A GDPR-compliant AI chatbot is one where you, the website owner, can prove who processes your visitors' messages, where those messages are stored, which sub-processors see them, how long they are kept and how a visitor gets them deleted, all backed by a signed processor agreement and a clear "you are talking to an AI" notice. No vendor can sell you compliance as a feature: you remain the controller, and your job is to pick a processor whose contracts and architecture let you meet your obligations.
One point trips up most buyers: "hosted in the EU" is not the same as "no data leaves the EU". Almost every AI chatbot, Heeya included, stores conversations in Europe but sends message content to a model run by a US provider to generate each answer. The honest question is which transfers happen, and under which safeguards.
This guide is for SMB and SaaS teams in the UK, Ireland, Germany, the Netherlands, the Nordics and Belgium looking for a European alternative to Intercom, Zendesk or Chatbase: what the law requires, a 10-question vendor checklist, seven tools compared on 23 October 2026, and a rollout plan. Heeya is one of the tools reviewed; we apply the same criteria to it and say where competitors go further.
Quick summary
- Shared duty: you are the controller, the vendor is your processor, and you need a DPA before go-live
- EU hosting covers storage, rarely inference: most tools send messages to US-run models
- European-built: Heeya, Crisp (France), Smartsupp (Czech Republic), Tidio (data mainly in the EEA)
- US with EU options: Intercom (Advanced and Expert) and Zendesk (Suite Professional+); Chatbase processes data in the US
- AI disclosure: required by Article 50(1) of the EU AI Act from 2 August 2026
Table of Contents
- What a GDPR-Compliant AI Chatbot Actually Requires
- Chatbot GDPR Compliance Checklist: 10 Questions for Vendors
- European AI Chatbots vs US Incumbents: 2026 Comparison
- Heeya: What It Does and Does Not Promise on Data
- Rolling Out an EU-Hosted Chatbot: Privacy Notice, Retention, DPA
- FAQ: GDPR-Compliant AI Chatbots and European Alternatives
What a GDPR-Compliant AI Chatbot Actually Requires
An AI chatbot processes personal data the moment a visitor types a name, an email or an order number. The GDPR does not ban that; it requires you to know the data flow end to end and to have a contract with every party that touches it.
Controller, processor and the DPA
You decide why and how the chatbot is used, so you are the controller; the vendor is your processor. Article 28 of the GDPR says you "shall use only processors providing sufficient guarantees", and that the processing "shall be governed by a contract or other legal act" setting out its subject matter, duration, purpose and the types of data involved.
That contract is the Data Processing Agreement (DPA). It names the sub-processors, the transfer mechanisms outside the EEA, the security measures and what happens to the data when you leave. The LLM provider behind the chatbot is one of those sub-processors.
Where data is stored is not where it is processed
A chatbot has two data paths. Storage holds conversations, your knowledge base and collected contact details. Inference sends the visitor's question and retrieved passages to a language model to produce an answer.
Many European vendors store data in the EU but call a US-based model for inference. That is lawful under the EU-U.S. Data Privacy Framework (DPF) or the Commission's Standard Contractual Clauses (SCCs), provided the vendor says so plainly. Read the sub-processor list, not the landing page.
Retention, visitor rights and AI transparency
Three further duties apply to every deployment:
- Retention and deletion: set how long conversations are kept, and be able to delete one or all of them on request.
- Data subject rights: visitors can ask you for access to, or erasure of, what they wrote; your vendor must help you answer.
- Transparency: your privacy notice must mention the chatbot, its purpose, its processors and any transfers. On top of that, Article 50(1) of the EU AI Act requires AI systems "intended to interact directly with natural persons" to be designed so that people "are informed that they are interacting with an AI system". Under Article 113, that rule applies from 2 August 2026.
Legal basis, DPIA and sector rules are covered in our GDPR chatbot legal guide; this page is about choosing the vendor.
