> ASAPP adds an AI chat and messaging widget that processes customer conversations in the United States. Consent, cookies and transfers under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/customer-support/asapp Customer support # ASAPP Analytics · [Official website](https://www.asapp.com) ASAPP is a United States based enterprise artificial intelligence platform for customer experience and contact centres. When embedded as a chat or messaging widget it loads from ASAPP servers, opens a conversation session and applies machine learning to automate messaging and voice interactions and to assist human agents. The widget records the customer interaction, which can include sensitive details, and it reads and writes cookies and browser storage to keep the session and to identify the user. Because this involves large scale processing of potentially sensitive data and non essential identifiers, ASAPP should load only after the visitor has given consent. [Block ASAPP until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States. ASAPP, Inc. hosts its Customer Experience platform and machine learning infrastructure in United States regions. There is no documented European Union data residency option, so customer interaction data is processed on United States infrastructure by default. Overview ## What does ASAPP do? ## **What ASAPP is** ASAPP is an enterprise artificial intelligence platform for customer experience and contact centres, based in the United States. It automates messaging and voice interactions and assists human agents with machine learning models that suggest replies, summarise conversations and predict outcomes. When it is added to a website, ASAPP runs as an embedded chat or messaging widget that loads its code from ASAPP servers and renders inside the host page. ## **What data and cookies ASAPP collects** When a visitor opens the widget, ASAPP creates a conversation session and records the customer interaction: the messages exchanged, the intents detected, agent handovers and the outcome of the contact. Because customers can type anything into a chat, these interactions may reveal sensitive information such as health, financial or account details. ASAPP applies machine learning models to this content to automate and assist the exchange. It stores session and identifier values in cookies and browser storage so that the conversation persists and the user can be recognised, and it connects the page session to its own session through a context provider. ## **GDPR and ePrivacy implications** The interaction content and identifiers that ASAPP processes are personal data under the GDPR, because they relate to an identifiable person, and they can include special category data when a customer shares sensitive details. Storing and reading identifiers on the visitor device also falls within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers. The scale of the processing and the use of machine learning raise both the risk level and the compliance obligations of the controller. ## **When consent is required** Consent is required before the ASAPP widget loads, because the identifier storage and behavioural processing it performs are not strictly necessary to deliver the content of the page. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the widget script should not run and no cookies or browser storage entries should be written. Where the widget is offered as an optional support channel, the moment the visitor opens it should be paired with clear information rather than treated as an implied agreement. ## **Transfers of data to the United States** ASAPP processes data on United States infrastructure, so European customer data is transferred outside the European Economic Area. Such transfers require the EU Standard Contractual Clauses 2021/914 within the ASAPP Data Processing Agreement and a documented Transfer Impact Assessment that considers United States surveillance law, in line with the Schrems II ruling and the guidance of the European Data Protection Board. Because the interactions can be sensitive and are processed at large scale, the supplementary measures assessed in that document deserve particular attention. ## **Practical steps for compliant use** Gate the ASAPP widget behind your consent management platform so it fires only after the relevant category is accepted. Describe ASAPP clearly in your cookie policy, including the session and identifier values it sets and their lifetime. Sign the ASAPP Data Processing Agreement, complete a Transfer Impact Assessment and, given the large scale processing of potentially sensitive interactions, carry out a Data Protection Impact Assessment under Article 35 GDPR. Apply the shortest workable retention on conversation records, restrict access to the machine learning outputs and minimise the personal data sent to ASAPP. Compliance ## ASAPP and the GDPR ASAPP is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior, freely given, specific, informed and unambiguous consent under Article 6(1)(a) GDPR is required, because the embedded widget reads from and writes to the visitor terminal (cookies and browser storage) and processes customer interaction data that qualifies as personal data and can include sensitive details. Article 5(3) of the ePrivacy Directive 2002/58/EC, transposed as Article 82 of the French Loi Informatique et Libertes under the TDDDG, section 25 of the German TDDDG and Article 22.2 of the Spanish LSSI CE, makes prior consent mandatory before ASAPP loads. Legitimate interest is not a valid basis for this non essential and large scale processing. - Risk level high - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, French TDDDG and CNIL guidelines on trackers, German TDDDG, Spanish LSSI CE and AEPD cookie guide, EDPB Schrems II Transfer Impact Assessment, EU Standard Contractual Clauses 2021/914, Article 35 GDPR Data Protection Impact Assessment ### Impact assessment (DPIA) A Data Protection Impact Assessment is likely to be mandatory under Article 35 GDPR, because ASAPP carries out large scale processing of customer interaction data with machine learning and those interactions can reveal sensitive information. Document the interaction data captured by the widget, the session and identifier values stored in cookies and browser storage, the automated processing and profiling performed by the models, the transfer of data to the United States and the retention period applied to conversation records. Configure the widget so that it loads only after consent and minimise the personal data sent to ASAPP. ### Sample text for your banner > We use ASAPP, an artificial intelligence customer experience service operated by ASAPP, Inc. (United States), to power our chat and messaging. ASAPP records your conversation, applies machine learning to assist it and stores session and identifier values in cookies and browser storage on your device. This data may be transferred to the United States under the EU Standard Contractual Clauses. ASAPP will only load if you click Accept. Cookies and trackers ## What ASAPP sets and contacts - Tracking method JavaScript Web SDK loaded from ASAPP servers such as sdk.asapp.com and served through a customer specific API host on api.asapp.com. When embedded as a chat or messaging widget the SDK opens a conversation