Privacy and GDPR notes

This page describes what the widget collects and where it goes, so you can describe PepoChat correctly in your own privacy policy. It is practical guidance, not legal advice. PepoChat's own policy is at pepochat.com/privacy.

What the widget collects

When a visitor opens the chat, the widget creates an anonymous session and records: browser and operating system, screen and viewport size, language, timezone, whether cookies are enabled, the page's origin as reported by the browser, and the widget's own address. Nothing is read from your page's content or cookies; the chat runs in a separate frame.

As the visitor chats, their messages are stored with the conversation. If they verify an email or give a name and email while booking, those are stored on the session. Votes (👍 / 👎) are stored with the conversation.

What the widget does not do

• It sets no cookies on your site. Its session identifier lives in the widget's own browser storage.
• It does not track visitors across sites.
• It does not send anything until the chat window is opened; a preloaded widget only reads your public widget settings.

Where data goes

Messages go to PepoChat's servers so the agent can reply and your team can follow up. Replies are generated by OpenAI models; the content sent is the conversation and the retrieved passages from your knowledge base. Verification emails are sent through Resend. If you connect integrations, the inputs the agent collects (an order number, an email) are sent to that tool over HTTPS, and only the fields you allow come back.

Retention

• Visitor sessions last 24 hours and are extended while the visitor chats. A session with no conversation is deleted a day after it expires; sessions attached to a conversation are kept with it.
• Conversations stay in your team inbox until you remove them.
• Knowledge sources are yours to delete at any time; deleting one removes its content from the agent immediately.
• Finished import jobs are cleaned up after 30 days.

For your privacy policy

State that your site uses PepoChat for support chat; that messages typed into the chat, and any email address the visitor chooses to give, are processed by PepoChat (operated by PepoCloud LLC) to answer and route the conversation; and name the connected tools whose data the agent looks up on the visitor's request. Link to PepoChat's privacy policy and terms. If you operate under GDPR, list PepoChat as a processor and the AI model provider as a sub-processor.

We do not currently claim a specific hosting region, a signed DPA template, or certifications such as SOC 2 or ISO 27001. If your procurement needs one of those, ask sales@pepochat.com about current status rather than assuming.