleting or returning the data when the service ends. Confirm which DPA applies and how the vendor gives notice when its subprocessor list changes.
Match each transfer to a safeguard. Ask which adequacy decision, SCCs, Binding Corporate Rules, or other transfer tool covers each recipient outside the EEA.
What should you set up and test on your side?
Five checks stay your job as the controller, whichever vendor you pick.
Define your own legal setup. Record the lawful basis, the privacy notice, and which customer data the agent may collect in a chat. A Data Protection Impact Assessment depends on the risk, so it isn’t automatic for every chatbot.
Separate each retention period. Active records, logs, backups, model-provider copies, analytics, and integrations may follow different schedules.
Walk through a privacy request. Check how access, correction, export, restriction, objection, and erasure requests are found, verified, sent to other processors, and recorded.
Review the AI notice. Test the wording, timing, language, placement, and accessibility on every channel you plan to use.
Test the stopping point. Check human handoff, ticket creation, transcript transfer, routing rules, restricted actions, and failed connections.
Ask for the evidence behind each answer. Useful records include a data-flow map, subprocessor list, DPA, transfer terms, retention schedule, deletion test, sample AI notice, and escalation test.
Where Wonderchat’s public evidence is clear, and where questions remain
Wonderchat’s servers and databases, including chat and user data, are in Frankfurt, Germany. Wonderchat also publishes a current subprocessor list, including each company’s service, country, and required or optional status.
On November 2, 2026, that list named 18 subprocessors. Thirteen list the United States as their country, among them OpenAI, a required provider of language processing, and Render, a hosting provider with servers in Frankfurt.
Those records support the Wonderchat EU-hosting statement for that storage scope. They don’t prove that every model request, log, backup, support action, or optional integration stays inside the EU.
Wonderchat’s privacy policy says third parties may process data outside the EU.
Two of four records answer the EU question in public. The model provider and the deletion schedule stay questions for the vendor.
Wonderchat’s public pages don’t yet provide one confirmed processing map for every model and connected service. They also don’t give one deletion timeline for every conversation record, log, backup, and integration.
Treat those two points as questions for Wonderchat’s team, and ask for the answers in writing.
Some buyers need contract terms for EU-only inference, a processor chain inside one region, customer-managed encryption keys, or self-hosting. If one of these controls is required, ask Wonderchat to document whether the selected setup supports it.
If you need to choose the hosting region yourself, Fin, formerly Intercom, may fit better, and Salesforce completed its acquisition of the company in September 2026. Fin’s help center, read October 31, 2026, offers a workspace in the US, the EU, or Australia to customers on a contract, with US hosting by default.
Review your data path with Wonderchat
Wonderchat is an AI customer service agent and AI helpdesk in one, and its chat and user data are stored in Frankfurt. It runs an AI customer service agent that answers from your own content, shows the source on every reply, and hands the rest to your team with the full chat attached.
Run the checklist on it before your legal review. The free plan refills 50 AI replies every month, with no credit card and no per-seat cost, so the first test costs nothing.
Start for free, paste your help center URL, and ask the hardest question your customers send, then one your docs can’t answer. You see the source on the first reply and an honest miss on the second.
For contract, subprocessor, regional-routing, retention, or deletion questions, book a demo and bring the checklist to Wonderchat’s team.
Frequently asked questions
Does GDPR require chatbot data to stay in the EU?
GDPR doesn’t set a blanket rule that chatbot data stays in the EU. Transfers outside the EEA need an accepted Chapter V safeguard, while the wider rules on lawful processing, notices, security, retention, processor oversight, and privacy rights still apply.
Is EU hosting the same as EU processing?
EU hosting describes where a database stores data, which is one step of several. Model inference, logs, backups, staff access, analytics, and integrations may involve other countries, so ask for a data-flow map with the region, recipient, safeguard, and retention rule for each step.
Is the AI model provider a subprocessor?
A model provider can be a subprocessor when it handles personal data for the chatbot vendor. Its role depends on the purpose, contract, and real data route, so ask who receives the message and why.
What should happen after a chatbot deletion request?
The controller should find the relevant data, assess the Article 17 request, and respond within the Article 12 timeline. The processor should help with active copies and downstream systems, and the vendor should explain backup schedules and any legal reason for keeping data longer.
Does the EU AI Act require a chatbot to say it is AI?
Article 50 requires providers to design directly interactive AI so people know it is AI, unless that is obvious in context, and to show the notice clearly by the first interaction. A visible human path is good practice, and Article 50 doesn’t require one.
