End-user Privacy Notice (template and guidance for customers)

This document is for our customers (the businesses that use Anna). When you put Anna on your website, your website visitors (your end users) send messages that are personal data, and you are the controller of that data. Under Articles 13 and 14 GDPR you must tell your end users how their data is used. We provide the template below so you can do that quickly. Adapt it to your business; you remain responsible for it. Text in [square brackets] is for you to complete.

Part 1: Short in-widget line

A short, layered notice shown in or near the chat that links to your full notice. For example:

  • English: "You are chatting with an AI assistant. See how [your business] uses your data: [link to your privacy notice]."
  • Icelandic: "Þú ert að spjalla við gervigreindarþjón. Sjá hvernig [fyrirtækið þitt] meðhöndlar gögnin þín: [tengill á persónuverndartilkynningu þína]."

Anna already shows a built-in line telling users they are interacting with an AI. The link to your full notice is the part you add.

Part 2: Full notice (a template you can host)

How we use the chat assistant

[Your business] uses an AI chat assistant called Anna, provided by Corveria ehf., to answer questions on this website.

What we collect. The messages you send in the chat, and, if you ask to be contacted or are referred to a person, the contact details you provide (such as name, email, or phone). If a short contact form is shown before the chat starts, this also includes the details you enter there.

Why. To answer your questions, help you, and where needed pass your request to our team. [State your legal basis, for example a legitimate interest in answering enquiries, or consent.]

Who processes it. The assistant is operated for us by Corveria ehf. as our processor. To generate replies, your messages are processed by its AI sub-processors, some of which are outside the European Economic Area (for example in the United States) under appropriate safeguards. See Corveria's sub-processor list for details.

No model training. Your messages are not used to train the AI models.

How long. [State your retention, for example we keep chat records for X months.]

Your rights. You can ask us to access, correct, or delete your data, or object to its use. Contact us at [your contact details]. You can also complain to the Icelandic Data Protection Authority (Persónuvernd) or the authority in your own country.

Part 3: How to inform your end users

  • Put the short line (Part 1) in or near the chat, and link it to your full notice (Part 2, or your existing privacy policy).
  • Add Anna (provided by Corveria ehf.) and its AI sub-processors to your own privacy policy's list of recipients and international transfers. Our Sub-processor list gives you the names, locations, and safeguards to copy.
  • If you connect Anna to Messenger or Instagram, your end users' messages are also processed by Meta as the messaging platform. Reflect that channel, and Meta as a recipient, in your notice.
  • If you enable the pre-chat contact form, tell your end users why you collect those details and on what basis. When the form is optional (the visitor can skip it), the built-in consent checkbox is on by default and consent (Art. 6(1)(a)) is the natural basis; keep the checkbox on. If you set the form to required, consent given as a condition of chatting does not count as freely given (Art. 7(4)); rely instead on your legitimate interest in handling inquiries, turn the consent checkbox off, and state that basis in your notice. Contact details from the form are kept for 12 months and then deleted.
  • Accept our Data Processing Agreement (it is part of our Terms). It sets out our obligations to you as your processor.
  • Remember that, as the controller, the choice of legal basis and the wording of your notice are yours. This template is a starting point, not legal advice.

Version 1.1.0. Last updated 2026-07-20.