⚠ DRAFT — to be reviewed by a lawyer before publication.
This text is a working draft. Company details in [BRACKETS] and items marked DECISION are placeholders. In case of discrepancy, the Greek text prevails.
LEGAL
GDPR & AI Act guide for stores using myCogni Chat
Last updated: [DATE] · Ελληνικό κείμενο →
This guide helps you add myCogni Chat to your store correctly from a personal-data and AI Act point of view. It is practical and does not replace advice from your lawyer or DPO, who know your business.
At a glance: what you need to do
- ☐ Sign (accept) a DPA with the AI provider you chose (section 3).
- ☐ Add the ready-made paragraph to your privacy policy (section 4).
- ☐ Keep the indication that the assistant is AI visible (section 5).
- ☐ Set up cookie consent for the optional features (section 6).
- ☐ Set a retention period and test data export/erasure (section 7).
- ☐ Write instructions for the assistant and review conversations regularly (section 8).
- ☐ Add the processing to your record of processing activities (section 9).
1. Who is who
| Role | Who | What it means |
|---|---|---|
| Controller | Your store | You decide to add the assistant, what it will do and which AI provider it will use. You inform visitors and respond to their requests. |
| Processor | The AI provider you choose, e.g. OpenAI, Google (Gemini), Mistral AI, OpenRouter | It receives the messages and returns the answer, using your own account and API key. You need a data processing agreement (DPA) with it. |
| Dizzy (myCogni) | Does not receive the conversations | The plugin runs on your own server. Our license server receives only technical license data (key, website URL, software versions) and no visitor data. If you give us access to your website for support, we then act as a processor for you, only for that request. |
2. What data goes where
Stored on your own server (WordPress database):
- chat history and answer ratings (👍/👎), without the visitor’s IP address,
- statistics events (e.g. whether a conversation led to an order),
- orders placed through the chat (in your WooCommerce, like any other order).
Sent to the AI provider you chose:
- the visitor’s messages and the recent history of the same conversation,
- store information needed for the answer (products, prices, stock, FAQs, policies),
- if the “assistant knows what the visitor looked at” feature is on, the IDs of the products and categories the visitor viewed,
- for cash-on-delivery orders inside the chat: the visitor types their full name, mobile number, address, city and postcode into the conversation. This data passes through the AI provider, like any other message, so that the order summary can be prepared. The order is created only when the visitor presses “Confirm order”, and it is placed on hold for confirmation by phone from you. Card details are never requested.
- when looking up an existing order: the visitor gives the order number and email or phone. The check takes place on your server and only the status and shipping details needed are sent to the AI provider, not the customer’s name and address.
If you enable optional connections (e.g. handover to a human via Telegram/WhatsApp, webhooks, voice messages), the related data also goes to the corresponding providers. Include them in your privacy policy and record of processing activities.
Card numbers: the plugin automatically masks numbers that look like credit-card numbers before they are stored in log files. Even so, ask visitors not to type such details into the chat.
3. Data processing agreement (DPA) with the AI provider
Article 28 GDPR requires a written agreement with every processor. Before taking the assistant live:
- Accept the provider’s DPA from your account (most providers offer it online, as part of their API business terms). Keep a copy or a dated screenshot.
- Check that your data is not used to train models. On the paid APIs of the major providers this is usually the default. Some free tiers allow the provider to use the data to improve its services. Do not use a free tier on a live store.
- Check where and for how long the provider keeps data (e.g. temporary retention for abuse detection, EU data residency or zero-retention options, where available for your account).
- Transfers outside the EU: if the provider processes data outside the EEA (e.g. USA), make sure there is a lawful transfer mechanism (Data Privacy Framework or Standard Contractual Clauses) and mention it in your privacy policy. A provider based and processing in the EU simplifies compliance.
- OpenRouter: it acts as an intermediary and forwards messages to other model providers. Data therefore passes through both OpenRouter and the final provider. In your account settings, restrict routing to providers that do not retain or train on data, and mention both in your privacy policy.
Providers’ terms change often. Check them when you activate the assistant and at least once a year.
4. What to add to your privacy policy
The plugin automatically adds suggested text to the WordPress tool “Settings → Privacy → Policy Guide”. We recommend, however, the fuller paragraph below. Fill in the [ ] and delete whatever doesn’t apply to you.
AI-powered digital assistant (chat)
In our store you can chat with a digital assistant that runs on artificial intelligence (AI), not a human. The assistant answers questions about products, availability, shipping and orders[, and can help you complete a cash-on-delivery order].
What data we process: the messages you type in the conversation and, if you provide them, details such as order number, email, phone[, full name and shipping address for an order placed through the chat]. [If you allow it in the cookie settings, the assistant also receives which products you recently viewed in the store, to serve you better.] Please do not type card details, passwords or information about your health into the chat.
Purpose and legal basis: answering your questions and serving you before or after a purchase (steps prior to entering into a contract or performance of a contract — Article 6(1)(b) GDPR); improving answers and producing anonymous statistics (our legitimate interest — Article 6(1)(f) GDPR).