Chatbot GDPR Compliance Checklist: 10 Questions for Vendors
Send these ten questions to every shortlisted vendor. A serious vendor answers in writing, pointing to a contractual document rather than a marketing page.
| # | Question to ask | What a good answer looks like |
|---|---|---|
| 1 | Will you sign a DPA under Article 28? | Yes, with the sub-processor list attached |
| 2 | Where are conversations and the knowledge base stored? | A named provider and country or region, not just "the cloud" |
| 3 | Which AI providers receive message content, and where do they process it? | Named models and providers, with the region and transfer mechanism for each |
| 4 | Is my data used to train any model? | No, by the vendor or its AI providers, stated in the contract |
| 5 | Do AI providers retain prompts, and for how long? | An honest answer: many keep requests briefly for abuse monitoring |
| 6 | How long are conversations kept, and who can change that? | A documented default plus a way for you to delete earlier |
| 7 | How do I handle a visitor's access or erasure request? | A process with a deadline, per conversation or full history |
| 8 | Does the widget set cookies or trackers? | A precise list for your cookie banner decision |
| 9 | How does the widget tell visitors they are talking to an AI? | A visible label or message by default |
| 10 | What happens to my data when I cancel? | Export available, then deletion within a stated period |
Questions 3 and 5 separate marketing from reality: a vendor that cannot name its LLM providers, or claims nothing is ever retained, has not checked. For the wider trade-offs between European and American vendors, see our French vs US AI chatbot comparison.
European AI Chatbots vs US Incumbents: 2026 Comparison
Every cell below comes from the vendor's own privacy policy, terms, sub-processor list or pricing page, checked on 23 October 2026. Where a detail is not published, we write "check the vendor's DPA" rather than guess. Prices change often; treat them as a snapshot.
| Tool | Company base | Where customer data is stored | EU data residency | DPA | AI sub-processors (as published) | Pricing model (23 Oct 2026) |
|---|---|---|---|---|---|---|
| Heeya | France (Tensoria) | OVH in France; databases in EU regions | Yes, by default (storage) | Processor under Art. 28; commitments in terms and privacy policy, signed addendum on request | Google, OpenAI; may process outside the EU under SCCs or DPF | Flat: €19 or €99/month; Enterprise on quote |
| Crisp | Nantes, France | Core infrastructure in Amsterdam, Netherlands | Yes, by default | Yes, part of the general terms, downloadable in-app | LLM providers "such as OpenAI"; regions: check the vendor's DPA | Flat per workspace: free tier (no AI), then $45 to $295/month with AI credits |
| Tidio | Tidio LLC (San Francisco) and Tidio Poland (Szczecin) | "Mainly" within the EEA | Mostly EEA; some transfers to the US | Yes; DPF plus SCCs as fallback | OpenAI (EU), Google Cloud (EU), Anthropic (US) | Plan + Lyro by conversations: Starter $24.17/month; Lyro from $32.50/month for 50 |
| Smartsupp | Brno, Czech Republic | AWS EMEA, "EU hosting center" | Yes (storage) | Yes, Data Processing Terms | OpenAI Ireland Ltd. (EU entity) | Plan + Mira AI by conversations: Solo $17/month; Mira from $16/month for 100 (annual) |
| Intercom | US company | US by default; EU or Australia on request | Yes, new workspaces on Advanced or Expert, on a contract | Yes, Data Processing Addendum | EU-hosted workspaces: OpenAI, Google, Microsoft listed as "AI processing (EU)" | Per seat + per outcome: Essential $29/seat monthly, Advanced $85, Expert $132 (annual); Fin $0.99 per outcome |
| Zendesk | US company | EEA only through the Data Center Location add-on | Yes, free on Suite Professional and above, activated on request | Yes; Binding Corporate Rules and DPF | OpenAI, Microsoft, Google, Mistral AI and others; regions: check the vendor's DPA | Per agent + resolutions: Suite Team £45, Professional £89/agent/month yearly (UK site); extra resolutions £1.30 to US$2.00 |
| Chatbase | US (Chatbase Inc.) | AWS us-east-1, United States | No EU option published | Yes; EU SCCs for EEA transfers | Listed in its trust centre; check the vendor's DPA | Message credits: Hobby $40/month ($32 annual), Standard $150, Pro $500 |
Sources: each vendor's privacy policy, DPA or terms, sub-processor list and pricing page, consulted 23 October 2026. Prices in the currency each vendor displayed.
