How to use SilentChat in full GDPR compliance — with as few consent requirements as possible.
Last updated: June 2026
This guide is for general informational purposes only and does not constitute legal advice. While the content has been prepared with care, it does not replace individual consultation with a qualified attorney. Actual GDPR requirements depend on your specific use case, industry, and jurisdiction. SilentChat (Forge12 Interactive GmbH) assumes no liability for the legal accuracy or completeness of the information and sample texts provided.
On this page
1. Overview: SilentChat & GDPR
SilentChat processes personal data on behalf of its customers. The GDPR roles are clearly defined:
Controller (Art. 4 No. 7 GDPR)
You, the SilentChat customer. You determine the purposes and means of data processing.
Processor (Art. 4 No. 8 GDPR)
SilentChat (Forge12 Interactive GmbH). We process data exclusively on your behalf and according to your instructions.
What data does SilentChat process?
Chat messages between visitors and agents
Visitor information (name, email — only if provided voluntarily)
Session data (pages visited, browser language, device type)
IP addresses — stored only as irreversible hash (SHA-256), never in plain text
AI chatbot interactions (if enabled)
Built-in privacy features
IP hashing — no plain-text IP addresses stored anywhere
Privacy-friendly fingerprinting — no canvas or WebGL fingerprinting
Configurable data retention — automatic deletion after your defined period
Self-service data export — visitors can request their data (Art. 15)
Self-service data deletion — visitors can request deletion (Art. 17)
Complete audit trail — all GDPR-relevant actions are logged
Consent management — configurable consent gate with version tracking
2. Legal Basis — When Do You NOT Need Consent?
The key to minimizing consent requirements: choose the correct legal basis for your use case. In many cases, you do not need explicit consent at all.
Art. 6(1)(f) — Legitimate Interest
Applies when the chat serves your legitimate business interest and does not disproportionately impact visitors' rights.
Customer support via live chat
Technical assistance and troubleshooting
General inquiries and contact requests
AI chatbot for answering support questions
No consent required. Widget config: require_consent: false
Art. 6(1)(b) — Performance of a Contract
Applies when the chat is necessary to fulfill or negotiate a contract with the visitor.
Pre-sales consultation for specific products or services
Order support and delivery inquiries
Post-purchase support for existing customers
No consent required. Widget config: require_consent: false
Art. 6(1)(a) — Consent
Required when data processing goes beyond what is necessary for support or contract performance.
Marketing conversations and proactive outreach
Visitor behavior tracking and profiling
Cross-session analytics and visitor identification
Storing chat history in the visitor's browser
Consent IS required. Widget config: require_consent: true
3. Decision Tree: Do I Need Consent?
What is the primary purpose of the chat?
Customer support & service
Art. 6(1)(f)
Sales consultation & advice
Art. 6(1)(b)
Marketing & proactive outreach
Art. 6(1)(a)
Do you track visitors across sessions?
No — each session is independent
Yes — we identify returning visitors
Do you store chat history in the visitor's browser?
No — enable_chat_history: false
Yes — enable_chat_history: true
No consent needed — use legitimate interest or contract performance as legal basis
Consent required — enable require_consent: true in widget settings
Note: Even without consent requirements, you must always inform visitors about data processing in your privacy policy.
4. AI Chatbot — Special GDPR Requirements
If you use SilentChat's AI chatbot feature, additional GDPR requirements apply:
Transparency obligation (Art. 13 GDPR)
Visitors must be informed that they are communicating with an AI system. SilentChat displays this automatically in the chat interface when the AI responds.
Sample text for your privacy policy:
Our website uses an AI-powered chatbot to answer frequently asked questions and provide initial support. The chatbot is clearly identified as an AI system. You can request to be transferred to a human agent at any time.
No automated decision-making (Art. 22 GDPR)
SilentChat's AI chatbot does not make automated decisions with legal or similarly significant effects. It provides informational responses only. Visitors can always request human review.
Data minimization
Only the current conversation context is sent to the AI provider — no visitor profiles, no historical data, no personal identifiers. The AI processes the question and returns an answer.
AI as sub-processor
The AI provider acts as a sub-processor. The default is IONOS (hosted in Germany); depending on the plan a tenant may enable Anthropic/Claude or OpenAI instead — such a change is recorded in the tenant’s audit log. This is documented in the SilentChat Data Processing Agreement (DPA) and sub-processor list.
Right to human review
Visitors can request to speak with a human agent at any time. Your agents can take over any AI conversation from the dashboard.
Recommendation: Add the AI transparency text to your privacy policy (sample text provided in Section 5).
