Settings → Privacy is where you minimize the sensitive data you hold, set a privacy posture, and record your DPA.
One honest framing before the detail: these are best-effort, defence-in-depth controls. They substantially reduce the personal data you store. They are not a guarantee that no personal data is ever stored, and this article isn't legal advice.
Privacy profiles
- Standard — default retention and handling.
- Healthcare — redaction on, minimized data, privacy-forward defaults.
Redaction
Two independent switches, and it's worth understanding the difference:
- Redact identifiers before AI processing — strips email addresses, phone numbers, SIN, card and postal codes from messages sent to the AI, while keeping the topic so it can still answer. Recommended for health intake.
- Redact before storing transcripts — scrubs identifiers (and long ID/record numbers) from visitor and operator messages before they're saved, so your stored transcripts hold minimized data. AI replies are left intact.
"Call me at 604-555-0199 or jane@example.com" → "Call me at
[redacted:phone]or[redacted:email]"
Storage redaction is irreversible by design — the identifiers were never written down. If your operators need to call people back, that's a reason to leave it off, not a reason to be surprised later.
Visitor consent
Under Settings → Widget → Visitor Consent, you can require consent before any non-essential tracking. When enabled, the widget shows a consent notice and keeps these off until the visitor accepts: returning-visitor tracking, proactive engagement, and Live Visitors presence.
The chat itself always works — consent gates the tracking, not the help.
Enable this for audiences covered by GDPR/UK GDPR or the ePrivacy Directive. It's off by default.
Retention
Chat history is retained for the number of days set under Settings → AI & Engagement → Chat History Retention, then deleted. That same number appears in your DPA, so set it deliberately.
How do I honour an access or deletion request?
From History, open any conversation with that visitor:
- ⬇ Export visitor data — everything held for them, as JSON.
- 🗑 Delete visitor data — erases all of their conversations, messages, files, AI memory, and their visitor record. Not just the one you're looking at.
Deletion cannot be undone. See Conversation history.
The Data Processing Agreement
Accept DPA on the Privacy page records your acceptance — the version, who accepted, and when — for your compliance file. View / print DPA produces the full document, which you can print or save as a PDF.
It covers roles and scope, sub-processors, international transfers (data is hosted
in Canada, AWS ca-central-1), security measures, retention and deletion, data
subject rights, breach notification, and audits.
It is a configurable template generated for your convenience, not legal advice. Review it with qualified counsel before relying on it.
Public privacy statement
Also on the Privacy page: a short statement shown to your visitors. Use it to say plainly what you do — "We redact sensitive details and don't retain clinical information." If you've turned redaction on, tell people. It's the whole benefit of having done it.