GDPR Check for AI Chatbots and AI Search in TYPO3: 12 Questions Your Data Protection Officer Will Ask

Your data protection officer (DPO) will check any AI chatbot or AI search in TYPO3 against the GDPR before it goes live, and three things decide the outcome: where visitors' inputs go, what gets stored, and who controls both. For AI Chatbot (T3AC) and AI Search (T3AS), the AI extensions for TYPO3 by T3Planet, each has a concrete answer, down to the database table. Below are twelve questions in the order a DPO asks them, and a checklist at the end you can hand straight over.

AI Chatbot and AI Search are extensions inside your TYPO3, built on one shared base: the same data sources, the same training, the same usage analytics. So every answer here covers both, and each comes from the technical documentation that T3Planet, a TYPO3 Association Gold Member since 2011, maintains for both products. Where they differ, we say so.

• The model only gets what it needs to answer: the visitor's question, matching excerpts from your content, and your instructions. No IP address, user agent, session ID, cookies or visitor ID.
• Chats and searches are stored in your TYPO3 database. One switch per product turns storage off.
• You choose which model answers, in AI Foundation (T3AF): any provider with your own API key, a local model, or the optional AI Credits.

How far the data travels varies depending on the model you choose. That is where your DPO's first three questions land, and where we back you with documentation they can file.

1. Who is the controller, and who is the processor?

Short version: you are the controller, your AI provider is the processor, and T3Planet stays out of the data path unless you choose AI Credits. Both extensions run on your own server, so with your own API key or a local model we never see a chat or a search. The only thing our premium extensions send us is a licence check, carrying the licence key and the domain. With the optional AI Credits, T3Planet becomes the processor and the AI providers become sub-processors. Under the EU AI Act, you are also the deployer.

2. Do we need a data processing agreement (DPA), and with whom?

It depends on who runs the model. AI Foundation offers three routes:

We can run a custom language model (custom LLM) for you on your server or on T3Planet infrastructure. In the second case T3Planet takes part in the processing, so talk to us about the DPA. AI Foundation itself is free, open source and runs no licence check.

3. Does any data leave the EU?

Only if you pick a provider outside the EU. That is a setting in AI Foundation, not a fixed default. With a local model the question never leaves your server. If your DPO requires EU-only processing, use your own key with a European provider whose contract commits to it, or a local model. Review the transfer safeguards in each provider's contract together with your DPO. With AI Credits, T3Planet selects the AI providers, and no commitment on processing location comes with it.

See AI Foundation

4. What data goes to the AI model?

Each request carries the visitor's message or query, the passages from your content that match it, and the instructions you set in the backend. Search may add one more call, to the embedding service (the service that turns text into search vectors), and that call also carries only the query.

The catch is the visitor's own text: it travels as typed. A name or a customer number in the question reaches the model too. So ask visitors, in the welcome message, not to enter personal details. We are happy to draft that line together with you.

Both widgets also offer voice input through a microphone. It uses the browser's speech recognition, and depending on the browser the browser vendor processes the audio. If your DPO would rather avoid that, switch voice input off in the backend.

5. What never reaches the AI model?

Both products document the same list: no IP address, no user agent, no session ID, no cookies and no visitor ID. Search adds one more: the page URL never travels as a tracking field. Unless visitors name themselves, the model knows what was asked and nothing about who asked it.

6. What is it trained on, and can it make things up about people?

On sources you pick: TYPO3 pages, a sitemap, single URLs, PDF files up to 25 MB, question-and-answer pairs or plain text. The AI model itself is not retrained. Your content is split into passages and stored as a search index in your database. To build that index the passages go once to the embedding service you set in AI Foundation, and that can be local too.

Keep personal data out of these sources. Before the first training run, check whether a sitemap includes pages with staff details, comments or form results.

Answers are grounded in those sources and show them: source links are on by default in both products. The follow-up instructions we ship tell the model not to add knowledge that is not in your content, and a threshold decides whether the system answers or declines. Mistakes remain possible, and both widgets tell visitors so.

