GDPR & EU AI Act Compliance

MerchantDesk is built to support GDPR and the EU AI Act. Some of that work is ours, because we build and run the platform. Some of it is yours, because you decide how MerchantDesk is used with your customers. This page explains both sides.

• You (the merchant) are the data controller for your customers' data. You decide what to collect and why.
• MerchantDesk is your data processor. We only process your customers' data to provide the service, and only on your instructions.
• Our sub-processors help us run the service. They are listed in our Privacy Policy, and we tell customers before adding a new one.

• Data Processing Agreement. We offer a DPA based on Article 28 of the GDPR. Email support@merchantdesk.ai to get a copy.
• Transfers outside the EU. We rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework when data leaves the EU, EEA or UK.
• Security. HTTPS everywhere, encryption of stored tokens and keys, hashed passwords, login codes for new devices and role-based access for teams.
• Data minimisation. We only send an AI model the conversation and store knowledge it needs to answer. Your customers' conversations are not used to train AI models.
• Retention. Data is kept only as long as needed. Our retention periods are listed in the Privacy Policy.
• Breaches. If a personal data breach affects your data, we tell you without undue delay so you can meet your own 72-hour reporting duty.
• Requests from individuals. You can find, export and delete a customer's conversations and contact details from your portal. If you need help with an access or deletion request, we'll assist.

• Mention MerchantDesk (as a support and chat provider) in your own privacy policy.
• Have a lawful basis for the data you collect in chat, and only collect what you need.
• Get consent before sending marketing messages by WhatsApp or email.
• Answer your customers’ privacy requests. We’ll help with the data held in MerchantDesk.
• Cover the chat widget’s browser storage in your cookie notice where your local law requires it.

The EU AI Act (Regulation (EU) 2024/1689) sorts AI systems by risk. The MerchantDesk AI Agent is a customer service assistant. It answers questions about products, orders and store policies. It is not used for any of the high-risk purposes listed in the Act, such as hiring, credit scoring, education or access to essential services.

That puts it in the group of AI systems that talk directly to people. The main rule for these is transparency: people must know they are talking to an AI (Article 50, which applies from 2 August 2026).

The AI Agent runs on general-purpose AI models from OpenAI, Anthropic and Google. Those companies carry the obligations the Act places on model providers.

• Clear AI disclosure. By default the chat widget names the assistant as an “AI Agent” and shows “Powered by MerchantDesk AI”, so customers know they're talking to AI.
• A human is always reachable. The AI can hand a conversation to your team, and your team can take over any conversation at any time.
• No prohibited practices. MerchantDesk doesn't use emotion recognition, biometric categorisation, social scoring or manipulative techniques.
• You control what it knows. The AI answers from the store information and training content you provide, and you can review and change it at any time.
• Records. We log every AI reply and its usage, so you can review what was said and when.
• Guidance for your team. Our Help Center covers what the AI can answer, when it hands over to a person and how to retrain it, to help your staff use it knowingly (the AI literacy duty in Article 4).

• Keep it clear that customers are talking to an AI. If you rename the assistant or remove our branding, add your own disclosure.
• Don’t present the AI as a human, and don’t configure it to mislead or pressure people.
• Keep your training content accurate and check how the AI answers, especially about prices, refunds and delivery.
• Make sure someone on your team can step in when a customer asks for a person or has a complaint.
• If you publish AI-generated marketing content where the law requires a label, label it.

• UK GDPR and the Data Protection Act 2018, handled in the same way as the EU GDPR.
• California (CCPA/CPRA): we don't sell or share personal information for cross-context advertising, and we act as a service provider for merchants' customer data.
• CAN-SPAM and ePrivacy rules for marketing email, supported by unsubscribe links and a postal address in campaign emails.
• WhatsApp and Meta policies for business messaging. See our Acceptable Use Policy.

For our DPA, a security overview, or any compliance question, email support@merchantdesk.ai. We usually reply within 2 business days.