Smartsupp

What is Smartsupp

Smartsupp is a Czech live chat and customer engagement platform founded in Brno in 2013. It combines a real time chat widget, video visitor recordings, AI shopping assistants (Mira), and Facebook Messenger integration in one product designed primarily for e commerce and small business websites.

The widget is loaded on a website with a small JavaScript snippet served from www.smartsuppchat.com. Once initialised, it places first party cookies, opens a websocket to Smartsupp servers in the Czech Republic, and (when enabled) starts recording visitor interactions on the page.

What data does Smartsupp collect

Smartsupp processes the visitor IP address, browser User Agent, current page URL, referrer, persistent visitor ID (cookie ssupp.vid), visit counters (ssupp.visits), approximate geolocation derived from IP (cookie ssupp.geoip), full chat message content, and any contact information voluntarily provided.

When session recording is enabled, Smartsupp additionally captures mouse movements, clicks, scrolling and form interactions, reconstructed as a replayable video. This is a high risk feature: unless sensitive fields are explicitly masked, payment details, passwords, health information, or other special category data may end up in the recording.

Cookies and tracking technologies

The main first party cookies are ssupp.vid (visitor identifier, 1 year), ssupp.visits (session counter, 1 year), ssupp.geoip (geolocation by IP, 1 year), ssupp.chatid (active chat identifier, session), and ssupp.utid (user tracking ID, 1 year). LocalStorage is also used to cache transcripts and configuration.

These cookies are not strictly necessary for the visitor to use the website itself, so they fall under Art. 5(3) ePrivacy and §25 TTDSG: prior informed consent is required before the script writes them.

GDPR, ePrivacy and data transfers

Smartsupp s.r.o. acts as a processor under Art. 28 GDPR for chat content and visitor recordings. A signed Data Processing Agreement is mandatory and the relationship must appear in your Records of Processing Activities (Art. 30 GDPR). Smartsupp stores chat data in the European Union (Czech Republic) and explicitly markets EU data residency as a differentiator versus US competitors.

Smartsupp uses Cloudflare as CDN for static widget assets, which may transit through global edge nodes. This typically does not involve personal data processing of chat content but should be noted in the transfer impact assessment. AI assistant features rely on third party LLM backends and may introduce additional transfers that must be evaluated separately.

Consent requirements

Because the widget script writes non essential cookies on load, the recommended pattern is to gate the smartsuppchat.com script behind a consent management platform: only inject the script after the visitor has accepted the Functional and Analytics categories. If video recording is enabled, present it as a separate analytics or marketing toggle.

Avoid the click to open pattern for Smartsupp specifically, since the visitor recording feature must be loaded with the page to be useful, and post click activation defeats the analytics purpose.

Implementation checklist

Sign the Smartsupp DPA. List Smartsupp s.r.o. in your RoPA as processor. Configure recording masking for all input fields and any element with sensitive data (CSS class data sensitive or data smartsupp ignore). Defer the script until consent. Document the legal basis for chat content (typically contract for support, legitimate interest for sales).

If you use Mira AI assistant, validate the location of the underlying LLM provider, document it as sub processor, and review whether your sector regulator (CNIL, BfDI, AEPD, Garante) treats it as high risk processing requiring a DPIA.