Privacy and GDPR

This page answers the questions a store usually has to answer for its own GDPR records: where eChat runs, which data leaves your store, how long it is kept, how to delete it, and how the widget fits a cookie consent banner.

Under the GDPR your store is the controller of your shoppers' data and Mirasvit, running the eChat service, is its processor. The terms of that processing are set out in the eChat Data Processing Agreement.

Where eChat runs

The eChat service is hosted in Canada. The European Commission recognises Canada as giving personal data adequate protection, so no further transfer safeguards are needed for EU data stored there.

Replies are written by the AI provider you connect in the eChat backend with your own API key: OpenAI, Anthropic, Google Gemini or xAI (see AI Providers). That provider works under your own agreement with it, not under Mirasvit's. eChat uses no other third-party AI, analytics, vector database or CDN for your shoppers' data.

What leaves your store

When	What is sent to eChat
The nightly sync	Catalogue and store content only: enabled, visible products, categories, CMS pages, store contact details and Knowledge Base articles. No customers and no orders.
While a visitor chats	Their messages and uploaded files; the page URL and title; the IP address, an approximate location derived from it, and the browser.
A signed-in customer chats	In addition: their name and email, the current cart, and their last 5 orders (number, date, total, status).
The visitor asks about an order	That order is looked up live in your store: status, items, totals, tracking, and a partial shipping address (name, city, region, postcode, country - never the street or phone). A guest first confirms their email with a code your store sends. See Order lookup.

The messages and the context above are passed to your AI provider to write the reply.

What the widget stores in the browser

The widget sets no cookies. It keeps these keys in the browser's local storage, each prefixed with echat_<instance ID>_:

Key	Purpose
visitor	A random visitor ID, or the customer ID of a signed-in customer, so a returning visitor keeps their conversation.
session	The current chat session.
route	Which chat screen is open, so the chat stays open while the visitor moves between pages.
expanded, sound_muted	Whether the chat window is expanded and whether its sound is muted.

EU consent rules treat local storage like cookies, so list these under your cookie declaration, and use Load the widget to hold the widget back until the visitor consents.

What the extension keeps in your store's database

To check a guest's email before an order lookup or a ticket, the extension keeps a short-lived record in your Magento database, in the table mst_echat_email_verification:

Column	Content
email_hash	A SHA-256 hash of the email. The address itself is not stored.
code, code_created_at, code_expires_at	The one-time code sent to the email. It is cleared once used and stops being accepted after 30 minutes.
verified_expires_at	Until when the email counts as confirmed, so the shopper is not asked again for an hour.

A row is removed as soon as both its code and its confirmation have expired.

Cookie consent

Set Stores > Configuration > Mirasvit Extensions > eChat > Widget > Load the widget:

• Always - the widget loads on every page, as before.
• After Cookiebot consent - Cookiebot releases the widget once the visitor accepts the Cookiebot category you choose (Preferences by default).
• After Magento cookie consent - the widget waits for Allow Cookies in Magento's cookie notice. This needs Stores > Configuration > General > Web > Default Cookie Settings > Cookie Restriction Mode set to Yes.
• After a call from another consent tool - for OneTrust, Usercentrics, Klaro or any other tool. The widget waits until the page does one of these when the visitor accepts:

// call the function
window.mstEchatConsent();

// or dispatch the event
document.dispatchEvent(new Event('mst-echat-consent'));

// or, when consent is already known before the page loads, set the flag
window.mstEchatConsentGiven = true;

Until consent is given, nothing is loaded from eChat and nothing is stored in the browser.

How long data is kept

By default conversations are kept until you delete them. To keep them for a fixed time, open the eChat backend, Settings > Data & privacy > Keep conversations for, and choose a period. Every day eChat deletes the conversations whose last message is older, together with the visitor data they leave behind: browsing history, location and device. See Settings.

A file a visitor uploads but never sends is deleted after a day.

When you remove a workspace, or reset the registration in Magento, the workspace's data is kept for 30 days so an accidental removal can still be undone on request, and is then permanently deleted. Billing records are kept.

Giving a shopper a copy

To answer an access request, filter Chat History by Visitor email and click Export CSV with a range that covers their conversations. The filter matches the email eChat has on file for the visitor, as a signed-in customer has. Unlike Erase a shopper's data below, it does not find a guest's conversations where the email was only typed into a message.

Deleting data

All deletes are permanent.

• One conversation - open it in Chat History and click Delete conversation.
• A visitor and everything they left - on their conversation, click Delete visitor data.
• A shopper's erasure request - in Settings > Data & privacy > Erase a shopper's data, enter their email. eChat shows how many conversations and messages it found, then deletes them whole: all conversations of a signed-in customer with that email, and every conversation where a guest typed that email or gave it for an order lookup, a verification code or a ticket. Deleting the whole conversation also removes the order, name and address that followed the email. A guest's other conversations that never mention the email are kept, and so is their browsing history while those conversations remain.