5. Widget Configuration for Maximum Compliance
SilentChat offers several configuration options to maximize GDPR compliance while minimizing friction for visitors.
Consent gate
require_consent: false — No consent screen before chat. Use when legitimate interest or contract performance applies.
require_consent: true — Shows a consent screen before the chat session starts. No data is collected until the visitor consents. Use when tracking or marketing is involved.
Chat history
enable_chat_history: false (recommended) — Chat messages are not stored in the visitor's browser. Each visit starts fresh. Maximum data minimization.
enable_chat_history: true — Chat messages are stored in localStorage for returning visitors. Requires consent.
Session timeout
Configure how long a session stays active. Shorter timeouts = less data retention. Default: 30 minutes.
Fingerprinting
SilentChat uses a privacy-friendly fingerprint (user agent, language, screen size, timezone only). No canvas or WebGL fingerprinting. The fingerprint is generated only after consent if require_consent is enabled.
Persistent chat resume
enable_persistent_resume: false (default) — visitors start fresh on every page reload. No cross-device storage. Minimal data processing.
enable_persistent_resume: true — visitors can opt in to resume an ongoing conversation across page reloads, new tabs, and new sessions. After the visitor's first message, the widget displays a consent strip with an email input. On acceptance, SilentChat stores a pseudonymous HMAC-SHA256-signed token (30-day hard cap, enforced server-side) in the visitor's browser and writes a per-tenant-salted email hash (SHA-256) to the database for lookup. The plaintext email is not additionally indexed. Legal basis: Art. 6(1)(a) GDPR (consent). Visitors can revoke at any time from the widget.
Stored data: signed token in the browser's localStorage (30 days), email hash in the visitors table, link to prior conversation IDs. Revocation deletes the token and email hash; existing conversation data remains under the general retention policy and stays subject to the visitor's deletion/export rights.
Share a screenshot
enable_screen_share: false — No monitor icon in the chat composer. No browser display capture and no tech-info collection happens. Choose this if you don't want to extend your privacy policy with another paragraph.
enable_screen_share: true (default on desktop) — A monitor icon in the composer lets the visitor send a one-shot screenshot. The visitor clicks deliberately, the browser shows its native picker ("Which tab/window/screen?"). Only after that explicit choice does the page capture a single frame, upload it as a PNG, and embed it into the chat. Alongside the image, a technical snapshot bundle is sent (user agent, browser language, screen and viewport resolution, timezone, color scheme, page URL, page title, referrer). On mobile the button hides automatically because `getDisplayMedia` is not reliably supported there. Legal basis: Art. 6(1)(a) GDPR (explicit per-click consent via the browser picker).
Stored data: the uploaded screenshot image (in the same S3 bucket as other attachments, subject to your configured retention rules) and the technical snapshot bundle in the message metadata. No live screen stream is transmitted or recorded — only the single still frame the visitor approved. The browser asks for fresh consent on every share. Subsequent deletion via the visitor's self-service right removes both the image and the metadata.
Read answers aloud
enable_read_aloud: true (default) — Every bot or team reply carries a speaker button. The text is spoken by the browser’s own speech synthesis (speechSynthesis), which runs on the visitor’s device. No audio is created, transmitted or stored — neither to us nor to any third party. We deliberately do NOT use the opposite direction, the browser’s SpeechRecognition interface: in Chrome it sends microphone audio to Google. The button only appears in browsers that support speech synthesis.
Stored data: none. No recording, no audio file, no extra field on the message. Which voice the browser uses depends solely on the visitor’s device. To switch it off, set enable_read_aloud to false and the button will not appear.
Custom visitor data (JavaScript API)
Not used (default) — your site calls neither setCustomData nor track. No additional data is created; the widget behaves as if the API did not exist.
Used (Professional and above) — your site transmits custom attributes (window.SilentChat.setCustomData) or events (window.SilentChat.track). Both are YOUR decision and YOUR content: we only store what your JavaScript sends us. Whatever you transmit here belongs in your privacy policy — we cannot describe it for you.
Data stored: attributes as key-value pairs on the visitor (at most 10 pairs, keys 40 / values 200 characters), events as their own row with name, timestamp and properties (at most 200 per session). Retained like pageviews; deleting the visitor removes both. Events are only stored with tracking consent, where your widget requires one.
Please do not put personal data into attributes or event properties. Values that look like an email address or phone number are stored masked (m***@example.com) — that is an emergency brake, not a substitute for data minimisation. For name and email there is setVisitorInfo, where they are intended and covered by the DPA.
Copy and adapt these texts for your website's privacy policy. Choose the variant that matches your use case.