session, instruments the customer interaction (messages exchanged, intents detected, agent handovers and outcomes) and applies machine learning models to automate messaging and voice contacts and to assist human agents. ASAPP connects the page session to its own session through a context provider and identifies the user with session and identifier values stored in cookies and browser storage. - Server location United States. ASAPP, Inc. hosts its Customer Experience platform and machine learning infrastructure in United States regions. There is no documented European Union data residency option, so customer interaction data is processed on United States infrastructure by default. - Data transferred outside the EU ASAPP, Inc. is a company incorporated in the United States and processes customer interaction data and session identifiers on United States infrastructure. European customer data is therefore transferred to the United States and must be covered by the ASAPP Data Processing Agreement incorporating the EU Standard Contractual Clauses 2021/914, together with a Transfer Impact Assessment as required by the Schrems II ruling. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------------- | ------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ASAPP-session | HTTP cookie (first party) | Session | Maintains the active chat or messaging session so that the messages and context of a single visit are grouped together while the visitor interacts with the widget. | | ASAPP-anon-id | HTTP cookie (first party) | Persistent (up to 12 months) | Stores a persistent identifier so that ASAPP can recognise a returning user, link a conversation to its context provider session and attribute interactions to a single profile. | | asapp\_sdk\_state | localStorage | Persistent (until cleared) | Holds the widget state and buffers interaction events (messages, intents and outcomes) before they are sent to ASAPP endpoints on api.asapp.com. | ### Third-party domains contacted (3) - `asapp.com` - `sdk.asapp.com` - `api.asapp.com` Questions ## Frequently asked questions about ASAPP Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies and storage does ASAPP set? ASAPP sets a first party session cookie that lasts for the visit, a persistent identifier that can last up to twelve months, and browser storage entries that hold the widget state and buffered interaction events. Together they let ASAPP keep the conversation, recognise a returning user and record how the chat is used. ### Do I need consent before loading ASAPP? Yes. ASAPP writes identifiers to the visitor device and processes chat interactions with machine learning, which is not strictly necessary to display the page, so under the ePrivacy rules you must obtain prior consent before the widget loads. The script should stay blocked until the visitor accepts. ### What is the legal basis for ASAPP? The valid legal basis is consent under Article 6(1)(a) GDPR, combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Legitimate interest cannot be used for this non essential and large scale processing, and where interactions reveal special category data an explicit consent condition also applies. ### Does ASAPP transfer data to the United States? Yes. ASAPP hosts its platform on United States infrastructure, so European customer data is transferred there. You need the EU Standard Contractual Clauses 2021/914 in the ASAPP Data Processing Agreement and a Transfer Impact Assessment, in line with the Schrems II ruling, to cover the transfer. ### Do I need a DPIA for ASAPP? Very likely yes. A Data Protection Impact Assessment is expected under Article 35 GDPR because ASAPP carries out large scale processing of interaction data with machine learning and those interactions can be sensitive. Assess the tracking, the identifiers, the automated processing and the United States transfer. ### How do I implement ASAPP compliantly? Load the widget only through your consent management platform after the relevant category is accepted, describe ASAPP in your cookie policy, sign the Data Processing Agreement and complete a Transfer Impact Assessment and a Data Protection Impact Assessment. Minimise the data sent, restrict access to model outputs and apply a short retention period. ### Are there alternatives to ASAPP? Alternatives include Cognigy, Ada, Kore.ai, LivePerson and Zendesk AI agents. They raise similar consent, cookie and transfer questions, so evaluate their hosting location, their machine learning practices and their data processing terms before assuming any of them is lighter on privacy. ### How do I update my cookie policy for ASAPP? Add a dedicated entry that names ASAPP as the provider, lists the session and identifier values with their lifetimes, explains the interaction data collected and the machine learning applied, and discloses the United States transfer and its safeguard. Keep the entry in step with your consent categories. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [REI Chat](https://www.flowconsent.com/en/services/customer-support/rei-chat) [REI Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. REI Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, REI Chat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/rei-chat) [Preferences](https://www.flowconsent.com/en/services/customer-support/rei-chat) · ### [Quickchat AI](https://www.flowconsent.com/en/services/customer-support/quickchat-ai) [Quickchat AI is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Quickchat AI integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Quickchat AI makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/customer-support/quickchat-ai) [Preferences](https://www.flowconsent.com/en/services/customer-support/quickchat-ai) · ### [LimeChat](https://www.flowconsent.com/en/services/customer-support/limechat) [LimeChat is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. LimeChat integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, LimeChat makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/customer-support/limechat) [Preferences](https://www.flowconsent.com/en/services/customer-support/limechat) · ### [Envybox](https://www.flowconsent.com/en/services/customer-support/envybox) [Envybox is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Envybox integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Envybox helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/envybox) [Preferences](https://www.flowconsent.com/en/services/customer-support/envybox) · ### [Combodo iTop](https://www.flowconsent.com/en/services/customer-support/combodo-itop) [Combodo iTop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Combodo iTop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Combodo iTop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/combodo-itop) [Preferences](https://www.flowconsent.com/en/services/customer-support/combodo-itop) · ### [Faveo](https://www.flowconsent.com/en/services/customer-support/faveo) [Faveo is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Faveo supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Faveo ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/customer-support/faveo) [Preferences](https://www.flowconsent.com/en/services/customer-support/faveo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)