You upload the content
Website pages, PDFs, price lists and manuals reach our systems and are stored on infrastructure located in the European Union.
Data security and GDPR compliance
Widgeto is built by an Italian company and your content is stored in the European Union. Below is the full path of every piece of data, with no vague formulas: what stays in the EU, the one step that leaves it, and the contractual guarantees that cover it.
The journey of one of your documents
From the moment you upload it to the moment a visitor reads the answer.
Widgeto indexes it
The text is split and turned into search indexes, still in the EU. This is the copy the chatbot consults to find the right passage.
A visitor asks a question
Widgeto picks the few relevant excerpts and sends them to the language model together with the question. This is the only step in which a fragment of your content leaves the European Union: the OpenAI endpoints we use today are based in the United States.
The answer goes back to the visitor
The model writes the reply and returns it. OpenAI does not keep those fragments to train its models: that is the default behaviour of the business APIs, written into the agreement we signed.
Where each kind of data lives
| Data | Where it lives | Who can reach it |
|---|---|---|
| Indexed content (website, PDFs, price lists) | European Union | Your account only. Excerpts are sent to the model at answer time. |
| Visitor conversations | European Union | Your account only, from your dashboard. |
| Contacts captured by the chatbot | European Union | Your account only, exportable whenever you want. |
| Private sources | European Union | Used to build answers, never shown to the visitor. |
| Fragments sent to generate an answer | United States (OpenAI endpoints) | Not retained for training. DPA and standard contractual clauses. |
| Billing data | European Union | Our administration and the payment provider. |
The guarantees, in plain words
Your content does not train the model
What you upload serves to answer your visitors and nothing else. The business APIs we use do not take data sent through them into training: it is the default behaviour, not a switch we might forget to flip.
We sign a DPA with you
We provide the data processing agreement you need for your record of processing activities: you are the controller, we are the processor. Ask for it from the contact page.
One sub-processor outside the EU
The language model provider. That transfer is covered by the Data Processing Addendum and by standard contractual clauses, and we declare it in the DPA we give you.
You delete whenever you want
Remove a document and it leaves the index: the chatbot stops using it to answer. Close your account and we remove content, indexes and conversations.
Private sources
Some documents are needed to answer well but must never be shown: the price list with your margins, the internal returns procedure, the terms reserved for one channel. Widgeto lets you upload them as private sources.
The chatbot uses them to build the answer, but never quotes them, never links them and never shows excerpts to the visitor. They live inside the same EU perimeter as everything else and follow the same deletion rules.
Questions about data security
On infrastructure located in the European Union, together with the search indexes and the conversations. The only data that leaves the EU today are the excerpts sent to the language model at the moment it writes an answer.
No. Neither by us nor by the model provider: the business APIs we use do not take data sent through the API into training.
You can, from your dashboard. Our technical staff only access them if you ask us for help with a specific problem, and only for as long as it takes to solve it.
Yes. Write to us from the contact page and we will send it over. You need it for your record of processing activities, since you are the controller of your visitors' data and we process it on your behalf.
It leaves the index and the chatbot stops using it to answer. If you close your account we remove content, indexes and conversations.
You are. Your visitors' data is yours. Widgeto processes it as a processor, which means only to run the service and following the instructions the DPA puts in writing.