European-built tools: Crisp, Tidio, Smartsupp
Crisp is French, runs its core infrastructure in Amsterdam and ships its DPA inside the standard terms. Its AI (Hugo) calls external LLMs "such as OpenAI". Per-workspace pricing suits teams with several human agents. See our Crisp alternatives guide.
Tidio is the most transparent on AI: its AI terms name OpenAI and Google Cloud (EU) and Anthropic (US), and forbid training on customer data. Data is "mainly" processed in the EEA, and Lyro is billed by conversation volume. See Heeya vs Tidio.
Smartsupp (Brno) stores data with AWS in an EU hosting centre and uses OpenAI's Irish entity for AI. It is live chat first, with the Mira AI agent sold separately. Our Smartsupp alternatives page compares it with AI-first tools.
US incumbents: Intercom, Zendesk, Chatbase
Intercom does offer EU data hosting, and goes further than most: for EU-hosted workspaces, it lists OpenAI, Google and Microsoft as "AI processing (EU)". The catch is access: only new workspaces on Advanced or Expert plans under a contract, and billing and admin data can still go to the US. For cheaper routes, see our Intercom alternatives for SMBs.
Zendesk offers a DPA, Binding Corporate Rules, DPF certification and a free EEA data centre option. That option needs Suite Professional or higher, must be requested and excludes third-party integrations; data may still be processed elsewhere "as reasonably necessary to provide the Services". Our Zendesk alternatives page has the full pricing breakdown.
Chatbase runs on AWS us-east-1 and states that information "will be processed in the United States", with SCCs for EEA transfers. Lawful, but there is no EU residency to choose. See Chatbase alternatives.
Flat, per-seat or per-resolution pricing
Per-resolution billing (Intercom Fin, Zendesk automated resolutions) and per-conversation AI add-ons (Tidio Lyro, Smartsupp Mira) grow with traffic. Per-seat billing grows with headcount. Flat plans (Heeya, Crisp per workspace) cap the bill but also cap volume. Our guide on how much an AI chatbot costs runs the numbers at different volumes.
Heeya: What It Does and Does Not Promise on Data
Heeya is an AI chatbot built by Tensoria, a French company. It answers visitors from your own documents using retrieval-augmented generation (RAG) and installs on any website with one script tag.
Where your data lives and who sees it
- Storage in Europe: the app and your data (conversations, knowledge base) are hosted on OVH in France, with databases in EU regions.
- Inference with US providers: to generate answers, conversation content is sent to AI providers (Google and OpenAI) that may process it outside the EU, under Standard Contractual Clauses or the Data Privacy Framework depending on the provider.
- No training: conversations are not used to train models, by Heeya or its providers. AI providers may keep requests temporarily, solely to detect abuse.
- Roles: you are the controller, Heeya your processor. Visitor identification details are not passed to the AI model, and no IP address is stored with conversations.
So Heeya is EU-hosted, not EU-only. On inference location, an EU-hosted Intercom workspace goes further; Heeya's difference is access, with EU storage by default on every plan from €19/month, no sales contract.
Plans and features
- Standard, €19/month: 1 agent, 500 messages/month, 1,000,000 characters of knowledge base.
- Premium, €99/month: 3 agents, 2,500 messages/month, 3,000,000 characters, plus support tickets, visitor identification and form connectors (webhook and HubSpot).
- Enterprise: on quote. Billing is in euros only.
- Trial: 7-day free trial on Standard, no credit card required.
Every plan answers from your PDF, DOCX, PPTX and TXT files or website URLs and includes a contact form for callback requests. An answer reliability score flags weak replies. Current limits are on the Heeya pricing page.
