Data requests from your visitors

Your visitors may ask what you store about them, or ask you to delete it. This page lists what SealReply stores about a visitor and the tools for those requests. It describes how the product works; it is not legal advice.

Who is responsible for what

You decide which data you collect through the chat and why, so you are the controller. SealReply stores and processes that data on your behalf, so we are your processor. Everything below is in your hands: we do not answer visitors' requests ourselves, and our staff cannot read your workspace's data (it is encrypted with your workspace's own key).

Data Processing Agreement — available on request: write to support from the console.

What SealReply stores about a visitor

Data	Details
Profile	Name, email and phone (left in the chat or noted by your team), tags, customer group, custom fields and member attributes your site passes
Visit	IP address, country, region, city, time zone, browser, system, device, screen, language, referrer, landing page, UTM tags and ad click IDs
Browsing trail	The latest 500 pages opened on your site, with time on page
Conversations	Every message and file, internal notes, the page the conversation began on, the rating and its comment, the team's remark, lead status and amount
Offline messages	Messages left while nobody was available, with the name and email given

Contact details, the address, pages and all content are encrypted with your workspace's key. Reports keep counts only (conversations, ratings, leads per hour); they name no visitor.

Tell visitors where your policy is

In Sites → your site → Privacy notice, turn on a short line under the chat that links to your privacy policy (an https:// page on your site). Write the line in each language or keep the built-in one: "We keep this chat and details of your visit to answer you." Visitors can chat whether or not they open the link; there is no banner and nothing is blocked.

Find the visitor

• From a conversation: open the Visitor tab.
• By email: Account security → Visitor data requests, enter the exact address the visitor gave. Each site has its own visitor records, so one person may appear more than once; handle each.

Only owners and admins see these tools.

Export (a request for access or a copy)

Export this visitor's data downloads one JSON file with everything in the table above, decrypted: the profile, the browsing trail, each conversation with its messages, offline messages, and the files sent in the conversations with download links that work for one hour. Internal notes and the team's remarks are included and marked; review the file before you send it on.

Delete (a request for erasure)

Delete all data about this visitor asks you to type the visitor's name, then deletes at once and for good:

• the profile, visit details, browsing trail and the visitor's own block;
• every conversation with its messages, notes, files, search entries, rating and lead;
• offline messages;
• webhook deliveries about the visitor (pending ones and the delivery log).

Files are removed from storage right after; if storage is briefly unavailable they are retried automatically.

What stays: IP blocks (they protect your site and do not name the visitor; remove them under Account security if you wish) and report totals (counts only). If the same browser comes back, it starts as a new, empty visitor.

Your webhooks receive visitor.deleted with the visitor's ID, so your own systems can delete their copy.

Automate with the API

Create an API key with visitors:export and/or visitors:delete (see Authentication).

# Find the visitor by email (the address goes in the body, not the URL)
curl -X POST https://api.sealreply.com/v1/visitors/lookup \
  -H "Authorization: Bearer $SEALREPLY_KEY" -H "Content-Type: application/json" \
  -d '{"email":"ann@example.com"}'

# Export everything about them
curl -o visitor.json https://api.sealreply.com/v1/visitors/$VISITOR_ID/export \
  -H "Authorization: Bearer $SEALREPLY_KEY"

# Delete everything about them
curl -X DELETE https://api.sealreply.com/v1/visitors/$VISITOR_ID \
  -H "Authorization: Bearer $SEALREPLY_KEY"

Limits per workspace: 60 lookups, 30 exports and 60 deletions an hour. Every lookup, export and deletion is written to your team activity log, with who did it but without the visitor's email or details.

How long data is kept without a request

• Chat history (conversations, messages, files, offline messages) is deleted automatically once it is older than your plan keeps it.
• Visitor profiles and their browsing trail (the latest 500 pages) stay until you delete the visitor or close the workspace.
• The webhook delivery log is kept for 30 days.
• Closing the workspace destroys its keys and deletes its data.