AI customer service and GDPR: what to consider
AI can be used in customer service in line with GDPR when processing locations, processing instructions and purpose are clear and a data processing agreement is in place. ZYBR’s application runs in Frankfurt, its database in Belgium and the Netherlands. With ZYBR BRAIN, its AI models run in France. Training on your customer data is excluded by contract.
Ready instantlyCancel monthlyEU hosting
What goes wrong without clear rules
If you use AI with customer data without knowing the locations and contracts, you cannot explain to your customers what happens to their data.
- Unknown locations. Application, database and AI model often run in three different places. Knowing only one of them is not enough to describe the processing.
- Training on customer data. Without a contractual rule it stays open whether your customers’ enquiries flow into training a model.
- Decisions without a human. Additional rules apply when AI decides refunds on its own.
How ZYBR solves it
ZYBR uses customer data to answer the enquiry and leaves sensitive decisions with your team.
Shop data only for the enquiry
To write a reply, ZYBR retrieves the order and delivery status from Shopify. WhatsApp, Instagram and Facebook use Meta. Training on your customer data is excluded.Your team approves sensitive replies
You enable automatic sending only for the topics you have chosen. Everything else, for example a replacement, waits as a draft in the ticket until your team approves it.
What GDPR requires when using AI
How you use the tool matters: check processing locations, processing instructions and the purpose of data use. Your privacy notice must explain the use. Additional rules apply to solely automated decisions about refunds.
- Processing locations. The ZYBR application runs in Frankfurt and the database in Belgium and the Netherlands. With ZYBR BRAIN, AI models run in Paris and Gravelines in France. WhatsApp, Instagram and Facebook use Meta; order data comes from Shopify.
- Data processing agreement and AI addendum. You sign the data processing agreement and AI addendum during setup. They exclude training on your customer data. Read the AI addendum and privacy notice.
- Processing on instructions. The provider may process the data only on your instructions and not for its own purposes.
Questions about AI and GDPR
Which AI is GDPR-compliant?
No tool is GDPR-compliant by itself; what matters is how it is used. Check where data is processed, whether a data processing agreement is available and how the provider uses the data. ZYBR's application runs in Frankfurt, its database in Belgium and the Netherlands and, with ZYBR BRAIN, its AI models in France.
May I process customer data with AI in customer service?
Generally yes, if you use the data only to handle the enquiry, the provider processes it only on your instructions, a data processing agreement exists and your privacy notice explains the use. Additional rules apply when AI decides refunds on its own. With ZYBR, training on your customer data is excluded by contract.
Where do ZYBR’s AI models run?
With ZYBR BRAIN, the AI models run in Paris and Gravelines in France. The application runs in Frankfurt, the database in Belgium and the Netherlands. Files are stored in EU data centres. WhatsApp, Instagram and Facebook use Meta; order data comes from Shopify. You sign the GDPR data processing agreement during setup.
Try ZYBR with your own customer enquiries
Connect your shop, forward your customer emails and look at the first drafts. Afterwards you decide by topic what is sent automatically.
- 1Create account
- 2Connect shop
- 3Train BRAIN
- 4Let it reply
Ready instantlyCancel monthlyEU hosting