muro.chat
Start your trial

GDPR for chat tools in 2026: what compliance actually means

A founder-friendly walkthrough of the GDPR articles that touch live chat, what your tool needs to do, and how muro handles each one.

The muro team

muro.chat

Published
Reading time
8 min
GDPR for chat tools in 2026: what compliance actually means
On this page

Live chat is a GDPR-rich product. Visitors send personal data ("my email is …", "my order number is …"); agents reply with more; the conversation lives in a database somewhere and gets emailed to a human inbox. Every step has an article that touches it. Here's the practical version, with what muro does for each.

Article 6, lawful basis

You need a legal reason to process visitor data. For live chat, that's legitimate interest (running the support service the visitor is asking for) for the conversation itself, plus consent if you set non-essential cookies. muro keeps essential cookies (session, CSRF) off the consent banner, you only ask consent for analytics, which we don't set by default anyway.

Article 7, proof of consent

"The user consented" is not enough, you need to prove it. muro stores every consent decision in cookie_consent with timestamp, IP, user-agent, and a fingerprint. If a regulator asks "did this user consent on March 4th?", we have the receipt.

Article 12-15, right of access

A visitor can ask: "what do you have on me?" You have one month to answer with all of it. muro's /api/account/export endpoint produces a JSON dump of everything, user record, accounts, sessions, organisations, websites the user belongs to, conversations, audit entries, in a single download. The dashboard exposes a button on /app/profile.

Article 17, right to erasure ("right to be forgotten")

A user (or visitor whose email we have) can ask for full erasure. Soft delete is not enough, the data must actually be gone. muro's /api/account/delete does cascade DELETE through every table (sessions, accounts, member rows, sole-owned orgs and their websites/conversations/messages). The audit log entry survives but only contains the action, no PII.

Article 20, data portability

Same export as Article 15 but in a structured, machine-readable format. JSON satisfies this. We were tempted to ship a "competitor migration ZIP" format too, but JSON is cleaner, anyone can write a 30-line script to import into anything else.

Article 25, privacy by design

You can't bolt privacy on at the end. In muro, every database query is WHERE organization_id = :orgId, there's literally no path in the codebase that would let one customer see another customer's data. We have unit tests that fail if a query forgets the predicate.

Article 28, processor agreements (DPA)

Your customers (controllers) have us (processor) handling personal data on their behalf. They need a signed DPA from us. We have a standard one at /legal/dpa; for enterprises we sign their custom one too. Includes the obligatory bits: technical safeguards, sub-processors list, breach notification clock (72 h to your team, you decide what to tell your users).

Article 30, records of processing

Every action that touches personal data should leave a trail. muro's audit_log records: sign-ins, password changes, API key creation/revoke, message sends, plan changes, billing events, GDPR requests. Retained 90 days, then automatically deleted by a cron job (you don't want infinite retention either, that's its own privacy problem).

Article 32, security

Vague but important. Means: encryption in transit (TLS), encrypted backups (AES-256 before any copy leaves our servers), strong passwords (scrypt via better-auth), 2FA available, rate limiting on credentials endpoints, brute-force protection, and data minimisation: page addresses stored without query strings, IP addresses cut to their network. It's all in /security.

Article 44, international transfers

You can't ship EU citizen data outside the EU without specific safeguards. muro stores your conversations in the EU: Hetzner in Nuremberg, Germany for the servers and Postgres, eu-west-1 for AWS SES email. Three providers are US companies, and each one is listed with its safeguard on /legal/subprocessors: Cloudflare, which sits in front of all traffic; Anthropic, which reads message content only when AI features are on for a site (you can turn them off per site); and Stripe for payments.

What we explicitly don't do

  • No Google Analytics, Mixpanel, Hotjar, Pendo, or other US analytics on the dashboard. Our own cookieless analytics on the marketing pages only, never inside the app or the widget.
  • No advertising pixels (Facebook, Google Ads, LinkedIn).
  • No cross-customer data joins. Even our own analytics queries respect organization_id.
  • No "AI training on your data" clause. Your conversations are yours.

GDPR isn't a checklist you finish, it's a posture. Build it into the architecture, document it in your DPA, surface it in the product (export buttons, consent records, audit log), and the compliance work mostly does itself. Anything in your stack that fights you on this is a candidate for replacement.

  • gdpr
  • privacy
  • compliance
  • eu
  • dpa

Written by The muro team. A question, or a mistake we should fix? Write to contact@muro.chat, a person reads every message.

Questions people ask

Do I need a cookie consent banner for my live chat widget?

The muro widget sets no cookies. It uses up to five localStorage keys on your own domain (muro_fp, a random ID, plus muro_vis, muro_conv, muro_email and muro_pro_at) so a returning visitor keeps their thread, and wipes them all 13 months after the first was written. localStorage is still terminal equipment access under ePrivacy, so load the widget with lazy: true in init: it then shows the launcher only and writes or sends nothing until the visitor opens the chat, which is the service they asked for.

Does muro store visitor IP addresses?

Yes, but cut to the network before it is written: an IPv4 keeps its first three octets (203.0.113.47 becomes 203.0.113.0) and an IPv6 its first 48 bits. The visitor record also keeps country (from Cloudflare's CF-IPCountry header), device, browser and OS parsed from the user agent, and the domain and path of the last page, never its query string or fragment. Set the page address to domain only or nothing in the site's Privacy settings. Read the full record at /app/visitors/{id}.

A visitor asked me for a copy of their chat. How do I answer it?

Open /app/visitors/{id} and click "Export visitor data (GDPR)". You get JSON with their identity record and every conversation they had, and the endpoint writes an audit_log row so the disclosure itself is traceable. To erase a visitor, click "Erase visitor (GDPR)" on the same page: it deletes them, any other visitor in the workspace with the same email, and all their conversations, immediately. Deleting the workspace cascades every visitor, conversation and message it owned.

If I turn on AI replies, do my visitors' messages leave the EU?

When AI features run on a site, yes: message content reaches Anthropic's API in the US. That covers more than auto replies, since triage, summaries and suggested replies read recent messages of the conversation too. Page addresses and IPs are never sent. To keep a site's messages out of it entirely, switch on "Turn off AI for this site" in /app/sites/{id}. AI replies are always labelled as AI in the widget. Bring your own Anthropic key and those calls run under your contract instead of muro's.

Is the DPA and EU hosting only available on an enterprise plan?

No, they are standard. The signed DPA at /legal/dpa, EU hosting, the public sub-processor list, the REST API, webhooks and the hosted MCP server are identical on Solo ($19 a month, up to 10 projects) and Fleet ($59, unlimited projects), with unlimited agents on both and no per seat or per resolution charge. The 14 day trial takes a card, no charge today, one click cancels before it renews.

What happens to a chat when nobody on my team is online?

The message is emailed to your workspace after a delay you set in /app/settings/notifications (90 seconds by default), and you reply straight from your mail client. Two GDPR consequences follow. That transcript now also sits in your mailbox, so your own records of processing should name your mail provider, and muro sweeps its forwarded_email rows after 90 days while the conversation stays in the inbox.

One inbox for the chat on every site you run.

muro is live chat hosted in Germany, with an AI that answers from your docs and hands the hard questions to you, at one flat price. Try both sides in the live demo, read the pricing, or see how muro compares.

Start your 14-day trialTry the live demo

Keep reading

All articles