a chat box is a place where customers paste things, and you keep the transcript whether you meant to or not.
retune has a privacy tab for this, one per bot. it's free if you run your own copy. it runs on your own computer, with an agent that builds what you ask for.
the shop in the video is nordlicht bikes, a bike shop in hamburg. i made it up, along with its visitors lea and anna.
no chat bot is gdpr compliant on its own. you are, as the business, and the bot is one of the tools you use. the privacy tab says the same at the top: it helps with your gdpr duties, and it isn't legal advice.
so here's what the tab does, and what it misses.
each part is a switch, and they all start off, so you turn on the ones you want.
consent comes first. the chat opens with a card that has your text, a link to your privacy policy and a checkbox. the message box stays locked until they tick it and click start chatting. retune saves when they agreed and to which version of your text.
personal details are masked before anything is saved. card numbers, ibans, email addresses and phone numbers become a short note like [email redacted], and so do most names.
a name gets caught when it follows words like "i'm" or "my name is", or when they gave it earlier in the chat. the masked version is also what the ai model gets, and the bot still answers.
old chats delete themselves. you pick 7, 30, 90 or 365 days. the tab shows how many chats are older than that right now, you can hit run now, and after that it runs every night.
visitors can see and delete their own chat. a shield in the chat header opens "your data", with a download button and a delete button.
when someone emails you asking to be forgotten, you search their email in the privacy tab. you export their chats so they get a copy, then erase them. every step lands in an audit log with what was deleted and when.
the tab also writes a privacy notice page from your settings. it says who's responsible, what's collected and how long it's kept, and which ai company and model answer the chat.
masking runs on patterns, so it has gaps you should know before you trust it.
street addresses aren't masked. a name typed on its own, with nothing around it, can slip through too. there's an ai name check you can switch on to catch more of those.
some long order or tracking numbers look like phone numbers and get masked by mistake.
when the bot asks for an email on purpose, the answer is kept as typed, because the visitor gave it so you can reply. the notice page says so.
the consent card is on the chat on your website. on whatsapp or telegram the bot asks first and waits for a yes. i've only checked that with a test, not in a real chat, so count on the website.
it fits a small business in the eu or uk that wants a chat bot on its site. it gives you a plain answer for whoever asks about your data. something like: they agree first, cards are masked, chats go after 30 days and they can delete theirs.
it won't replace your privacy policy, your records or a lawyer's advice. if your work means people type health or legal details into the chat, read the gaps above twice. an accounting firm or a dental office has its own letter about that.
the privacy tab isn't switched on for new accounts by itself. sign up, then email me to switch it on. once it's on, a privacy tab shows up next to the capture tab, where you pick what the bot asks visitors for. the steps, from consent to the 30-day setting, are in chatbot consent and data retention.
if it's useful, take it. if it's missing something, tell me.
olive