Security & GDPR
Last updated: 13/10/2026
Servers in Italy
Accounts, knowledge bases, conversations and leads are stored on servers in Italy (EU).
No model training
Your documents and conversations are not used to train OpenAI or Google AI models.
Encrypted leads
Name, email and phone of captured contacts are encrypted at rest with AES-256.
DPA on request
Data processing agreement (Art. 28 GDPR) available on the Pro and Ultra plans.
1. Roles: controller and processor
For your account data (name, email, billing) SmartChatAssistant is the data controller, as described in the Privacy Policy.
For the data of visitors who write to your assistant on your website (conversations, leads) you are the controller and SmartChatAssistant acts as data processor under Art. 28 GDPR: it processes that data only to provide the service and according to your instructions.
2. How data flows
- The visitor writes in the widget on your site. If you enable GDPR consent in the widget, the chat starts only after it is accepted.
- The message reaches our servers in Italy, where the context is assembled: assistant instructions, FAQs, knowledge base and the latest messages of the conversation.
- The context is sent to the AI provider chosen for the assistant (OpenAI, Google Gemini or OpenRouter), which generates and returns the reply.
- Question and answer are saved in your assistant's conversation history, visible only to you and your team. The visitor's IP address is stored only as a SHA-256 hash, never in clear.
3. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hosting provider | Application server and database | Italy (EU) |
| OpenAI | Reply generation (if chosen for the assistant) | USA |
| Google (Gemini API) | Reply generation (if chosen for the assistant) | USA |
| OpenRouter | Reply generation (if chosen for the assistant) | USA |
| Stripe | Payments (account billing data only) | USA / Ireland |
Transfers to the United States rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (Art. 46 GDPR). Each assistant uses a single AI provider: the one you choose in its settings.
4. Model training
We use the paid APIs of OpenAI and Google: under their terms, content sent through the API is not used to train their models. The same applies to your documents and knowledge base, which leave our servers only as the context of a single reply.
Exception: the free models available through OpenRouter (marked free) are offered by third-party providers that may log prompts. If you handle sensitive data, choose an OpenAI or Gemini model for your assistant.
5. Security measures
- HTTPS enforced on every connection and a strict Content Security Policy.
- Lead data encrypted at rest with AES-256; passwords protected with bcrypt.
- Two-factor authentication (2FA) available on every account.
- Brute-force protection on login and rate limits on the APIs.
- CSRF tokens on dashboard forms and application-level isolation between accounts.
- Personal API keys (BYOK) stored encrypted.
6. Retention and deletion
- Conversations are automatically anonymised after 30 days (Free), 90 days (Pro) or 365 days (Ultra).
- Visitors can request the export or deletion of their conversations; the platform exposes dedicated endpoints you can link from your site.
- Leads and knowledge base stay until you delete them. When an account is closed (on request to privacy@smartchatassistant.com) we delete its assistants, conversations, leads and documents.
7. Requesting the DPA
On a Pro or Ultra plan you can request the data processing agreement (DPA, Art. 28 GDPR) by writing to privacy@smartchatassistant.com from your account email, stating company name, VAT number and privacy contact. We will send you the document to sign.
8. Contact
For security questions or to report a vulnerability: privacy@smartchatassistant.com