Privacy & Compliance
Visitors sometimes type things they should not, such as a credit card number. This plugin helps you keep that data out of your records and out of the AI provider's hands, delete old chats on a schedule, and respond to requests from people who want their data.
Open it from Privacy in the left-hand menu.
These tools help you meet privacy obligations such as GDPR, but they do not replace legal advice. Make sure your privacy policy matches how you use them.
Mask personal data in visitor messages
Masking happens before a message is saved. The saved transcript, the conversation history the AI sees, and the AI provider all receive only the masked text. A visitor who types a card number sees their own message normally; your records show [CARD] instead.
Choose what to mask:
| Option | Shown as | Notes |
|---|---|---|
| Card numbers | [CARD] | On by default. Numbers are checked with the standard card checksum, so ordinary numbers such as order numbers are left alone. |
| US Social Security numbers | [SSN] | On by default. Format 123-45-6789. |
| Email addresses | [EMAIL] | Off by default, because your chatbot may ask visitors for an email so you can follow up. |
| Phone numbers | [PHONE] | Off by default. Numbers of 9 to 15 digits that look like phone numbers are masked. Dates are left alone. |
Click Save after changing options. Messages stored before you turned masking on are not changed.
Delete old conversations automatically
Under Delete old conversations automatically, enter a number of days. Conversations with no activity for that long are deleted permanently every night. Enter 0 to keep conversations forever.
- The minimum is 7 days.
- Deleted: the messages, uploaded images and files, and the visitor's IP address and device details.
- Kept: the contact record (name and email), so your lead list is not affected.
- A conversation that is still being used is never cut off, because the last activity date decides.
Deletion is permanent and cannot be undone. Export anything you need before setting a retention period.
Visitor data requests
When someone asks what data you hold about them, or asks you to delete it:
- Under Visitor data requests, type the email address they gave the chatbot and click Find.
- HelpNest shows how many contact records and conversations it found.
- Choose an action:
- Export as JSON: downloads a file with their contact details and full conversations, ready to send to them.
- Erase permanently: deletes their conversations, their contact record and their support tickets, after you confirm.
Audit log
The Audit log at the bottom lists the last 50 privacy actions: settings changes, exports, erasures and automatic deletions, with the time of each.
To protect the person's privacy, the log never stores the full email address of someone you erased. It keeps only the first letter and the domain, for example j***@example.com.