GDPR

Chatevo supports GDPR data subject rights for EU visitors and customers. Organization admins can fulfill requests from the dashboard or API.

Roles

Role	Responsibility
You (data controller)	Decide what data to collect; respond to visitor requests
Chatevo (data processor)	Process data per your instructions; provide deletion/export tools

Enterprise customers execute a DPA formalizing these roles.

Right	Chatevo feature
Access	Export conversation and account data
Rectification	Update account profile; correct KB content at source
Erasure	Delete conversations, documents, and account
Portability	JSON export of conversations and configuration
Restriction	Pause deployments; disable data collection
Objection	Stop processing by deleting deployment or account

POST /api/v1/gdpr/export
Authorization: Bearer ch_live_xxx
Content-Type: application/json

{
  "scope": "organization",
  "include": ["conversations", "assistants", "knowledge_bases", "audit_logs"]
}

Returns a download URL valid for 24 hours.

POST /api/v1/gdpr/delete

{
  "scope": "conversations",
  "external_user_id": "user_9281"
}

Requires matching external_user_id from JWT or Direct API metadata.

Contact support@chatevo.ai from the admin email. Account deletion cascades:

Processing	Typical lawful basis
Providing the service	Contract
Security logs	Legitimate interest
Product analytics (aggregated)	Legitimate interest
Marketing emails	Consent (opt-in)

Document your lawful basis in your privacy policy. Chatevo provides a subprocessor list for your records.

Request type	Target response
Export	Within 30 days (usually < 72 hours)
Erasure	Within 30 days; active data removed immediately
Account deletion	30-day soft delete, then hard purge