Honest limitations
Heeya answers in French and English only, a real gap if your customers write in other languages. It is a website chatbot, with no voice and no multi-agent helpdesk with SLA routing; teams that need those should pair it with a helpdesk or look at Zendesk or Crisp. For the support use case Heeya targets, see the AI customer service chatbot page.
Rolling Out an EU-Hosted Chatbot: Privacy Notice, Retention, DPA
Four steps turn a compliant tool into a compliant deployment.
Update your privacy notice
Add a chatbot section to your privacy notice covering:
- the purpose and the legal basis you rely on
- the vendor as processor, and its AI providers as sub-processors
- any transfer outside the EEA and the safeguard used (SCCs or DPF)
- how long conversations are kept, and how visitors exercise their rights
Heeya's privacy policy lists its hosting, AI providers and visitor data in a form you can mirror.
Decide retention and deletion
Choose a retention period you can justify and check the tool can honour it. On Heeya, conversations are kept as long as the assistant exists and deleted with it; deletion of one conversation or the full history can be requested at [email protected] and is done within 30 days. Do not ask visitors for health or financial details in the chat.
Sign the DPA and set the AI disclosure
Before go-live, check the processor commitments (Heeya sets them out under Article 28 in its terms and privacy policy, and a separate signed addendum is available on request) and file the sub-processor list with your records of processing. Then check the AI disclosure. Heeya's widget shows "I'm an AI, but not without flaws!" under the chat by default, and the greeting names the assistant. Keep wording of that kind visible to meet Article 50, and read our EU AI Act chatbot compliance checklist if your use case could be high-risk.
FAQ: GDPR-Compliant AI Chatbots and European Alternatives
Is there a European alternative to Intercom?
Yes. Crisp (France), Smartsupp (Czech Republic) and Heeya (France) store customer data in the EU by default, and Tidio says it mainly processes data in the EEA. Heeya fits teams that want an AI agent answering from their own documents at a flat price (from €19/month); Crisp suits teams that need a shared inbox for human agents. Intercom itself offers EU hosting, but only for new workspaces on Advanced and Expert plans under a contract.
Is Intercom GDPR compliant?
Intercom provides a Data Processing Addendum, publishes its sub-processors and offers EU regional hosting for new workspaces on Advanced and Expert plans. For EU-hosted workspaces, it lists OpenAI, Google and Microsoft as AI processing in the EU; billing and admin data may still leave the region. Compliance then depends on how you configure and document the deployment, because you remain the controller.
Does an AI chatbot need a DPA?
Yes, as soon as it processes personal data on your behalf, which almost every website chatbot does. Article 28 of the GDPR requires a contract setting out the subject matter, duration, purpose, types of data and each party's obligations. That contract is the DPA, and it should list the vendor's sub-processors, including the AI model providers.
Can a chatbot hosted in the EU still send data to the US?
Yes, and most do. EU hosting usually covers storage, while answers are generated by models from providers such as OpenAI, Google or Anthropic that may process messages outside the EU. That is lawful under SCCs or the Data Privacy Framework, but it must appear in the sub-processor list and your privacy notice. Heeya is in this situation: data is stored in Europe, while Google and OpenAI may process conversation content outside the EU.
Do I have to tell visitors they are talking to an AI?
Yes. Article 50(1) of the EU AI Act requires AI systems that interact directly with people to inform them they are interacting with an AI system, unless it is obvious from the context. It applies from 2 August 2026. A visible label or greeting in the chat widget is the simplest way to comply.
Which AI chatbots offer EU data residency?
As of 23 October 2026, Heeya (OVH, France), Crisp (Amsterdam) and Smartsupp (AWS EU hosting centre) store data in the EU by default, and Tidio mainly processes data in the EEA. Intercom offers EU hosting on Advanced and Expert plans for new workspaces, and Zendesk an EEA data centre on Suite Professional and above, on request. Chatbase states that data is processed in the United States.
Looking for an EU-hosted AI chatbot at a flat price?
Answers from your own documents, data stored in Europe, AI providers named. From €19/month, no per-resolution billing.
