Embedded AI Chat Widget Data Privacy

Q: What's the difference between 'encrypted in transit' and 'encrypted at rest'?

In transit (TLS) protects data as it travels from your visitor's browser to the vendor's server—it stops eavesdropping on the connection. At rest means the data is encrypted while sitting on the vendor's hard drive. You need both. Without at-rest encryption, the vendor's employees or attackers can read your conversations.

Q: If a visitor is from the EU, am I required to have a GDPR DPA with my chat widget vendor?

Yes. If you collect data from any EU resident via your website, GDPR applies to that data. You must have a signed Data Processing Addendum with your chat vendor before you collect data. Without it, you're in violation even if the vendor is legitimate.

Q: Can I export all my chat conversations if I want to switch platforms?

It depends on the vendor and their contract. Some guarantee it in writing; others make it difficult or slow. Before you sign, ask for an export right in the DPA. If a vendor won't commit to exporting your data in a portable format within 30 days, that's a sign they're betting on lock-in.

Q: What should I do if a vendor won't answer my data security questions?

Don't deploy their widget. A reputable vendor will have SOC 2 Type II reports, a published security policy, and clear answers to encryption and retention questions. Silence is a red flag and usually means they don't have the infrastructure to back up their claims.

You drop a chat widget on your website and visitors start asking questions. Their names, emails, problems, account numbers—all flowing into conversations. Within weeks, you've collected hundreds of micro-interactions that represent real customer intent. Then someone asks: where is this data actually stored, who can see it, and what happens if we switch platforms in six months? That question exposes a gap most teams skip over during implementation. Embeddable AI chat widgets (whether from Intercom, Drift, or Orin's built-in widget ) live on your domain, collect sensitive information, and hand that data to a third party's servers. The legal risk and operational fragility are real. Here's how to own the relationship. Data ownership starts with your contract, not the feature demo When a vendor embeds a chat widget on your site, you're not actually owning the conversation—you're licensing access to it. Read the data processing addendum (DPA) before you sign. Specifically, ask: Who owns the data? You must own customer conversations outright. Any clause that lets the vendor use your chat transcripts for model training, analytics, or competitive insight is a red flag. Where is it stored? Geography matters. If you operate in the EU, GDPR requires data to either live in the EU or move under Standard Contractual Clauses (SCCs). If you're in Southeast Asia, LGPD (Brazil) and PDPA (Thailand) have their own territorial rules. A vendor that says 'it's in AWS' without specifying the region has not answered the question. Can you export it? Demand the right to export all customer conversations in a structured format (JSON, CSV). If the vendor won't commit to this in writing, they're betting you'll be trapped with them. What's the retention period? You should be able to set how long conversations live on their servers. A default of 'forever' means deleting a customer conversation on your end doesn't delete it on theirs. Most vendors bury data ownership in their terms of service. The DPA is where you learn the truth. Get legal eyes on it—this is cheaper than rebuilding customer trust after a breach. Encryption in transit and at rest are not the same thing A vendor will often claim their widget uses 'enterprise-grade encryption.' That statement is technically true and functionally meaningless without detail. You need to know: In transit (TLS 1.2+): This is table stakes. Every reputable platform encrypts the channel between your visitor's browser and their servers. This prevents your ISP or a café WiFi operator from reading the conversation. If a vendor doesn't encrypt in transit, hang up immediately. At rest (AES-256 or equivalent): This is where your data lives on the vendor's servers between conversations. Not all platforms encrypt this by default. Some reserve it for 'enterprise' plans. Ask directly: is every conversation encrypted with a key you or your organization control? If the vendor holds the keys, they can decrypt and read your customers' data. Key management: Who holds the encryption keys? If the vendor holds them, they can legally hand data to law enforcement without notifying you. If you hold the keys (or Orin does, on your behalf), data disclosure requires your consent. This distinction matters for healthcare, fintech, and law firms. Ask for their Security and Compliance documentation (SOC 2 Type II audit, ISO 27001 certification). These third-party audits prove encryption claims. If they refuse to share, they don't have them. GDPR, LGPD, and PDPA: where embeddable widgets actually break compliance Your website is global by default. A visitor from Munich, São Paulo, or Bangkok can reach you. That means their data is subject to their country's laws, not yours. Most chat widgets miss this. GDPR (EU): If any visitor is in the EU, their data is GDPR-protected. You need: A lawful basis for collecting chat data (usually 'legitimate interest' or 'consent'). Your privacy policy must disclose this. A Data Processing Agreement (DPA) with the widget vendor, signed before you collect data. The right to delete a customer's conversation on request (right to erasure). The vendor must comply within 30 days. If the vendor is not in the EU, a Standard Contractual Clause or another lawful transfer mechanism. Many US vendors rely on adequacy decisions or SCCs. Ask which one applies to you. LGPD (Brazil): Similar rules, but LGPD requires explicit consent for most data collection. A chat widget that automatically loads and starts collecting without opt-in is in violation. You need a clear consent banner or a legitimate interest statement. PDPA (Thailand): Thailand's Personal Data Protection Act covers Thai residents. Consent is required, and data must be protected to a 'reasonable' standard. The definition of reasonable is vague, which means vendor selection matters more. Choose a platform with a clear security audit. The pattern: compliance means having a contract that names the vendor as your data processor, a privacy policy that di