GDPR and AI in customer service: what you may do with data
Legal basis, data processing agreements, EU storage and the AI Act's transparency rules for chatbots. What must be in place before AI reads your tickets.
Here we collect information on data handling, access and review. Bring the questions from your IT or procurement team to a walkthrough.
All customer data in Supportifier is stored within the EU/EEA and is never used to train AI models. A data processing agreement is signed with every customer as standard and retention periods are governed by contract. Sign-in uses SSO with domain restriction, there are permission levels, and customer data is separated at the database level. The language model runs with zero data retention, so ticket content is not kept by the provider after an answer is generated.
People and AI
Automatic answers, reviewed drafts and human handling are used depending on the question and the source material. Customer data should not be published as help articles.
How the knowledge is usedAll customer data in the service is stored within the EU/EEA. We make no third-country transfers of customer data in the service. Visitor statistics on the website are a different matter: they are processed by Google, OpenAI and Apollo after your consent, as described on the cookie page.
No. Customer tickets are not used to train AI models, neither ours nor the provider's. Approved answers improve the suggestions within your own account, and that learning happens only there. The data is never shared with other customers.
Draft answers are generated by a language model from Anthropic, run with zero data retention. The content is processed when the answer is generated and is not kept by the provider afterwards. The only storage is in our own service, with the retention periods stated in the privacy policy.
Yes. When we process email and customer data on behalf of a customer, the customer is the data controller and Supportifier the data processor. A data processing agreement is signed with every customer as standard, and retention periods are governed there.
Sign-in uses SSO with domain restriction, so only accounts on your own domain can log in. There are permission levels for different roles, and customer data is separated at the database level so one customer never sees another's. What may be shown in the help centre, the chat and the customer portal is decided per channel.
Next step
Tell us how you work today and what you need answered.