Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentBotStar is a Vietnamese AI-powered chatbot platform for building conversational bots on websites and messaging channels including Facebook Messenger and WhatsApp. As a Vietnamese company without an EU adequacy decision, all transfers of European personal data require Standard Contractual Clauses. The AI processing of conversation content, combined with transfers to Vietnam and the US, makes BotStar a high-risk tool under GDPR that requires prior consent and careful assessment.
BotStar is a Vietnamese AI-powered chatbot platform that enables businesses to build conversational bots for websites, Facebook Messenger, WhatsApp, and other messaging channels. It provides a visual chatbot builder, live chat fallback, natural language processing, and integrations with CRM and e-commerce systems. BotStar is used by businesses across Southeast Asia and internationally to automate customer support and lead capture conversations.
BotStar collects conversation content, visitor IP addresses, browser and device information, session identifiers, and any personal data shared by users during the chatbot interaction. When integrated with Facebook Messenger or WhatsApp, it may also receive user profile information from those platforms. AI models process conversation content to generate responses and route conversations.
Vietnam does not have an EU adequacy decision. Transfers of EU personal data to Vietnamese infrastructure require Standard Contractual Clauses under GDPR Article 46. This is an additional compliance burden compared to EU-based or adequacy-covered alternatives. The AI processing of conversation content, potential collection of sensitive data shared in chat, and the Vietnam transfer combine to create a high-risk processing profile that requires a DPIA.
Consent is required before the BotStar widget loads under the ePrivacy Directive. The consent notice must disclose AI processing, the Vietnam and US transfers, and the types of data collected. Users must be informed that their conversations are processed by AI models and may be stored outside the EU.
BotStar processes data in Vietnam and the US. Vietnam requires SCCs and a Transfer Impact Assessment. US infrastructure also requires SCCs. Verify in your DPA which infrastructure processes EU data and obtain contractual safeguards covering both jurisdictions.
Block the widget until consent is obtained. Disclose AI processing and Vietnam and US transfers in your privacy policy. Sign a DPA with BotStar incorporating SCCs for both Vietnam and US infrastructure. Conduct a mandatory DPIA. Advise users not to share sensitive personal data in the chatbot. Document all processing and transfers in your RoPA.
Websites using BotStar must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is required for BotStar deployments given the AI processing of conversation content, transfers to Vietnam (no EU adequacy), and potential collection of sensitive data via chat. The combination of AI analysis, cross-border transfer to a non-adequate country, and automated conversation processing meets multiple GDPR Article 35 trigger criteria.
Sample consent text
We use BotStar to power our AI chat assistant. BotStar processes your conversation data using AI and may transfer data to Vietnam and the United States. Please accept to enable the chat assistant.
Third-party domains contacted
botstar.comapi.botstar.comcdn.botstar.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| bs_session | session | Session | Session identifier used to maintain the active BotStar chatbot conversation state |
| bs_uid | persistent | 1 year | Visitor identifier used to recognise returning users and personalise chatbot interactions |
BotStar uses cookies for user preferences — inform visitors with a consent banner.
Get started freeBotStar collects conversation content, IP addresses, browser and device information, session identifiers, and any personal data shared in the chat. When integrated with Facebook Messenger or WhatsApp, it may receive user profile data from those platforms. AI models process conversation content to generate responses.
Yes. BotStar sets non-essential cookies and processes conversation data using AI from the first interaction. Prior consent is required. The consent notice must disclose the AI processing and transfers to Vietnam (no EU adequacy) and the US.
Consent (Art. 6(1)(a)) is required for tracking cookies and AI conversation processing. Legitimate interest may apply for conversation data when a user actively initiates chat, but the Vietnam transfer and AI processing create a risk profile that makes consent the safer basis.
Yes, to Vietnam and the US. Vietnam has no EU adequacy decision, requiring SCCs and a Transfer Impact Assessment. US infrastructure also requires SCCs. Verify in your DPA which infrastructure handles EU data and obtain contractual safeguards for both jurisdictions.
Yes, a DPIA is required. The Vietnam transfer to a country without EU adequacy, combined with AI processing of conversation content and potential collection of sensitive personal data, meets multiple GDPR Article 35 trigger criteria.
Block the widget until consent is obtained. Disclose AI processing and Vietnam and US transfers in your privacy policy. Sign a DPA with BotStar incorporating SCCs for both jurisdictions. Conduct a mandatory DPIA. Advise users not to share sensitive data in the chatbot.
Boost.ai (Norway) and Vergic (Sweden) process all data within the EU with no third-country transfers. Userlike (Germany) offers EU-hosted chatbot functionality. For Facebook Messenger bots specifically, ManyChat offers EU data processing. Any EU-based chatbot platform eliminates the Vietnam transfer risk.
Add a section explaining that BotStar processes chatbot conversation data in Vietnam and the United States, that Vietnam does not have an EU adequacy decision, that Standard Contractual Clauses are the applicable transfer mechanism for both jurisdictions, and that a Transfer Impact Assessment has been conducted as part of your DPIA.