GDPR and the EU AI Act
GDPR and the AI Act, in plain English.
How FrontDesk handles your customers' data, what they are told, and what you control. Short version: your data stays yours, it is stored in the EU, it is never used to train AI, and every customer knows they are talking to an AI.
Who is responsible
Your customers. Your data.
You are the controller
Your customers' messages, photos and bookings belong to your business. You decide what happens to them.
We are your processor
FrontDesk processes that data only to answer and book for you, on your instructions, under Article 28 of GDPR.
A DPA is available
A standalone Data Processing Agreement is available for every client. Ask for it by email.
Request the DPA →Where data lives
Stored in the EU. Never used to train AI.
Storage and AI
- Customer conversations, contacts and campaigns are stored in the EU, in Germany
- AI language models from third-party providers process messages only to reply for you
- Your data is not used to train AI models, and providers may not use it for their own purposes
- Transfers outside the EU are covered by the European Commission's Standard Contractual Clauses
- No analytics or tracking cookies on the chat
How long it is kept
- Conversations: 12 months after the last message
- Account data: while you are a client
- When you leave: deleted or anonymised within 30 days
- Backups: cleared within 90 days of a deletion request
- Financial records: 6 years, as Irish law requires
The EU AI Act
Every customer knows it is an AI.
The EU AI Act says people must be told when they are talking to an AI. FrontDesk does this in its first message, every time.
Disclosed in the first message
A short, friendly line: they are chatting with your AI assistant, and a person is available.
STOP means stop
Anyone who replies STOP is never messaged again, and is removed from follow-ups and campaigns.
A person when it matters
Medical questions, complaints, refunds and anything sensitive go to you. It never gives medical or legal advice.
What you control
Settings you can switch on.
Consent before the chat
A short form on website chat: name, number and consent to your privacy policy.
Transcripts
Every conversation is kept in your FrontDesk app, and can be emailed to you.
Delete on request
A customer asks, we delete. Requests are handled within 30 days.
Block numbers or countries
Stop the assistant answering a number or a whole country.
Who sees what
Staff see only the chats assigned to them. Denis accesses conversations only to set up, fix and improve your assistant.
When it answers
Around the clock, or only outside your hours.
Sub-processors
Who else touches the data.
The same list is in our privacy policy, with locations and safeguards.
This page is a plain-English summary, not legal advice. The Privacy Policy and Terms of Service are the binding versions.
FAQ
Data and privacy questions.
Is FrontDesk GDPR compliant?
Yes. You are the data controller and FrontDesk is your processor. Data is stored in the EU, never used to train AI, transfers are covered by Standard Contractual Clauses, and a Data Processing Agreement is available.
Do I need to tell my customers I use an AI?
FrontDesk tells them in its first message, as the EU AI Act requires. It is also good practice to mention it in your own privacy notice.
Can a customer ask for their data to be deleted?
Yes. They can reply STOP or ask you, and we delete it. Requests are handled within 30 days.
Who can read my customers' messages?
You and the staff you assign. Denis accesses conversations only to set up, fix and improve your assistant.
Where is the data stored?
In the EU, in Germany. AI processing uses providers in the US under Standard Contractual Clauses, and your data is not used to train their models.
Is a Data Processing Agreement available?
Yes. A Data Processing Agreement is available on request. Ask Denis on your demo or email [email protected].
Has FrontDesk been security tested?
Yes. It is security-tested on every release, with regular independent scans and a penetration test. The test summary is available on request.
What happens if Denis is unavailable?
Your assistant keeps working without him: it answers, books and follows up on its own, day and night. A technical partner with access covers urgent changes if Denis is away, and if a channel ever disconnects you both get an email straight away.
Questions about your data? Ask Denis.
Book a free 15-minute call, or email [email protected] for the Data Processing Agreement.