Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
melibo is a German conversational AI and chatbot platform that automates customer service through an embedded chat widget. It sets functional cookies and uses session storage to operate the conversation, and it can collect optional usage analytics. Because the service runs in visitors browsers and may process personal data, it must be addressed in your cookie banner and privacy notice.
melibo is a conversational AI and chatbot platform developed by melibo GmbH in Germany. It is embedded on a website as a chat widget that automates customer service and answers visitor questions in natural language. Because the widget loads in the visitors browser and exchanges messages with melibo infrastructure, it processes personal data and must be reflected in your privacy documentation.
melibo typically sets a functional session cookie and a cookie that remembers the chat widget state, and it uses browser session storage to maintain the conversation. The content of conversations, including anything the visitor types, is processed to generate replies. Optional analytics cookies may be enabled to measure how the chat is used, and these are not strictly necessary for the service to function.
Under the ePrivacy Directive, storing or reading non essential cookies on a users device requires prior consent, while strictly necessary cookies that operate the requested chat do not. Under the GDPR, the conversation data and any analytics constitute personal data processing that needs a valid legal basis and transparent information. You remain the controller for data collected through your site and melibo acts as your processor.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Analytics and other non essential cookies should be blocked until the user gives explicit, informed consent through your cookie banner, and operating the chat itself can rely on contract or legitimate interest. melibo states that conversation data is processed within the European Union, so no transfer to a third country is expected, although some AI subprocessing may apply under a data processing agreement. You should confirm the current subprocessor list and the safeguards in place.
Sign a data processing agreement with melibo, then configure your consent management platform to gate the analytics layer and load it only after acceptance. Document the cookies and retention in your cookie policy, list melibo as a processor in your records, and inform users that conversations are processed. Periodically review transcripts retention and subprocessors to keep the documentation accurate.
Websites using melibo must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment may be advisable where chat usage is extensive or sensitive. Consider: (1) the categories of personal data exchanged in conversations, including data users type freely; (2) whether children or vulnerable users may interact with the bot; (3) the role of any AI subprocessor and the safeguards in the data processing agreement; (4) retention periods for transcripts and analytics; (5) the risk of users disclosing special category data and how the bot handles or filters it.
Sample consent text
We use melibo to provide live chat support and, with your permission, to analyse how the chat is used. Non essential cookies and analytics are only set after you click Accept. You can decline or change your choice at any time.
Third-party domains contacted
melibo.deapp.melibo.decdn.melibo.deCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| melibo_session | Functional | Session | Maintains the chat session so the conversation continues across page views. |
| melibo_widget_state | Functional | Persistent (up to 1 year) | Remembers the chat widget state, such as whether it is open or minimised. |
| melibo_analytics | Analytics | Persistent (up to 1 year) | Optional cookie that measures how visitors use the chat to improve the service. |
| melibo_csrf | Functional | Session | Security token that protects the chat against cross site request forgery. |
melibo uses cookies for user preferences — inform visitors with a consent banner.
melibo typically sets a functional session cookie and a cookie that stores the chat widget state, and it uses browser session storage to keep the conversation going. An optional analytics cookie may also be enabled to measure how the chat is used. The functional cookies are needed to run the chat, while the analytics cookie is not.
The strictly necessary functional cookies that operate the chat the user requested can be set without prior consent. However, any optional analytics cookies are non essential and require prior, informed consent under ePrivacy. You should configure your cookie banner so the analytics layer only loads after the user accepts.
Operating the chat that a visitor actively starts can rely on contract or legitimate interest under GDPR Art. 6(1). Non essential cookies and analytics rely on consent under Art. 6(1)(a) together with Art. 5(3) of the ePrivacy Directive. You should document the chosen basis for each purpose in your records of processing.
melibo states that conversation data is processed within the European Union, so no transfer to the United States is expected by default. Some AI subprocessing may apply under a data processing agreement, so you should review the current subprocessor list. If any subprocessor operates outside the EU, confirm that appropriate safeguards such as Standard Contractual Clauses are in place.
A full DPIA is not always mandatory, but it is advisable where chat usage is extensive or where conversations may involve sensitive data. Assess the categories of data exchanged, whether vulnerable users may interact with the bot, retention periods, and the role of any AI subprocessor. Documenting this assessment helps demonstrate accountability under the GDPR.
Sign a data processing agreement with melibo and integrate the widget through your consent management platform so optional analytics load only after consent. Add the cookies and their durations to your cookie policy, list melibo as a processor, and inform users that conversations are processed. Test that declining consent actually prevents non essential cookies from being set.
Other conversational AI and chatbot platforms exist, including EU based providers and open source options that can be self hosted for greater control. When comparing alternatives, weigh server location, subprocessor transparency, the availability of a data processing agreement, and how cleanly the tool integrates with consent management. The right choice depends on your data protection priorities and support needs.
List each melibo cookie with its name, type, purpose and duration, and distinguish the necessary functional cookies from the optional analytics cookie. Explain that conversations are processed to provide support and that melibo acts as a processor. Keep the entry in sync with what the widget actually sets by rescanning your site after any configuration change.