ChatFrom privacy, security and hosting
Updated
Where ChatFrom keeps data, GDPR and the DPA, the services that process data, how long conversations are kept, and the security built in.
Where is my data stored?
In Frankfurt, Germany. ChatFrom's website, app and engine run on Hostinger servers in Frankfurt, and the database (Supabase) is in Frankfurt too, on every plan. The AI model that writes each answer runs at its maker, mostly in the United States, reached through OpenRouter. OpenRouter is told to use only the chosen model's own maker, never another company that also runs it.
Is ChatFrom GDPR compliant?
ChatFrom is run by a German company and hosted in Germany. For the chats on your website, you are the controller and ChatFrom processes the data on your behalf (Art. 28 GDPR). The data processing agreement (DPA) is part of the terms you accept when you sign up, so there is nothing extra to sign, and every sub-processor is named in it. The privacy policy is at chatfrom.io/privacy-policy and the DPA at chatfrom.io/dpa.
Which services process data for ChatFrom?
- Hostinger: hosting the site, the app and the engine, in Frankfurt.
- Supabase: the database and sign-in, in Frankfurt.
- Resend: sending sign-in links, hand-off notices and verification codes, and receiving email sent to a chatbot's address.
- OpenRouter, and the model provider the chatbot's owner chose: writing answers.
- Stripe: payments, invoices and VAT.
- Sentry: error reports, in its region in Germany.
- Axiom: the server's technical log, without the content of chats.
- DataFast: counting page views on chatfrom.io without cookies.
Where data leaves the European Economic Area, the transfer rests on an adequacy decision such as the EU-U.S. Data Privacy Framework, or on standard contractual clauses.
Is my data used to train AI models?
No. Nothing you put into ChatFrom is used to train any model of ChatFrom's, and ChatFrom asks OpenRouter for providers that do not train on what passes through them.
How long are conversations kept?
Under Settings, Privacy, you choose: keep them until you delete them, or delete them 30 days, 90 days or 1 year after the last message. On the Free plan, conversations are kept 14 days after their last message, whatever you choose, and your choice applies once you upgrade. Every night, older ones are deleted with their messages and files, what the chatbot remembers about people and has not updated since, and callback requests for calls before then. When a paid plan ends, nothing is deleted for 30 days.
How do I handle a data request from someone who chatted with my chatbot?
Search Conversations by the email they gave or their visitor id. Under a conversation you can download or delete it, or everything about that person: every conversation with the same visitor id, what the chatbot remembers about them, and their callback requests.
Can I export or delete my account?
Yes, under Account in the sidebar: download everything your account holds as one JSON file, or delete the account. Deleting ends any subscription and removes every chatbot with its sources and conversations, and your sign-in. You confirm by typing your email, and it cannot be undone. Deleting a chatbot deletes what it knew with it.
What does the widget store in a visitor's browser?
A random visitor id and a copy of the last messages of the conversation, so a reload keeps the chat. By default they are kept only until the tab closes. With Remember returning visitors on (which needs the visitor's consent in the EU), they stay longer and the conversation is shown again for up to 30 days. No analytics runs in the chat on your website.
How does ChatFrom keep chatbots secure?
Built in on every plan, the Free plan too, with nothing to switch on:
- Your data stays yours: each chatbot's knowledge is kept apart and answers only that chatbot.
- Signed-in users stay private: a user's token goes only to your own server, never to other tools or logs.
- Allowed domains: the widget runs only on the sites you list.
- Answers checked: phone numbers, choices and links are validated before your tools see them.
- Limits built in: rate limits per visitor and per address, and a monthly allowance of answer credits.
- No errors shown to visitors: a failure becomes a polite message, and the reason goes to you.
- Secrets encrypted: API keys, tokens and passwords for your connections are stored encrypted and never shown again.
- Instructions in sources ignored: the chatbot treats your documents as information, never as orders, and warns you about suspicious text.
Does ChatFrom follow the EU AI Act?
ChatFrom tells visitors they are talking to an AI by default ("You're chatting with an AI assistant"), as the EU AI Act requires unless it is already obvious. Under ChatFrom's terms, you must make sure people know they are talking to an AI, and must not let a chatbot take decisions with legal or similarly significant effects without a person reviewing them.