Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Webotit is a French SaaS that builds AI conversational agents for marketing, customer service and lead qualification. The publisher embeds a JavaScript widget that opens a chat panel; the conversation runs through Webotit's NLP engine and, optionally, through a connected LLM. Hosting is in France (OVHcloud Roubaix and Gravelines). The widget sets cookies for session continuity and analytics and requires consent under the GDPR and ePrivacy Directive, plus AI Act transparency notices since it is a chatbot interacting with humans.
Webotit is a French B2B SaaS that lets companies design and operate AI conversational agents for their websites and messaging channels. Conversations are handled by a proprietary NLP engine for routine flows and can be escalated to a generative AI model (LLM) for open ended questions. The product targets marketing teams, customer service desks and sales SDR functions and is sold mostly to large enterprises in France and Europe.
The Webotit widget sets webotit_session for cart continuity, webotit_uid for cross, session recognition, webotit_locale for the chosen language and webotit_analytics for KPIs. It processes the conversation text, the visitor IP and User, Agent, the timestamp of each turn and the metadata returned by the NLP engine (intent, confidence, escalation flag). Free text input can incidentally include direct identifiers and special categories of data.
Persistent cookies and KPI cookies require prior consent under Article 5(3) ePrivacy. The conversation itself, when explicitly initiated by the visitor, can rely on Article 6(1)(b) GDPR (contract or pre, contract performance for the service the visitor requested). AI Act Article 50 requires the publisher to disclose, before or at the start of the conversation, that the user is interacting with an AI system. If automatic intent routing changes the user journey significantly, document the absence of solely automated decision making under Article 22 GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Webotit hosts its production environment on OVHcloud in Roubaix and Gravelines. Conversation data stays in the EU by default. The optional LLM connector adds a separate processor : OpenAI, Anthropic, Mistral or any model the customer chooses. When the model runs in the United States, SCCs and a Transfer Impact Assessment are required, and the publisher should consider hosting the LLM on Mistral or OpenAI EU regions to keep all traffic inside the EEA.
Place the chat widget behind a CMP consent gate for the analytics cookies. Display a clear AI disclosure at the start of the conversation. Configure short transcript retention (30 to 90 days). Sign the Webotit DPA and confirm OVHcloud EU only hosting. Sign a separate DPA with the LLM provider you select and complete a Transfer Impact Assessment if it operates from outside the EEA. Train your bot to avoid prompting for sensitive data when not needed.
Websites using Webotit must obtain user consent under GDPR regulations.
DPIA considerations
Webotit processes free, text conversation data, which can incidentally include direct identifiers (names, phone, email) and special categories (health, religious, political opinions) typed by the visitor. Key DPIA considerations: (1) free, text inputs make data minimisation hard, design the bot flow to prevent unnecessary collection; (2) the optional LLM connector (OpenAI, Anthropic, Mistral) introduces a new processor and possibly a US transfer that must be assessed; (3) automatic intent classification and routing may qualify as profiling under Article 22 GDPR; (4) AI Act Article 50 requires transparent disclosure that the user is talking to a machine; (5) when the chatbot is plugged into a CRM, the transcript becomes a record subject to data subject access requests. A DPIA is recommended whenever Webotit handles complaints, health questions or financial advice.
Sample consent text
Our chat assistant is powered by Webotit (Webotit SAS, Paris). You are talking to a virtual assistant, not a human. Your messages, the time, your IP address and a session identifier are processed by Webotit on French servers (OVHcloud) to deliver the conversation. If you ask a question that requires our generative AI module, the message is forwarded to our LLM provider under additional safeguards; we will tell you before that happens. You can stop the conversation and request deletion of the transcript at any time.
Third-party domains contacted
webotit.comapp.webotit.comapi.webotit.comcdn.webotit.comwss.webotit.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| webotit_session | Strictly necessary | Session | Holds the chatbot conversation state across page reloads while the visitor stays on the site. |
| webotit_uid | Functional | 6 months | Persistent visitor identifier so a returning user can resume a previous chat thread and so the bot can recognise repeat questions. |
| webotit_locale | Functional | 1 year | Stores the visitor's language preference so the bot answers in the right locale on subsequent visits. |
| webotit_analytics | Analytics | 13 months | Aggregated bot KPI cookie used to measure conversation success rates, escalation to a human and visitor satisfaction. |
Webotit uses cookies for user preferences — inform visitors with a consent banner.
Webotit sets webotit_session (session, conversation state), webotit_uid (6 months, persistent visitor identifier), webotit_locale (1 year, language) and webotit_analytics (13 months, bot KPIs). All cookies live on Webotit subdomains.
Yes for the persistent and analytics cookies. The conversation itself, started by the user, can rely on Article 6(1)(b) GDPR, but the cookies still require Article 5(3) ePrivacy consent through the CMP.
Consent for analytics and persistent cookies, contract performance for the conversation requested by the user, legitimate interest for fraud prevention and basic security logs.
Not by default : Webotit hosts in France on OVHcloud. Transfers can only happen if you enable the optional LLM connector to a US, based model. Switch to an EU model (Mistral, OpenAI EU) to avoid the transfer.
Recommended for complaint handling, healthcare advice or financial questions, mandatory if the bot makes autonomous decisions affecting the user (Article 22 GDPR risk) or if it routinely handles special category data.
CMP gate for cookies. Clear AI Act disclosure at conversation start. Bot designed to avoid asking for unnecessary personal data. Short retention. Webotit DPA signed, OVHcloud EU only hosting confirmed. Separate LLM DPA if you enable the generative module.
Yes : Botpress (Switzerland), Dydu (France), Rasa (open source, Germany), Smartly.AI (France), Botnation (France), or self, hosted LangChain stacks on Mistral. For a fully EU stack, Webotit + Mistral is a strong pairing.
List the four Webotit cookies with their domain, duration and purpose. Add Webotit SAS as a processor based in Paris, and if you enabled the LLM connector, add the LLM vendor as a sub, processor with its own destination country.