Variant A: Live chat without consent (legitimate interest)
We use SilentChat, a live chat service provided by Forge12 Interactive GmbH (Josefstr. 37, 78166 Donaueschingen, Germany), to offer customer support on our website.
When you use the chat, the following data is processed:
- Your chat messages
- Technical information (browser type, language, device type)
- A hashed version of your IP address (not stored in plain text)
The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in providing efficient customer support.
Data is processed exclusively on servers within the EU/EEA. Chat data is automatically deleted after [number] days.
A Data Processing Agreement (Art. 28 GDPR) has been concluded with the provider.
Variant B: Live chat with consent
We use SilentChat, a live chat service provided by Forge12 Interactive GmbH (Josefstr. 37, 78166 Donaueschingen, Germany).
Before using the chat, you will be asked for your consent. Only after you consent will the following data be processed:
- Your chat messages
- Name and email (if provided by you)
- Technical information (browser type, language, device type)
- A hashed version of your IP address
- A privacy-friendly device fingerprint for session management
The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time by clicking the lock icon in the chat widget. Upon revocation, all locally stored data is immediately deleted.
Data is processed exclusively on servers within the EU/EEA. Chat data is automatically deleted after [number] days.
A Data Processing Agreement (Art. 28 GDPR) has been concluded with the provider.
Addition: AI chatbot
Our chat system includes an AI-powered chatbot that can answer frequently asked questions. The chatbot is clearly marked as an AI system in the conversation.
For AI processing, your chat message is forwarded to our AI provider (listed in our sub-processor register) in anonymized form — without personal identifiers. The AI generates a response based solely on the current message and our knowledge base.
No automated decisions with legal or similarly significant effects are made. You can request a human agent at any time.
The AI sub-processor is listed in the SilentChat Data Processing Agreement.
Addition: Data subject rights
You can exercise the following rights regarding data processed through SilentChat:
- Right of access (Art. 15 GDPR): Request an export of your data directly through the chat widget.
- Right to erasure (Art. 17 GDPR): Request deletion of your data directly through the chat widget.
- Right to rectification (Art. 16 GDPR): Contact us to correct inaccurate data.
- Right to object (Art. 21 GDPR): You can object to data processing at any time.
To exercise these rights, use the self-service options in the chat widget or contact us at [email address].
Note: replace [number] with your configured retention period in days and [email address] with your contact email. Adapt the texts to match your specific use case.
7. Consent & Cookie Banner Texts
Depending on your configuration, you may or may not need a cookie banner reference for SilentChat.
Variant A: No cookie banner needed
If you use SilentChat with require_consent: false and enable_chat_history: false, no cookies or persistent local storage are used until the visitor starts a chat. A session token is created only when the visitor actively initiates a conversation — this is technically necessary and does not require consent under ePrivacy regulations.
This website uses a live chat system (SilentChat). A session cookie is set only when you actively start a conversation. No tracking or advertising cookies are used.
Variant B: Cookie banner with chat reference
If you use require_consent: true or enable_chat_history: true, include SilentChat in your cookie/consent banner:
Live Chat (SilentChat): We use a chat system to provide customer support. If you consent, a session token and your chat history may be stored in your browser for a better experience. You can revoke consent at any time in the chat widget.
Suggested category: "Functional" (not "Marketing" or "Analytics")
Variant C: Inline consent in widget
When require_consent: true is enabled, SilentChat shows a built-in consent screen before the chat starts. You can customize the consent text in your widget settings. Sample:
By starting this chat, you agree to the processing of your messages and technical data for the purpose of customer support. You can find details in our privacy policy. You can revoke your consent at any time.
8. Data Processing Agreement (DPA)
As a SilentChat customer, you are the data controller. SilentChat processes personal data on your behalf. This requires a Data Processing Agreement (DPA) according to Art. 28 GDPR.
Where to find the DPA:
The DPA is available in your SilentChat dashboard under Settings > Legal > Data Processing Agreement. You can review and accept it digitally.
STRATO AG (offsite store for encrypted backups and delivery of the DPA documents, Germany)
AI provider (IONOS in Germany by default; alternatively Anthropic/OpenAI in the US as configured, listed in DPA)
Your checklist:
Review and accept the DPA in your dashboard
List SilentChat as a processor in your own privacy policy
Keep the sub-processor list updated (you will be notified of changes)
9. Implementation Checklist
Follow these steps to ensure your SilentChat implementation is GDPR-compliant:
1
Step 1: Determine your legal basis
Decide whether your use case falls under legitimate interest (Art. 6(1)(f)), contract performance (Art. 6(1)(b)), or requires consent (Art. 6(1)(a)). See Section 3 for the decision tree.