See AI Chatbot

7. What is stored, and where?

In your own TYPO3 database, and nowhere else. With history on, AI Chatbot keeps the conversation (messages, answers and visitor feedback), the session data, and a hashed IP address that the documentation classes as pseudonymised rather than anonymous. AI Search keeps less: the query up to 255 characters, the answer, the source paths it used and, for follow-ups, a technical session ID. No IP address, user agent, cookie or frontend user is stored on the search side.

In the visitor's browser each widget keeps one localStorage entry: AI Chatbot a visitor ID, AI Search up to five recent search terms. The visitor ID stays even with history switched off. AI Chatbot also holds live chats in a cache for about 24 hours.

8. How long is data kept, and how is it deleted?

Unless you set a period, entries stay until someone deletes them. A fixed retention period takes three steps:

1. Find the command. In AI Foundation, open Scheduler & CLI. The command t3af:history:cleanup deletes AI Chatbot and AI Search history older than the retention period.
2. Create the task. Add a TYPO3 Scheduler task for the command and set the period in days. Without one, 90 days apply.
3. Record the period. Run the task daily and copy the period into your record of processing activities and your privacy notice.

To delete single entries, go to Usage Analytics, where you can also select several at once. That is your route for erasure requests under Art. 17 GDPR and access requests under Art. 15. Because the data is pseudonymised, you usually find a person's entry through its content, for example a name they typed themselves, and the full-text search in Usage Analytics helps with that. Who may open this area is set per backend group in AI Permissions.

9. Can we switch storage off completely?

Yes, with one switch per product: "Save chatbot history" in AI Chatbot and "Save search history" in AI Search. When it is off, no new chats or searches are written to the database. Chat still works for the current visit and search still answers. The recent-searches list, the search feedback thumbs and the Usage Analytics reports go with it, which is a trade-off best settled together with your DPO.

See AI Search

10. What belongs in the privacy notice?

A section on the chatbot and the search. It states the purpose, the legal basis your DPO sets, the AI provider as a recipient, any transfer outside the EU, the retention period from your cleanup task, and voice input if you keep it on. Add the two localStorage entries too. For German visitors, § 25 TDDDG governs whether they need consent; elsewhere your national ePrivacy rules do, and either way it is your DPO's call. The visitor ID lets a chat continue; the recent searches are a convenience that disappears with the history switch. We pull the technical details for this section together for you from the documentation.

11. Do visitors have to know they are talking to AI?

Yes. Article 50 of the EU AI Act requires that people are told when they interact with an AI system, and both widgets show an AI notice for that. As the deployer, check that the wording and placement fit your site. What the widgets ship is compliance-ready tooling, not a compliance guarantee. For everything else the AI Act asks of TYPO3 site owners, read our guide to the EU AI Act for TYPO3.

12. Do we need a data protection impact assessment (DPIA)?

Your DPO decides under Art. 35 GDPR. Look closer when your visitors are especially vulnerable, such as patients, children or job applicants, when they are likely to type health or financial details, when you keep history for a long time, or when the AI provider sits outside the EU. German readers have a useful basis in the data protection authorities' guidance on AI and data protection of 6 May 2024.

Settle these ten before go-live, and pass the list on together with the technical documentation for AI Chatbot and AI Search.

1. Model mode chosen and recorded: own key, local model or AI Credits.
2. DPA signed with the AI provider, or with T3Planet for AI Credits.
3. Transfers outside the EU reviewed, or avoided with an EU provider or a local model.
4. Data sources checked for personal data.
5. History decided: on with a retention period, or off.
6. Cleanup task t3af:history:cleanup added to the scheduler.
7. Access to Usage Analytics limited to the backend groups that need it, in AI Permissions.
8. Voice input deliberately on or off.
9. Privacy notice updated, localStorage entries included.
10. AI notice in the widget reviewed, and the need for a DPIA assessed.

Jürgen, AI Consultant for TYPO3 at T3Planet, works through AI Chatbot and AI Search together with you, from the model choice to the cleanup task. T3Planet by NITSAN Technologies has been a TYPO3 Association Gold Member since 2011 and won a TYPO3 Award in 2018.

Book a demo with Jürgen