Privacy and GDPR

Consent, how long data is kept, people’s data requests and the AI notice.

Each assistant has its own privacy settings, so you can match each client’s policy.

Privacy: consent (1) and retention (2)

The settings

Setting	What it does
AI notice	Before its first reply the assistant tells people it’s an automated assistant. You can change the wording.
Ask for consent (1)	The assistant asks once, with Yes and No buttons, before storing the conversation. If the person says no, everything they write is deleted and only general answers are given.
Privacy policy link	Shown under the consent question.
Retention (2)	Old data is deleted automatically every night. 0 keeps data until it’s deleted by hand. Active gift cards, open orders and future bookings are always kept.
”Delete my data” phrases	When someone writes one of these, all their data is deleted and they’re told.

Data requests

Open the person in Conversations and use:

• Export data to download everything stored about them (the right of access).
• Delete all data to erase it (the right to be forgotten).

Every export and deletion is written to the audit log with who did it and when.

The agency or the business is responsible for its own privacy policy. InstaForge gives you the tools; check the wording with whoever handles legal matters for the client.

How we use AI page

Every installation has a public How we use AI page that explains, in plain words, what the assistant does with messages. Link to it from the client’s privacy policy.