What to put on your website: GDPR and terms

You have deployed (or are about to deploy) the Yasan AI assistant — chat, AI search or e-mail support. Under the GDPR (and UK GDPR) you are the controller of your visitors’ and customers’ personal data and Yasan (Let’s Whisper s.r.o.) is your processor. This page contains everything you need. It takes about 20 minutes.

Checklist#

1. Data Processing Agreement — part of the Terms, binding automatically on acceptance / app installation: yasan.ai/dpa. Need a countersigned copy for an audit? Write to [email protected].
2. Add the paragraph below to your privacy policy. We host the detailed notice for shoppers at yasan.ai/ai-assistant-privacy and the assistant links to it directly — nothing else to copy.
3. Add the rows below to your cookie table.
4. Pass the consent state to the assistant (see below). Without it the assistant does not remember visitors between visits; chat, search and e-mail work normally regardless.
5. Health or otherwise sensitive catalogue? Forbid health advice in the assistant’s instructions. A query about a specific medicine linked to a persistent identifier is health data (Art. 9 GDPR).
6. Products for children? The assistant is not intended for children below the age of digital consent (15 in Czechia, 16 in Germany, 13 in the UK), and the Terms do not allow you to target it at them. In the assistant’s instructions, forbid it to address children or urge them to buy.
7. Add Yasan to your records of processing (Art. 30 GDPR) as a processor — sample row below.
8. Do not hide the AI notice, the privacy link or “Powered by” in the widget, and do not instruct the assistant to claim to be human — these are your obligations under Art. 50 of the EU AI Act and the Terms. You may give it a name and a personality.
9. Data subject requests (access, erasure…) are handled by you as controller. Write to [email protected] and we will help.
10. E-mail support: if you use the AI mailbox, make sure your policy covers automated processing of e-mails (the paragraph below does) and that automatically sent replies carry a signature disclosing AI.
11. UK shops: obtain consent for the visitor identifier exactly as in the EU (PECR regulation 6); Yasan does not use the UK statistical-analytics exemption. Advertising or cross-site tracking always needs consent.

Text for your privacy policy#

Note: the paragraph and the hosted notice cover processing through Yasan. If you further use the data yourself (e.g. search reports for your own marketing, exporting conversations to your CRM), you must describe that in your own policy.

Cookie-table rows#

Strictly necessary (no consent; stored only after the visitor actively uses the assistant):

Name	Provider	Type	Purpose	Duration
whisper-chat-active	Let’s Whisper s.r.o. (Yasan)	cookie	keeps the chat session active	session
whisper-chat-…	Let’s Whisper s.r.o. (Yasan)	local storage	keeps the conversation across page loads	until deleted
whisper-chat-ui-…	Let’s Whisper s.r.o. (Yasan)	local storage	remembers the chat window state	until deleted
whisper-chat-invitation-seen-…	Let’s Whisper s.r.o. (Yasan)	local storage	prevents repeated chat invitations	until deleted
whisper-chat-consent	Let’s Whisper s.r.o. (Yasan)	local storage	stores the visitor’s consent choice	until deleted
whisper-search-…	Let’s Whisper s.r.o. (Yasan)	local storage	keeps the search thread across page loads	until deleted
whisper-search-outbox-…	Let’s Whisper s.r.o. (Yasan)	local storage	holds an unsent search message	until sent

Analytics (consent required):

Name	Provider	Type	Purpose	Duration
whisper-chat-visitor-id	Let’s Whisper s.r.o. (Yasan)	local storage	random visitor identifier; measuring the assistant and resuming earlier searches on a later visit	until browser data is cleared or consent is withdrawn

Category description, if your banner needs one:

Help us measure what visitors look for and do not find, and recognise a visitor on a later visit. The assistant keeps working without consent.

Passing consent to the assistant#

The assistant never creates a visitor identifier without a positive consent signal. Pass the state in one of these ways:

1. Shoptet: nothing to configure — Yasan reads Shoptet’s native cookie bar automatically. Just make sure the bar is on and includes a statistics/analytics category.
2. Cookiebot, CookieYes, OneTrust: ready-made snippets are in the assistant settings in the app — add them to your site next to the banner. Step by step: Setting up cookie consent.
3. Any other banner: after the visitor decides, call window.Whisper.setConsent({ analytics: true }) or { analytics: false } on refusal or withdrawal. Withdrawal deletes the identifier immediately.

Requirements for a valid banner (GDPR / ePrivacy):

• consent before the identifier is created (no pre-ticked boxes, no “by browsing you agree”),
• refusing as easy as accepting (equal button in the first layer),
• withdrawal at any time, as easy as giving consent,
• the banner names the analytics category and links to your policy.

Row for your records of processing (Art. 30)#

Purpose	Data subjects	Data categories	Processor	Transfers	Retention
AI assistant on the website and in e-mail (customer support, product recommendations, search, measurement)	website visitors, customers	content of conversations/queries/e-mails, e-mail address, order data, basket, technical data, pseudonymous identifier (with consent)	Let’s Whisper s.r.o., Czech Republic (DPA: yasan.ai/dpa)	USA (DPF / SCCs) — AI model and infrastructure providers	24 months

Related Articles#

• Setting up cookie consent
• GDPR: how Yasan protects your data
• Data and Privacy
• Organization Management