2
Step 2: Configure the widget
Set require_consent and enable_chat_history according to your legal basis. See Section 5 for recommended settings.
3
Step 3: Update your privacy policy
Add the appropriate SilentChat section to your privacy policy. See Section 6 for copy-ready sample texts.
4
Step 4: Update cookie banner (if applicable)
If you use consent mode, include SilentChat in your cookie/consent banner. See Section 7.
5
Step 5: Accept the DPA
Review and accept the Data Processing Agreement in your SilentChat dashboard under Settings > Legal.
6
Step 6: Configure data retention
Set an appropriate retention period in Settings > Data Retention. The shorter, the better for GDPR compliance. Maximum: 365 days for conversations, 180 days for sessions.
7
Step 7: Add AI transparency (if using AI chatbot)
If you use the AI chatbot feature, add the AI transparency text to your privacy policy. See Section 4.
8
Step 8: Test the self-service rights
Verify that the data export and data deletion flows work correctly from the visitor's perspective.
10. Frequently Asked Questions
Does SilentChat store IP addresses?+
No. IP addresses are hashed (SHA-256 with salt) before storage. The original IP cannot be reconstructed. This means the stored hash is not considered personal data under most interpretations.
Where is data stored?+
All data is stored on servers within the EU/EEA (Hetzner Online GmbH, Frankfurt); encrypted backups are stored with STRATO AG in Germany. No data is transferred to third countries except when AI features are used (see sub-processor list).
Can visitors delete their data themselves?+
Yes. Visitors can request data export and deletion directly through the chat widget. They receive a magic link via email to confirm the action. Data is anonymized (not hard-deleted) to maintain conversation integrity while removing all personal identifiers.
Do I need a cookie banner for SilentChat?+
Not necessarily. If you use SilentChat with require_consent: false and enable_chat_history: false, only a technically necessary session token is created when the visitor actively starts a chat. This typically does not require cookie consent. However, you should mention SilentChat in your privacy policy.
What about the AI chatbot and GDPR?+
The AI chatbot processes only the current message context — no personal profiles are built. The AI provider is listed as a sub-processor in the DPA. Visitors are automatically informed that they are communicating with an AI. No automated decisions with legal effects are made.
How long is data stored?+
You control the retention period in your dashboard settings. Maximum allowed: 365 days for conversations, 180 days for visitor sessions, 90 days for pageviews. After expiry, data is automatically and irreversibly deleted.
Can I use SilentChat without any consent at all?+
Yes, if you use it solely for customer support (legitimate interest) or contract-related communication, and disable chat history storage. You still need to mention the data processing in your privacy policy — but no active consent action from the visitor is required.
What happens when a visitor revokes consent?+
All locally stored data (session token, fingerprint, chat history) is immediately deleted from the visitor's browser. The consent revocation is logged in the audit trail. Server-side data remains until the configured retention period expires or the visitor requests deletion.
How does persistent chat resume work and what is stored?+
Enable resume in the dashboard under Widget > UX & Engagement (enable_persistent_resume, default off). Once a visitor sends their first message, the widget shows a consent strip with an email field. On acceptance, SilentChat stores a signed token in the visitor's browser localStorage (30 days, HMAC-SHA256 with a per-tenant secret) and writes an email hash (SHA-256 with per-tenant salt) to the visitors table — the plaintext email is not additionally indexed. On the next visit the widget pulls the most recent conversations and displays a "Welcome back" banner. Legal basis is Art. 6(1)(a) GDPR; visitors can revoke the token from the widget at any time, which removes both the token and the email hash. Only enable this feature alongside an updated privacy policy and mention it in your cookie/consent banner under "Functional".
We use the screenshot-sharing feature. What needs to be in our privacy policy?+
When enable_screen_share is on (Widget > UX & Engagement), the visitor gets a monitor icon in the chat composer. On every click the browser shows ITS OWN native picker — the visitor chooses which tab, window or screen to share. Only after that explicit choice is a single still frame captured, uploaded as a PNG attachment, and tagged with a technical snapshot (user agent, resolution, URL, timezone, color scheme, referrer). There is no live screen stream and no recording. Add a paragraph to your privacy policy noting that visitors can voluntarily share a screenshot with a technical snapshot for debugging purposes via the chat widget (Art. 6(1)(a) GDPR, per-click consent), and that the resulting data lives in the conversation under your regular chat-data retention rules. No additional cookie banner change is needed because no data is collected without the visitor's active click.