AI Chatbot Privacy Checklist for Your Website

This page describes how our product works. It is not legal advice and it does not tell you what the law requires for your business. If you are unsure, ask a lawyer or your data protection contact.

1. Where is the data stored?

Ask: in which country are the servers and the database? OneType: the app, database and search index run on servers in Nuremberg, Germany (Hetzner). OneType is a product of Divhunt GmbH in Zug, Switzerland.

2. Which AI providers see your visitors' messages?

Ask: which companies process each question, and where are they located? OneType: the provider of the model your agent uses sees each question together with the matching parts of your content, to write the answer: OpenAI or Anthropic, or the provider of your own AI key. Search also uses Mistral (EU) and Voyage AI (US). The full list is on the sub-processors page.

3. Is your content or your visitors' chats used to train AI models?

Ask: is anything used for training, and can it be switched off? OneType: no. OneType does not use your content or your visitors' chats to train AI models.

4. Can other customers see your data?

Ask: how is each customer's data kept apart? OneType: every record belongs to one workspace, every query is limited to it, and search results are checked again so nothing from another workspace can come back.

5. Does the chat set cookies?

Ask: does the widget set cookies or use other browser storage, and what for? OneType: the chat sets no cookies. It keeps the conversation in the browser tab's session storage, tied to your agent and your site.

6. Can you delete or export one person's data?

Ask: what happens when a visitor asks you to delete or export their conversations? OneType: open the person in Contacts and choose Erase contact: it deletes their details and their conversations' content. You can also download everything about them as a file first. Only owners and admins can do this.

7. How long are conversations kept?

Ask: is there a retention period you can set? OneType: conversations are kept until you delete them.

8. Is there a data processing agreement?

Ask: will the vendor sign a data processing agreement (DPA), and who is listed as a sub-processor? OneType: our Data Processing Agreement and the sub-processors list are published on the site.

9. How is the data protected?

Ask: encryption, access, logs. OneType: all traffic is encrypted (HTTPS with HSTS). AI keys, integration tokens and webhook secrets are encrypted with AES-256-GCM; passwords are stored as hashes. Server access is limited to authorised personnel with SSH keys. App logs hide emails, phone numbers, IP addresses and secrets. Each workspace has an audit log you can see, kept for 365 days.

10. Which certifications does the vendor hold?

Ask: SOC 2, ISO 27001? OneType: none today. OneType has no SOC 2, ISO 27001 or other certification at the moment. For security questions write to security@onetype.ai.

11. What does the chat answer from?

Ask: can the chat make things up, and can you see where an answer came from? OneType: answers are written from your own pages and files and show the page they came from. The crawler respects robots.txt, ignores instructions hidden in web pages, and answers may only link to approved sites.

12. What do you tell your visitors?

Whatever vendor you choose, your own privacy policy should say that a chat assistant is used, which providers process the messages, and how someone can ask you to delete their conversations. Ask your lawyer what exactly your site must say.

Quick checklist

Try it: Start free: Add an AI chat to your site.