An honest, jargon-light rundown of how we handle your data, where it lives, and which providers help us run Kisnip.
We comply with the EU GDPR and the Swiss FADP. We don't sell your data, we don't use your conversations to train AI models, everything is encrypted, and you can export or delete your data whenever you want.
A few principles we don't compromise on, no matter which plan you're on.
Not to advertisers, brokers, or anyone. Only ever to run the service you pay for.
Sent to our AI provider only to generate a live reply, never to train models.
Encrypted in transit (TLS) and at rest, with access locked to systems that need it.
Processed live to reply. We keep the text transcript, but never store the audio.
Access, export, correct or delete it any time, from your dashboard or by email.
When data leaves the EU, we rely on the EU's Standard Contractual Clauses (SCCs).
The sub-processors that touch data on our behalf, each under a GDPR-compliant Data Processing Agreement.
| Provider | What they do for us | Where | Safeguards |
|---|---|---|---|
| Google FirebaseGoogle Ireland Ltd. | Hosting, database, authentication, file storage and our serverless backend. | EU + Google global infrastructure | SCCs, ISO 27001, GDPR DPA |
| Google Gemini / Vertex AIGoogle LLC | Generates the assistant's text and voice replies in real time. | EU + Google global infrastructure | SCCs, GDPR DPA, no training on your data |
| StripeStripe Payments Europe, Ltd. | Subscription billing and payment processing. | EU / US | SCCs, PCI-DSS Level 1 |
| HostpointHostpoint AG | Sends transactional emails: verification, password resets and conversation summaries. | Switzerland | Swiss adequacy, GDPR-aligned |
| Google AnalyticsGoogle LLC | Anonymous usage stats for our public website, only after you accept cookies. | EU / US | SCCs, IP anonymisation, consent-gated |
We keep this list current. If we ever add or change a sub-processor, it'll show up here and in our Privacy Policy.
Whether you're an account holder or a visitor who chatted with an assistant, the GDPR gives you real, enforceable rights. Here's what you can ask for:
Ask for a copy of the personal data we hold about you.
Correct anything that's wrong, incomplete or out of date.
Have your data deleted, the "right to be forgotten".
Take your data with you in a common, machine-readable format.
Limit or object to how certain data is processed.
Lodge a complaint with your local data protection authority at any time.
To exercise any of these, contact us and we'll sort it out, usually well within the 30-day window the GDPR allows.
Both, depending on the data. For your account details we're the controller. For the conversation data your visitors generate through the widget on your site, you're the controller and we act as your processor, which is why our Data Processing Agreement is built into our Terms.
No separate signing needed. Our GDPR-compliant Data Processing Agreement is incorporated into our Terms of Service, so when you create an account and accept the Terms, you automatically enter into the DPA with us. If your organisation needs a counter-signed copy, contact us.
Transcripts stay available while your account is active so you can review them in your dashboard. When you delete your account, associated personal data is removed or anonymised within 30 days, except where the law requires us to keep certain records (for example, accounting records kept for up to 10 years under Swiss law).
Some of our providers operate globally, so data may be processed outside the EU. Whenever that happens we rely on the European Commission's Standard Contractual Clauses and each provider's own safeguards to keep your data protected to EU standards.
If a breach is likely to put your rights at risk, we notify the competent supervisory authority without undue delay (within 72 hours where required) and inform affected users as soon as we reasonably can.
We're happy to walk you through how we handle your data.
Kisnip handles every conversation under EU GDPR and Swiss FADP. Start free and see it in minutes, no credit card required.
