Chat privacy

What should a privacy policy say when you have a chat on your website?

When you have a chat on your website, your privacy policy must say what it keeps, for how long, and what it stores in the browser. Muzau provides this text, in French or English, and its chat follows it. A conversation that stays anonymous is deleted 30 days after its last message, the fingerprint of the IP address within 48 hours, and the browser identifier is used only to find the conversation again. It is up to you to add it, with your contact address.

Why a chat has to be declared in your privacy policy

A form collects what the visitor chooses to send, field by field. A chat receives sentences typed as the exchange goes on, often by someone who leaves no name or address and will never come back to claim anything. Yet those messages are kept, read by a provider that writes the reply, and a small identifier stays in the browser to find the conversation again.

Your policy must say so in plain words: what is kept, for how long, who processes it, who to write to. This text binds your company, not your tool: it must only promise what the chat really does. This is the part Muzau gives you ready; reviewing and publishing it remain yours.

How the agent goes about it

Input

Your chat agent, created in Muzau

It does

Provides the notice for your visitors, then keeps to its deletion deadlines

It delivers

A text to paste into your policy, in French or English

A ready-made text for your privacy policy, in French or English

On your chat agent's page, Muzau shows the text to add to your privacy policy, in French or English depending on your account's language. It speaks to your visitors, in your company's name, and presents Muzau as the provider that supplies the chat on your behalf. The ready-to-send message for the person who manages your website contains it too, with the line of code to paste: see putting a chatbot on your company's website. All that is left is to write your contact address into it.

An anonymous chat conversation is deleted after 30 days

A conversation where the visitor left no address, name or number is deleted 30 days after its last message, with nothing for you to do. One where they left their email or phone, or whose request was passed on to you, is not deleted at 30 days: it joins your customer exchanges and follows their retention period. Until then, you read the 20 most recent conversations on the agent's page, each in full.

The visitor's IP address is never kept

The chat limits the number of conversations opened from the same connection, to slow down automated sending. For this it relies on a technical fingerprint derived from the IP address, deleted from all conversations after 48 hours at most, including those that remain. The address itself is never stored.

An identifier to find the conversation again, not an advertising cookie

The chat stores an identifier in the browser that is used only to find the conversation again. A visitor who closes the tab and comes back the next day finds it again, from the same browser, and a button lets them start a new one. It is not an advertising cookie: it does not follow the visitor to other sites. In private browsing, or if the browser blocks storage, the chat works but does not keep the conversation from one visit to the next.

What the GDPR notice for a chat must contain

Whatever the tool, a visitor should be able to read in a minute what happens to what they type. Six points are enough:

• Who provides the chat: your company, and the provider acting on its behalf.
• What is kept: the content of the conversation, the page the visitor writes from, and what they choose to leave, an email or a number.
• For how long: one period for the anonymous conversation, another for one that becomes a customer exchange. A number of days beats "as long as necessary".
• What stays in the browser: an identifier or a cookie, what it is for, how to delete it.
• Where the message goes: if it is read by an artificial intelligence provider, say so, and say in which country.
• Who to write to in order to access, correct or delete their data: an address that actually receives emails.

Three mistakes come up again and again. Writing "no data is kept" when the conversation is. Copying another site's policy, which describes another tool. Changing tool or setting without rereading the text. The "Artificial intelligence" notice shown in the chat is a different question: see should you tell a customer they are talking to an AI. For the GDPR principles applied to AI, the AI glossary sums them up; it is not a substitute for legal advice.

What it does not do

• It does not publish the text for you: it is up to you to add it to your privacy policy and write your contact address into it.
• It does not delete at 30 days a conversation where the visitor left their email, name or number, or that was passed on to you: it joins your customer exchanges.
• It does not keep the conversation from one visit to the next in private browsing, or when the visitor's browser blocks storage.

Frequently asked questions

Does the website chat set a cookie?

The Muzau chat stores a technical identifier in the browser that is used only to find the conversation again if the visitor comes back. It is not an advertising cookie, and it does not follow the visitor to other sites.

How long are chat conversations kept?

With Muzau, a conversation that stays anonymous is deleted 30 days after its last message. If the visitor left their email, name or number, or if their request was passed on to you, it joins your customer exchanges. The fingerprint derived from their IP address is deleted after 48 hours at most.

Where are the chat messages hosted and processed?

The Muzau application and its database are hosted in the Paris region. The text of the messages is processed by AI models from providers based in the United States, under standard contractual clauses: the notice Muzau provides says the message is passed to an artificial intelligence provider.

Does a returning visitor find their chat conversation again?

With the Muzau chat, yes: from the same browser, even the next day, and even if they closed the tab mid-reply. A button lets them start a new conversation. In private browsing, the conversation is not kept from one visit to the next.

Can the chat give a customer's information to someone pretending to be them?

No. An address typed into a chat does not prove who someone is: the Muzau chat treats every visitor as an outsider and gives no information specific to a customer, neither their file nor the appointments they have already booked. What you keep for your team never enters its replies. If you let it consult a spreadsheet, a schedule or a stock list, what it reads there can be used in its replies: that is your choice.