Who it is sent to: to generate the answer, your messages are sent to the artificial-intelligence provider [PROVIDER NAME, e.g. OpenAI Ireland Ltd / Google Ireland Ltd / Mistral AI SAS / OpenRouter Inc.], which acts as processor on our behalf, under a data processing agreement. The provider does not use the data to train its models. [Processing may take place outside the EEA (e.g. USA), with the safeguards of Article 46 GDPR (Standard Contractual Clauses) / the EU-U.S. Data Privacy Framework.] [If you ask to talk to a human, your message is forwarded to our team via [Telegram / WhatsApp].]
How long we keep it: conversations are stored on the store’s server, without your IP address, for [90] days and are then deleted. Orders completed through the chat are kept like all orders, for as long as tax law requires.
Your rights: you can request access to, correction, erasure or export of your conversation data at [STORE EMAIL], and you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
The assistant’s answers are generated automatically and may contain mistakes. For prices, availability and terms of purchase, what is stated on the product page, in the cart and in the store’s terms of use applies. For anything important, you can contact our team at [PHONE / EMAIL].
5. AI Act: telling people they are talking to AI
Regulation (EU) 2024/1689 (AI Act), Article 50, which applies from 2 August 2026, requires that people interacting with an AI system are informed that they are talking to AI, at the latest at the first interaction, in a clear and accessible way, unless this is obvious.
- myCogni Chat shows by default an indication that the assistant is AI. Do not remove it and do not hide it with CSS.
- If you change the assistant’s name (e.g. “Maria”), do not present it as an employee. Keep the word “AI” or “digital assistant” in the title or the first message.
- Suggested texts:
- Title: “AI assistant” or “Digital assistant (AI)”
- First message: “Hello! I’m the digital assistant of [STORE] and I run on artificial intelligence. I may make mistakes, so for anything important you can talk to our team. How can I help?”
- Below the input field: “Answers by AI — may contain mistakes. [Privacy policy]”
- When the conversation is handed over to a human, it’s good to say so explicitly (“You’re now chatting with [Name] from our team”).
6. Cookies and consent
| Technology | What it does | Consent? |
|---|---|---|
| Basic chat functionality (the window, the current conversation in the session) | Necessary to provide the service the visitor requested by opening the chat | No (strictly necessary, Article 4(5) of Greek Law 3471/2006) |
| “Assistant knows what the visitor looked at” (localStorage, up to 30 days) | Remembers which products the visitor viewed | Yes. The plugin respects it automatically with CookieYes, Cookiebot, Complianz or the WP Consent API. Set the category in the settings (default: functional). |
Measurement cookie mycogni_chat_sid (7 days, created only after the first chat message) |
Links a conversation to a later order, for the assistant’s performance statistics | We recommend placing it in the statistics (analytics) cookies and declaring it in your cookie table. |
Make sure the consent tool loads before the optional features and that the visitor can easily withdraw consent.
7. Retention, export and erasure
- Retention period: in the myCogni Chat settings, set “Events/ratings retention (days)”. The default is 90 days (allowed from 7 to 730). Keep the shortest period that is genuinely useful to you (30–90 days is enough for most stores) and state the same number in your privacy policy.
- Export / erasure: the plugin connects to the WordPress tools “Tools → Export Personal Data” and “Erase Personal Data”. It finds conversations by the visitor’s email. Test it once before you need it.
- The visitor can also delete their conversation from the chat window itself.
- Respond to every request within one month.
- Remember that copies of the conversation may also exist at the AI provider (for as long as its terms provide) and in any connected tools (e.g. Telegram).
8. Supervising the assistant: good practice
- Instructions (prompt): state explicitly that the assistant does not give medical advice, does not promise discounts, delivery times or compensation beyond what your policies state, and refers to a human when it isn’t sure.
- Supplements, cosmetics, health: visitors often write about their health problems. This is special category data (Article 9 GDPR). Instruct the assistant not to ask for such information and not to make health claims that are not permitted (Regulation (EC) 1924/2006 on health claims).
- Review conversations regularly (e.g. once a week in the first weeks) and correct the FAQs or knowledge base where the assistant makes mistakes.
- Orders from the chat: confirm every on-hold order by phone before fulfilling it.
- API key: don’t share it, set a spending limit in the provider’s account and change the key if you suspect a leak.
9. Record of processing activities and risk assessment
- Add a line “AI digital assistant” to your record of processing activities (Article 30 GDPR), with the details from sections 2–7: purpose, data categories, provider, transfers, retention.
- For the legitimate interest (statistics, improving answers), keep a short legitimate interest assessment (LIA).
- As a rule, a store customer-service assistant does not require a Data Protection Impact Assessment (DPIA). Discuss it with your adviser, though, if you systematically process health data or very large volumes, or if you combine conversations with marketing profiles.
Questions about setting up myCogni Chat: [SUPPORT EMAIL]. Dizzy does not provide legal advice; this guide is for information only.
Questions about this page?