Compliance by default.
LOPDGDD + GDPR
Compliant with the Spanish Data Protection Act and the EU General Data Protection Regulation.
Data in the EU
Storage on European infrastructure. Some providers, such as the AI model (Anthropic), process data in the US under Standard Contractual Clauses. ChatMe OÜ is registered in Estonia.
DPA included
It is part of the terms and linked from your dashboard. Need a signed copy? Email privacy@chatme.es.
No data selling
Your conversations never train third-party models. Ever. Your content is yours.
EU AI Act 2024/1689
Compliant with the European AI Regulation. Transparency and traceability by default.
Encrypted in transit and at rest
TLS on every connection and AES-256 at rest. Row-level security (RLS) in the database and an ownership check on every request.
AI-Act-ready — by default.
The European AI Act applies generally from August 2, 2026. Your ChatME chatbot already meets the key obligation with zero configuration.
Always-on AI disclosure
Every widget identifies the assistant as AI: an "AI" indicator in the header and a notice at the start of the conversation. It cannot be switched off — you comply by default.
On WhatsApp, Instagram, Messenger and Telegram too
On messaging channels, the first reply of every conversation automatically identifies itself as an AI assistant.
No manipulation, no dark patterns
The assistant informs and manages; it does not score people or make high-risk decisions (credit, hiring, admissions, diagnosis) — prohibited in our terms.
EU data and EU provider
EU-hosted infrastructure and ChatMe OÜ as the European provider of the system, with the Regulation's roles (provider/deployer) spelled out in the terms.
Everything in writing.
All public, no small print. The privacy policy, the DPA and the sub-processors are linked from your dashboard too.
What data we process and why.
Your processor agreement, part of the terms. Signed copy? privacy@chatme.es.
The list of third parties that process data on your behalf.
Which cookies we use on the site and widget.
The rules of the service.
Your assistant in 10 minutes.
With your data in order from day one: GDPR, EU-hosted infrastructure and a DPA included in the terms.