FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Customer support

Superchat

PreferencesOfficial website

Superchat is a German messaging and customer communication platform that aggregates WhatsApp Business, SMS, email, and other channels into a unified inbox. As a German company with EU infrastructure, the core platform data is GDPR-compliant. However, WhatsApp Business API messages are processed by Meta (US), requiring SCCs. Marketing messages sent via any channel require prior consent under both GDPR and the ePrivacy Directive.

Block Superchat until consentScan my site
Overview

What does Superchat do?

What is Superchat?

Superchat is a Berlin-based business messaging platform that provides a unified inbox for customer communications across WhatsApp Business, SMS, email, Instagram, and other channels. It allows businesses to manage all customer conversations from a single interface, send automated follow-up messages, and run broadcast marketing campaigns. Superchat's core platform operates on EU infrastructure, but WhatsApp Business API messages flow through Meta's global network.

What data does Superchat collect?

Superchat processes contact names, phone numbers, email addresses, and the full content of customer messages across all channels. For WhatsApp Business API, Meta processes message metadata and routes messages through Meta's global infrastructure. Superchat stores conversation history, contact profiles, and campaign engagement data on EU servers.

GDPR and WhatsApp Business implications

Superchat's core platform data is GDPR-compliant due to EU infrastructure. The WhatsApp Business API introduces a US transfer via Meta, requiring SCCs. Marketing messages via WhatsApp, SMS, or email require prior consent under both GDPR and the ePrivacy Directive. Transactional messages related to an existing service relationship may rely on contract performance or legitimate interest.

Consent requirements for messaging

Marketing messages via any channel require prior explicit consent. WhatsApp specifically requires opt-in through approved channel opt-in flows under Meta's WhatsApp Business Policy. Contacts must explicitly agree to receive messages before any marketing communication is sent. The consent mechanism and opt-in record must be maintained and available to demonstrate upon request.

Data transfers and WhatsApp routing

Superchat's own infrastructure is EU-based. WhatsApp Business API messages are processed by Meta (US), requiring Standard Contractual Clauses for that data flow. Sign both Superchat's DPA and Meta's WhatsApp Business data processing addendum. Document both transfers in your RoPA.

Practical compliance steps

Obtain prior consent before sending any marketing messages. Implement WhatsApp opt-in flows compliant with Meta's policy. Sign DPAs with both Superchat and Meta. Update your privacy policy to describe both Superchat and Meta as processors. Document the WhatsApp data transfer in your RoPA. Maintain consent records for all messaging contacts.

Compliance

Superchat and the GDPR

Superchat is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR) for marketing messages. Contract performance (Art. 6(1)(b)) for transactional customer service messages. Legitimate interest (Art. 6(1)(f)) for follow-up messages within an existing customer relationship.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, UK GDPR

Impact assessment (DPIA)

A DPIA is advisable when Superchat is used for large-scale marketing messaging campaigns via WhatsApp, as this involves both EU to US data transfer (Meta) and the processing of mobile phone numbers and message content at scale.

Sample text for your banner

We use Superchat to communicate with you via WhatsApp, SMS, and other messaging channels. Your messages and contact details may be processed by Superchat (Germany) and, for WhatsApp messages, by Meta (United States). Please accept to enable messaging features.
Cookies and trackers

What Superchat sets and contacts

Tracking method
JavaScript widget, first-party cookies, messaging channel aggregation (WhatsApp, SMS, email), server-side conversation processing
Server location
Germany (Superchat is a German company with EU-based infrastructure)
Data transferred outside the EU
Superchat is a German company with EU infrastructure. However, when WhatsApp Business API is used, message data is processed by Meta (US). SMS messages may involve telecoms processing outside the EU. Standard Contractual Clauses apply for WhatsApp-routed message data transferred to Meta.

Cookies set (1)

NameTypeDurationPurpose
sc_sessionsessionSessionSuperchat session cookie used to maintain the active chat widget state

Third-party domains contacted (3)

  • superchat.de
  • api.superchat.de
  • app.superchat.de
Questions

Frequently asked questions about Superchat

Can't find your question? Write to us, we answer fast.

What data does Superchat collect?

Superchat collects contact information (phone numbers, emails, names), conversation history across all channels, team notes and tags, and engagement metrics. WhatsApp message metadata is also processed by Meta. All Superchat platform data is stored on EU servers in Germany.

Does Superchat require consent under GDPR?

For WhatsApp marketing messages, explicit opt-in consent is required under both GDPR and WhatsApp Business Policy. For customer-initiated service conversations, legitimate interest or contract performance may apply. For the website widget, ePrivacy consent is required before the script loads.

What is the legal basis for using Superchat?

Contract performance (Art. 6(1)(b)) for service conversations. Legitimate interest (Art. 6(1)(f)) for customer-initiated support. Consent (Art. 6(1)(a)) for WhatsApp marketing messages. ePrivacy consent for website chat widget cookies.

Does Superchat transfer data outside the EU?

Superchat stores all platform data on EU servers in Germany. However, WhatsApp Business API messages are routed through Meta's infrastructure, which may involve US transfers for message content and metadata. Both Superchat and Meta should be disclosed in your privacy policy.

Do I need a DPIA for Superchat?

Generally not for standard business messaging. A DPIA becomes advisable when processing sensitive customer data through messaging channels in regulated sectors, or when running large-scale automated campaigns that could significantly affect individuals.

How do I implement Superchat in a GDPR-compliant way?

Obtain explicit opt-in before sending WhatsApp marketing messages. Provide a privacy notice about Superchat and Meta processing. Obtain ePrivacy consent before loading the website widget. Sign a DPA with Superchat. Update your privacy policy. Configure contact data retention. Document processing in your RoPA noting EU data location.

Why is Superchat more GDPR-friendly than US-based messaging platforms?

Superchat stores all platform data on EU servers in Germany, eliminating third-country transfer risks for contact and conversation data. The WhatsApp API routing through Meta is the only indirect US transfer, which is inherent to any WhatsApp Business provider.

How do I collect GDPR-compliant WhatsApp opt-ins with Superchat?

Use Superchat's opt-in features to collect explicit WhatsApp consent. The opt-in must clearly state the contact is agreeing to receive WhatsApp messages from your business, describe message types, and be separate from other consents. Store opt-in records with timestamps. Provide a simple opt-out in every message.

Same category

More services: Customer support

See the whole category

Slingshot

Slingshot is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Slingshot supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Slingshot enables informed decisions that improve experience and drive results.

Analytics

CoCo AI

CoCo AI is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. CoCo AI integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, CoCo AI makes advanced AI accessible to all teams.

Marketing

Toky

Toky is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Toky is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Toky offers reliable solutions that scale with organizational needs and evolving web standards.

Preferences

CometChat

CometChat is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CometChat integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CometChat helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Screets

Screets is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Screets integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Screets helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Carrot quest

Carrot quest is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Carrot quest integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Carrot quest enhances satisfaction by ensuring tailored browsing experiences for every visitor.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site