SealReplyIs Your Live Chat Private? What Happens to Your Chat Data
Your chats hold names, emails, orders and complaints. Here's where that data goes, who can read it, and the questions to ask any live chat provider.
Live chat is only as private as the service behind it. Every message a visitor sends is stored by your chat provider, and it often contains names, emails, phone numbers, order details and sometimes complaints. Whether that's safe depends on three things: how it's stored, who can read it, and what you can do with it when a visitor asks.
This guide explains each one, gives you questions to ask any provider, and shows how SealReply handles them.
What a live chat tool stores
More than the messages. A typical chat tool keeps:
- Messages and files sent in the chat, in both directions.
- Visitor details: name and email if they gave them, location from their IP address, browser and device.
- Browsing trail: where the visitor came from and which pages they viewed.
- Your notes, tags and leads about that visitor.
All of this is personal data. In many countries, including under the GDPR in the EU and the UK, you are responsible for it — even though your provider stores it.
1. How is it stored?
Ask: Is chat data encrypted at rest? Is it encrypted with a key shared by every customer, or one per customer?
In SealReply: chats are stored encrypted, with a separate key for each customer.
It's worth being precise here, because providers often blur it. This is server-side encryption, not end-to-end encryption. With end-to-end encryption, only the people in the conversation could read it, and features like search, email replies and translation would be very hard to offer. With server-side encryption, the service can decrypt the data to run those features, so the real question becomes the next one.
2. Who on the provider's side can read it?
This is the question most providers answer vaguely. "Only authorised staff" can mean anyone in support.
Ask: Can support staff open my conversations? Who approves that? Will I know?
In SealReply:
- Our staff can't read your conversations on their own.
- The only exception is an emergency access request for an abuse report or a lawful request. A second senior staff member must approve it. It covers one site and at most 7 days of conversations, and ends after 24 hours.
- You're notified by email, and every approval and every conversation opened is listed in your console under Account security → Platform access.
If nobody has ever been allowed in, that page says so.
3. Where does it go besides the provider?
Ask: Which other companies receive chat data, and what exactly do they receive?
Look out for translation, AI and email services. In SealReply, the one to know about is DeepL, and only if you turn on message translation (Pro and Business plans): only the text of the messages your team chooses to translate is sent, never visitors' names, emails or other details. New-chat and offline-message notification emails to your team don't contain what visitors wrote.
4. How long is it kept?
The less you keep, the less can leak. Many tools keep everything forever by default.
Ask: How long is chat history kept? Can I keep it for less?
In SealReply: each plan keeps history for a set time, and the owner can choose to keep it for less under Team → Workspace settings → Keep chat history for. Ended conversations, their messages and files, and offline messages older than that are deleted for good. To protect you from mistakes or a hijacked account, a shorter period takes effect after 72 hours, and you're emailed; you can undo it until then.
5. What happens when a visitor asks for their data?
Under the GDPR and similar laws, visitors can ask to see their data or have it deleted. You need to be able to do this without writing to your provider and waiting.
Ask: Can I export everything about one visitor? Can I delete it?
In SealReply: under Settings → Visitor data requests, find a visitor by the exact email they gave. Then:
- Export this visitor's data gives you a copy to send them.
- Delete all data about this visitor removes their details, browsing trail, every conversation with its messages and files, ratings, leads and offline messages. It can't be undone, so export first if they asked for a copy. Report totals and IP blocks stay, because they don't identify the visitor.
6. Can you take your data with you?
Ask: Can I export all my chat history on my plan, whenever I want?
In SealReply: Reports → Export chat history exports every message of conversations in a date range (up to 31 days at a time), internal notes included, as CSV or JSON. Every export is recorded in the activity log.
Tell your visitors
Being open about chat data is part of keeping it private:
- Mention the chat in your privacy policy: what it collects, who provides it, how long you keep it.
- Show a privacy notice in the chat. SealReply can show a short line under the chat linking to your policy (Sites → your site → Privacy notice; off by default). Visitors can chat whether or not they open it.
- Ask for less. Don't make visitors give their name and phone number just to ask a question.
A checklist for any live chat provider
| Question | A good answer |
|---|---|
| Encrypted at rest? | Yes, ideally with a key per customer |
| Can staff read chats? | Not on their own; approval by a second person; you're told |
| Who else gets the data? | A short, named list, and only what each one needs |
| How long is it kept? | A clear default, and you can shorten it |
| Visitor asks for their data? | Export and delete one visitor yourself |
| Leaving? | Export everything on your plan |
Choosing a tool? See How to choose live chat software for the other questions worth asking.
This article explains how chat data is handled; it isn't legal advice. If you're unsure what the GDPR or your local law requires of you, ask a lawyer.