Answer privacy questions with specifics. Answers from your docs. Team replies in Slack or Telegram.

Privacy questions should have a current source

Buyers ask the same questions across security reviews, sales calls, and product support: which region stores data, who processes it, whether there is a DPA, and how long records remain available. If the answers are spread across old PDFs and a stale FAQ, sales and support may give inconsistent explanations. A docs-grounded assistant can make a maintained public statement easier to find, but only if the privacy owner treats it as controlled content.

Examples include “Is chat data hosted in the EU?”, “Can we review a DPA?”, “Are conversations used to train models?”, and “Does using this tool make our service GDPR compliant?” The first product facts can be answered directly from approved pages. The final question requires a qualified assessment of your company’s processing, notices, lawful basis, retention, and other vendors; do not let generic copy settle it.

• Keep the privacy notice and subprocessors list aligned with current operations.
• Assign an owner to review data handling statements when vendors change.
• Give visitors a human route for procurement and data-subject requests.

State MivoChat’s product facts accurately

MivoChat is hosted in Frankfurt, a DPA is available, and MivoChat does not train on your data. It uses Claude through Anthropic’s API. Put the current privacy and subprocessor pages among the connected sources so the assistant can answer those product questions from the approved description. If a question asks for a negotiated contractual position or a specific processing detail absent from those pages, the right response is “I don’t know” and a handoff.

Your team can receive that conversation in a Slack thread or Telegram topic, review the request, and reply in the same channel. The visitor sees the response in the widget. A teammate can take over, hand the conversation back to AI after the procurement question is resolved, or close it. This keeps the visitor experience in one place while the people responsible for privacy remain accountable for sensitive answers.

Compare costs using the right unit

Starter is $29/month for 1,000 AI replies, 3 seats, and one site; Pro is $99/month for 10,000 replies, 10 seats, and five sites. The monthly reply allowance counts each AI response, not each conversation. At the default 3 replies per AI conversation, the Starter allowance represents about 333 conversations.

For 333 resolved conversations, Fin at $0.99 per resolution is approximately $329.67 before seats. Treat this as a worked example, not an exact equivalent: privacy questions may resolve in one reply, while a long procurement exchange consumes more MivoChat replies. MivoChat adds no per-resolution fee. If a plan limit is reached, the conversation is handed to a human. Paid billing is coming soon; the trial lasts 14 days and needs no card.

Place the widget beside public policy pages

Add the widget to your marketing site and public documentation where buyers or users look for privacy details. A standard website install is: <script src="https://mivochat.app/widget.js" data-site="YOUR_SITE_KEY" async></script>. In a Next.js App Router site, use the supported root layout script placement using next/script. Keep the widget off pages whose authenticated data could imply it has access to a user’s account.

Connect only the policy pages you are prepared to maintain. Test questions about Frankfurt hosting, DPA availability, training, and your own retention policy. Confirm the answer reflects the current text and does not extend a narrow claim into a broader compliance guarantee. If the privacy notice changes, update the source and retest the corresponding visitor question before relying on the new wording.

A tool cannot make your company compliant

MivoChat does not access private account records, respond to a data-subject request on your behalf, change a retention setting, or take legal action. Make sure important contact routes and policy URLs are written clearly in your public pages.

Your organization determines its lawful basis, purposes, retention periods, access controls, notices, and response process. Route contractual requests, data deletion requests, and questions not answered by the published policy to your privacy owner. A clear “I don’t know” protects against inventing assurances, but a human still has to review the request and respond.