Smallchat

Smallchat is a hosted live chat widget that connects a chat box on your website to a Slack workspace. When a visitor opens the widget and sends a message, that conversation appears as a thread inside Slack, where your team replies. To the visitor it feels like an ordinary website chat, while your team answers from a tool they already use every day.

What Smallchat is

You add Smallchat to your site with a single embed script. The script loads the chat box, styles it to match your brand and links each conversation to a Slack thread. Smallchat is a US based product, and Slack, which receives the messages, is also operated from the United States. Because the widget runs in the visitor browser and exchanges data with these external services, it is a third party processor that you need to describe in your privacy documentation.

Data and cookies collected

Smallchat sets cookies in the visitor browser to keep the chat session active and to recognise a returning visitor, so a conversation can continue across pages and visits. It collects the messages a visitor types and any contact information they choose to enter, such as a name or email address. This content flows into Slack, where each conversation becomes a thread, and it can be exported to a CSV file. All of this is personal data when it relates to an identifiable visitor.

GDPR and ePrivacy implications

Under the GDPR you are the controller for the chat data you collect, while Smallchat and Slack act as processors. You need a lawful basis, a clear privacy notice and an agreement that governs the processing. The ePrivacy Directive adds a separate rule about storing and reading cookies. A cookie that is strictly necessary to run a chat the visitor has just started can be set without prior consent, but any cookie that loads before the visitor interacts, or that serves analytics or marketing, requires consent first.

Consent requirements

The cleanest approach is to load Smallchat only after the visitor chooses to chat, or after they accept it through your consent banner. Handling the live conversation itself can usually rely on legitimate interest, because the visitor asked to talk to you. Consent is the right basis for any non essential cookie or analytics feature placed before that interaction. Whichever path you take, make it easy to refuse, and record what the visitor agreed to.

Data transfers to the US and Slack

Because Smallchat and Slack are operated from the United States, chat data about EU and EEA visitors is transferred outside the European Economic Area. These transfers should rely on a recognised safeguard, typically the EU US Data Privacy Framework where the providers are certified, supported by Standard Contractual Clauses. Name these transfers in your privacy notice, explain that messages reach a US workspace, and keep a short note of the safeguards you depend on.

Practical compliance steps

List Smallchat and Slack in your records of processing and your cookie policy, including the chat cookies and their purpose. Sign the relevant data processing terms, set a retention period for chat transcripts and visitor exports, and delete data you no longer need. Tell visitors before they share information that their messages go to your team in Slack, and respect access and deletion requests across both the widget and the Slack workspace.