Quiq Messaging

What Quiq Messaging is and how it works

Quiq Messaging is a customer engagement platform operated by Quiq Inc., a software vendor based in Bozeman, Montana. It lets brands engage visitors through web chat, SMS, Facebook Messenger, WhatsApp, Apple Messages for Business and Google Business Messages, with a unified agent desktop and an asynchronous conversation model. The platform also includes Quiq AI Studio, a generative AI workbench that automates a portion of the conversations and allows agents to assist customers more efficiently. The integration on a website typically takes the form of a JavaScript widget loaded from a Quiq CDN.

Cookies and personal data collected

The Quiq web widget writes first party local storage entries and cookies that include the conversation identifier (typically quiq-conversation-id), the anonymous visitor identifier (quiq-anon-id) and an agent session token. The platform also collects the IP address, the user agent, the timestamp of each message, the page from which the chat was opened and the entire content of every message exchanged. When generative AI is enabled, transcripts are processed through a large language model which may persist the prompts for quality monitoring.

GDPR and ePrivacy implications

Cookies that are strictly necessary to maintain an active chat session can be loaded without consent under Article 5(3) of the ePrivacy Directive when the visitor explicitly opens the chat. Cookies used for proactive engagement, behavioural targeting or cross site tracking require consent. Conversation transcripts contain personal data and sometimes special category data, so the controller must inform the visitor under Articles 13 and 14 GDPR, identify the legal basis (typically contract performance for the chat itself and consent for any AI training) and document the retention period.

International data transfers and Schrems II

Quiq Inc. is a US controller subject to FISA 702 and Executive Order 14086. Conversations are stored on AWS infrastructure in the United States. Transfers rely on the EU US Data Privacy Framework where Quiq is self certified, complemented by Standard Contractual Clauses where the framework does not apply. European controllers must perform a Transfer Impact Assessment, document the supplementary measures put in place (encryption keys held in the EU, pseudonymisation of contact details, restricted US support access) and reference both mechanisms in the record of processing activities.

Compliance steps for a clean deployment

Activate the chat widget only after the visitor has explicitly opened it or after they have accepted the relevant cookie category through your Consent Management Platform. Configure short retention periods for transcripts, mask payment card numbers and other sensitive identifiers, restrict the use of generative AI to non sensitive scenarios, sign a Data Processing Agreement and the Standard Contractual Clauses with Quiq Inc., document the Transfer Impact Assessment and reference Quiq in the cookie banner detailed view and in the privacy notice.