Privacy & data protection

People who write to you share health and family matters. Commelia is built so that personal data stays where it belongs.

Principles

Visitors are anonymous unless they give an email address or your website passes a verified identity.
Internal notes are never shown to visitors or returned by the API.
AI requests only go to providers that do not store or train on your data.
Summaries and knowledge suggestions are anonymized before they are stored.
Commelia is hosted in Switzerland, or on your own server.

Anonymization

Under Project settings → Knowledge & privacy, configure how personal data is found and removed from knowledge suggestions, summaries and the anonymize API:

Patterns always catch emails, phone numbers, AHV numbers, IBANs, card numbers and dates.
Optionally, AI finds names, places and organisations too.
Always remove: terms that identify people in your context, such as small local groups or villages.
Never remove: your own organisation’s details, such as your phone number or address.
Try it: paste a text to see what would be removed with the current settings.

Hiding personal data from the AI provider

With Hide personal data from the AI provider switched on, contact details, the contact’s name and your custom terms are replaced with placeholders before prompts are sent, and restored in the replies. This applies to suggestions, rewrites, auto mode and translation.

Data retention

Under Project settings → General → Data retention, choose what happens to closed conversations after a number of months:

Keep conversations (default),
Delete conversations, or
Anonymize conversations: all message text and visitor identifiers are removed, statistics are kept.

Retention runs daily and cannot be undone. Files sent via WhatsApp are deleted together with their conversation. Owners can see retention runs in the audit log.

Visitors ending a conversation

In the widget, visitors can choose End conversation. In one short panel they can rate the conversation, ask for a transcript by email and have their messages deleted. Closed conversations offer Email transcript and Delete conversation too.

Deleting works like retention’s anonymization, but right away:

All message text (including internal notes), translations, files, the summary, tags, intro answers and the rating comment are removed. Unpublished knowledge drafts from the conversation and webhook deliveries that contain it are deleted.
The conversation stays in your inbox, read-only, with a note that the visitor deleted it. Message count, timestamps, assignee, mode and the rating score are kept for reports.
An anonymous visitor without other conversations is deleted too. Identified visitors (via the host site’s identity) are kept.
The conversation.anonymized webhook tells your integrations to delete their copies.
Owners see each deletion in the audit log (conversation.anonymized).

The transcript is sent before the messages are deleted. It contains only what the visitor saw, without internal notes. Copies in backups disappear as the backups expire.

If you are legally required to keep records, switch off Visitors can delete their conversations under Project settings → General → Data retention. Visitors can still ask you directly.

Requests from visitors

In a conversation’s details, under Data protection:

Export data (JSON) downloads everything stored about a contact.
Delete contact permanently deletes the contact and all their conversations.

Your team’s accounts

Team members can protect their account with two-factor authentication. Important actions, such as report exports and retention runs, are written to the audit log.

Owners manage people under Settings → Team. Remove from organisation only ends the membership. Delete account also deletes the person’s login, name, email address, sessions and personal settings, and unassigns their open conversations. The account stays as an anonymous “Former user” entry, so their messages, audit records and report figures keep their history. Accounts that also belong to another organisation can only be removed, not deleted. The email address can be used for a new account afterwards.

Platform administrator access

Platform administrators can open any organisation from Platform admin → Organisations → Open organisation. It opens in a new tab with owner permissions, under the administrator’s own identity. A banner shows the organisation and administrator access. Each tab keeps its own organisation selection.

Owners can view sensitive actions under Settings → Audit log: organisation and project changes, team permissions and invitations, API keys, webhooks, knowledge changes, conversation changes and messages, and contact changes, exports and deletion. Records identify the actor and target. Safe configuration values can include before/after details; message text, contact details, credentials and free text are excluded.

Audit records cannot be changed or deleted, not even by owners. They stay attributed to the person who acted after that person leaves the team; deleted accounts appear as “Former user”. Filter the log by action (for example knowledge for all knowledge events), person, object ID and date. Click a target to see every event for that object, such as a conversation.

Use Return to platform admin in the banner to leave the organisation view. The platform admin page does not show this banner. Administrator permissions remain available.

The platform admin page uses separate navigation without organisation data or links. Use Open organisation to enter an organisation’s workspace.

Administrators who belong to an organisation open their own workspace by default, without an admin access banner. The banner appears when accessing an organisation they do not belong to. Return to my organisation restores their own workspace; administrators without memberships return to the platform admin page.

Audit details

Update records describe actual changes. Group records include membersAdded and membersRemoved as user IDs. Team permission records include project roles before and after, and group IDs added or removed. Unchanged form fields are omitted; saving an unchanged form does not create an update record.

The changes object uses field paths such as availability.enabled. Safe settings include before and after values. Changes to free text, contact details and credentials use {"changed": true} without the values. Creation, deletion and export records include action-specific context such as IDs, permissions or counts.

Older records keep their original details. They cannot be expanded into a history that was not recorded at the time.