cat docs/privacy-gdpr.md
All docs Last updated

Privacy and GDPR

Oshu is built to be a clean processor for your visitor conversations: European hosting, a European model provider, no third-party trackers, and tools to delete or export data on demand.

What the widget stores

When a visitor uses the chat, we process the messages they type, the responses the assistant generates, timestamps, and a conversation identifier. Technical data such as the visitor's IP address is used only transiently for security and abuse prevention — it is not stored permanently alongside the conversation.

The widget sets two strictly necessary first-party cookies so a conversation can be resumed (cw_conv_<agent> and a signed session token). They last around 24 hours, with SameSite=Lax and the Secure flag. No tracking, marketing, or third-party cookies are set.

Page context and private mode

When current-page awareness is on, the assistant is told the address of the page the widget is on (with tracking parameters, other query strings and fragments removed), its title, first heading and breadcrumbs, so it can tell which lecture a short question refers to. This is page metadata, not page content: the widget never reads your page body, and never fetches any URL a visitor is on.

Retention differs by mode, and this is the important part:

  • Normal conversation: the page metadata is stored alongside that message like any other message content, and is covered by your retention window and by conversation deletion.
  • Private mode: nothing page-derived is stored at all. The hint is included in the single request and then dropped — no snapshot in the transcript, nothing in the browser's stored conversation, nothing in the export.
  • Private mode changes storage, not what the model can see in the turn being answered. That is why a private chat still shows the page-title line above the input: hiding it would make the capability less transparent, not more private.

Where data is processed

Everything runs on European infrastructure. Servers are operated by Hetzner in Germany, and responses are generated through the EU API of Mistral AI in France. There is no transfer to a third country, and your content is not used to train AI models. Billing and email are handled by EU sub-processors (Mollie, sevDesk, AhaSend). The full list lives in your legal pack.

Retention

Conversation logs are deleted automatically after your workspace's configured retention window (12 months by default). Need a shorter window? Contact us and we'll set it for your workspace. Deleting a conversation, an agent, or running a full chat-log wipe removes the stored content immediately.

Deleting and exporting data

You hold the controls for the right to erasure and portability:

  • Delete all chat logs — wipe every stored conversation for your workspace from Settings → Account (type-to-confirm).
  • Close your account — removes your data; invoices are kept only as long as the law requires.
  • Export conversations — download your conversations as CSV or JSON from the Conversations page.

See Account and data for the step-by-step.

Your data processing agreement

A data processing agreement under Art. 28 GDPR governs our handling of your visitors' data. The agreement, the records of processing, and a ready-to-paste privacy notice for your own site are in Settings → Legal. Paste the widget privacy snippet into your site's privacy policy and have your own counsel review it before publishing.

See also: Account and data and Theming and embedding.