Botpress and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Botpress says it never uses conversation data for training or model improvement.

Vendor's wording: “We do not use Conversation Data or other End-User personal data for any other purpose, which includes analytics and algorithms and model improvements or training.”

Source: botpress.comSection 1, End-UsersSecond source: botpress.comChecked on 19 October 2026

United States. The DPA says all data is processed in the US unless stated otherwise; the terms let Botpress host anywhere at its discretion.

Vendor's wording: “Unless otherwise stated, all data is processed in the United States.”

Source: botpress.comSchedule 3 – Sub-ProcessorsSecond source: botpress.comChecked on 19 October 2026

DPA in the terms.

Yes. A published DPA with EU Standard Contractual Clauses; the page has an 'Execute Data Processing Agreement' button.

Vendor's wording: “In Processing Conversation Data through the Services, the parties acknowledge and agree that the Customer acts as the Controller and that Botpress acts as a Processor.”

Source: botpress.comSection 2.a Role of the partiesChecked on 19 October 2026

On the list.

Active (Botpress; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Botpress'Checked on 19 October 2026

Conversations, messages and events are kept 90 days and logs 30 days; conversations and messages can be deleted via API. Files are kept indefinitely unless given an expiry. Data is deleted or returned on termination.

Vendor's wording: “Conversations 90 days Can be manually deleted using the Chat API”

Source: botpress.comRetention Period tableSecond source: botpress.comChecked on 19 October 2026

1 named: SOC 2 (homepage says SOC II certified, also GDPR compliant and penetration tested by KPMG). Trust Center not readable by server.

Vendor's wording: “SOC II certified, GDPR compliant, and penetration tested by KPMG.”

Source: botpress.comHomepage security sectionChecked on 19 October 2026