Chatbot GDPR & Privacy Compliance

Aimogen’s chatbot system includes explicit privacy and GDPR-aware controls, but compliance is not automatic. The plugin provides the tools; you decide how data is collected, stored, disclosed, and restricted. This document explains what Aimogen does, what it does not do, and how to configure chatbots responsibly in regulated environments.

---

Core Principle #

Aimogen chatbots are not autonomous data collectors.

Nothing is:

• collected silently
• sent without configuration
• stored without purpose
• shared without provider involvement

All privacy-relevant behavior is explicitly configured.

---

Data That a Chatbot May Process #

Depending on configuration, a chatbot may process:

• user messages
• conversation history
• uploaded images (vision chatbot)
• voice input (voice chatbot)
• user identifiers (logged-in users)
• voluntarily provided personal data (email, name, phone, etc.)

If a feature is not enabled, the data is not processed.

---

AI Providers and Data Flow #

When a chatbot is used:

• messages are sent to the selected AI provider
• processing happens on the provider’s infrastructure
• responses are returned to the site

Aimogen acts as a controller-side integration, not a data processor proxy.

You are responsible for:

• selecting compliant providers
• reviewing their data processing terms
• informing users of third-party data transfer

---

GDPR Consent Gate (Frontend Chatbots) #

Aimogen can require explicit consent before allowing chatbot interaction.

When enabled:

• users must accept a privacy or GDPR notice
• chat input is blocked until consent is given
• consent text is customizable

This applies only to frontend chatbots and is optional but strongly recommended in the EU.

---

What Consent Controls Do (and Don’t) #

Consent gating:

• blocks interaction until accepted
• ensures user acknowledgment
• prevents accidental data submission

Consent gating does not:

• anonymize data
• override provider policies
• retroactively protect previous chats
• replace a privacy policy

It is a gate, not a shield.

---

Conversation Logging and Storage #

Chatbot conversations may be:

• logged
• partially stored
• persisted across sessions

This depends on:

• logging settings
• persistence settings
• user state (guest vs logged-in)

You can:

• disable logging entirely
• limit retention
• restrict persistence

If logging is disabled, conversations are not stored locally.

---

Guest Users vs Logged-In Users #

Privacy impact differs by user type:

Guest Users #

• typically tracked via browser/session context
• persistence may rely on cookies or local storage
• clearing browser data removes history

Logged-In Users #

• conversations may be associated with the user account
• persistence is more reliable
• data falls under account-related personal data

You should document this distinction in your privacy policy.

---

Lead Collection and Personal Data #

Chatbots can be instructed to collect personal data only if you configure them to do so.

Examples:

• email address
• name
• phone number

Important rules:

• collection must be intentional
• users must be informed
• purpose must be clear
• storage must be justified

Aimogen does not auto-collect personal data.

---

Image and Voice Privacy Considerations #

Image Chatbot #

• uploaded images are sent to the AI provider
• images may contain personal or sensitive data
• Aimogen does not sanitize or anonymize images

Voice Chatbot #

• voice input is converted to text
• audio may be processed by provider tooling
• voice data may be considered biometric data in some jurisdictions

These features require explicit disclosure.

---

Backend Chatbot (Admin Use) #

The backend chatbot (Playground):

• is admin-only
• does not require GDPR consent
• still sends data to AI providers
• still consumes API quota

Admin usage is not user-facing but still subject to provider terms.

---

Data Retention and Deletion #

Aimogen:

• does not enforce retention periods
• does not auto-delete chat history
• does not anonymize stored conversations

You must:

• define retention rules
• handle deletion requests
• comply with “right to be forgotten” where applicable

This is a site-level responsibility.

---

What Aimogen Does Not Do for You #

Aimogen does not:

• generate a privacy policy
• ensure GDPR compliance automatically
• anonymize personal data
• filter sensitive user input
• prevent users from sharing personal information
• sign data processing agreements on your behalf

Compliance is a configuration and policy task.

---

Recommended Compliance Checklist #

Before enabling a frontend chatbot:

• update your privacy policy
• disclose AI provider usage
• enable consent gating if required
• review logging and persistence settings
• avoid unnecessary data collection
• test guest and logged-in behavior
• document retention and deletion procedures

For voice and image chatbots, add additional disclosures.

---

Best Practices #

• keep chatbot personas conservative
• instruct bots not to request sensitive data
• avoid storing conversations longer than necessary
• disable persistence when not needed
• prefer opt-in over opt-out
• audit provider policies regularly

Treat chatbots like forms, not toys.

---

Summary #

Aimogen provides the mechanisms needed for GDPR- and privacy-aware chatbot deployments, but it does not make legal decisions for you. Consent gating, logging controls, persistence options, and data collection are all configurable, explicit, and optional. Proper compliance depends on how you configure these tools, how you inform users, and how you manage data lifecycle and provider relationships.