GDPR
GDPR requests, handled where the data lives.
Support is where personal data piles up: names, addresses, order numbers, whole chat transcripts. Replyful keeps it in the EU, deletes it when a customer asks or when your retention period runs out, and asks chat visitors for consent before they type. This page explains what each tool does. It isn't legal advice.
Not better in 90 days? Your subscription back.
- Right to erasureArticle 17
- Delete the contact. Their messages, attachments and chat transcripts are wiped from every case. Your reports keep the counts.
- Storage limitationArticle 5(1)(e)
- Choose how many days closed cases are kept, per inbox. Every night, older ones are erased.
- Right of accessArticles 15 and 20
- The contact page lists every case a person has had with you, with the full conversation. For a machine-readable copy, the read-only API returns their cases and messages as JSON.
- Consent and transparencyArticles 7 and 13
- Show your privacy notice in the chat, with implicit consent, where writing counts as accepting, or explicit, where visitors accept before they write. We save when they did.
- Processor agreementArticle 28
- Our DPA applies from the day you sign up. The sub-processor list is public, and we give 30 days' notice before adding one.
- Transfers outside the EUChapter V
- Conversations, files, backups and the AI stay in EU regions. The US services we use, for sign-in and payments, never see conversation content and run under standard contractual clauses.
What it does
The GDPR work a support team actually does.
Forget a customer in one step
Deleting a contact strips their name, email, phone and every message, attachment, internal note, AI draft and live chat transcript from all their cases, including side threads with suppliers. The cases stay as anonymous shells, so response times, SLAs and satisfaction scores still add up.
Retention per inbox
Set "delete closed cases after N days" on each email inbox and chat. Open and snoozed cases are never touched. Before you shorten the period, Replyful shows how many cases it will erase.
Consent before the first message
Per chat, choose implicit consent, where chatting counts as accepting your notice, or explicit, where visitors press accept before they write. Change your policy and every visitor is asked again. Turn on the AI badge and the chat tells visitors they're talking to an AI, as the EU AI Act asks.
Check who's asking before the AI answers
When the AI looks up an order or an account in your systems, it first checks who it's talking to, with a one-time code by email or the sign-in from your own app. It only returns that person's records. Connecting your systems is on Pro.
A record of every deletion
The audit log shows each erased case, who or what erased it and why: a deletion request or an expired retention period. It also records changes to inboxes, users and knowledge. Roles decide who can read conversations and who can delete contacts.
EU hosting, and AI that doesn't learn from you
The app and database run in Amsterdam, files and email in Frankfurt, the AI in EU regions. Our AI providers don't train models on your conversations. Backups stay in the EU and expire after 30 days.
Getting started
Set it up once. Then it runs on its own.
- 01
Pick a retention period
Decide how long a closed case is useful, say two years for warranty questions, and set it on each inbox and chat.
- 02
Add your privacy notice to the chat
Write a short notice with a link to your privacy policy, translate it per language and choose how visitors accept it.
- 03
Answer requests as they come
Someone asks to be forgotten? Find them under Contacts, delete, type DELETE to confirm. The audit log keeps the proof.
GDPR questions from support teams
Short answers. Your DPO or lawyer has the final say.
Try it on one inbox. Fourteen days, no card.
Not better in 90 days? Your subscription back.