If a chatbot processes your personal data and you're in the UK or EU, UK GDPR applies — full stop. Here's what it requires and how to spot a compliant app.
We'll walk through the rules that actually matter when you chat with an AI: what lawful processing looks like, what "data minimization" means in practice, how the right to erasure works, why children's data needs extra care under the UK Age Appropriate Design Code, and exactly how Soriz handles each of these.
GDPR is famously long, but for an AI chatbot the practical requirements boil down to a handful of layers. If the app isn't getting these right, that's your signal.
Usually contract (you signed up) or consent (you ticked a specific, informed box). Vague "legitimate interest" claims for sensitive emotional data don't hold up.
Users should understand what's collected, why, for how long, and who it's shared with — without needing a solicitor.
Collect only what's needed. Use it only for the purpose you stated. Don't quietly repurpose chat logs for ad targeting.
Access, rectification, erasure, portability, objection — responded to within one month, usually free of charge, self-serve wherever possible.
Encryption in transit and at rest, access controls, breach response plan. "Trust us" isn't a security measure.
A named privacy contact or DPO you can actually reach — email, not a hidden form that goes nowhere.
Where AI chatbots tend to fall short — the patterns worth checking before you sign up:
Before you give a chatbot your thoughts, check for these specifics. You don't need to be a lawyer — you just need to read carefully.
The short version, plainly stated:
If any of this changes, we'll say so — and we'll tell you before it affects you, not after.
| UK GDPR requirement | How Soriz handles it |
|---|---|
| Lawful basis for processing | Contract for core chat; specific consent for optional features like marketing email. |
| Data minimization | Account essentials + chat content only. No contact-list, location, or gallery ingestion. |
| Right to access | Request your data export via hello@soriz.com. Responded to within one month. |
| Right to erasure | Self-serve from Settings — memory clear, chat delete, or full account close. Global scope. |
| Training on user data | Off by default. Not used to train Soriz models. |
| Children's data (UK AADC) | High-privacy defaults; non-sexual content across all companions; no behavioural ad profiling. |
| Security | Encryption in transit and at rest, access controls, incident response process. |
| Privacy contact | hello@soriz.com — real human, real response. |
Either openly stated, or hidden behind vague language that doesn't rule it out.
Deletion requires a support ticket, proof of ID for no reason, or weeks of follow-up.
Just a form that disappears into the void. UK GDPR expects a real route for data subject rights.
Your data is processed outside the UK/EU but no transfer mechanism is named.
App likely used by under-18s but ships without high-privacy defaults or a clear age gate.
Privacy notice changes without user-facing notice. You should always be told before terms shift.
Yes. Any AI chatbot that processes the personal data of UK or EU residents falls under UK GDPR or EU GDPR — regardless of where the company is based. That means a lawful basis for processing, a plain-English privacy notice, support for data subject rights, and appropriate security. Using an AI chatbot does not exempt a company from the rules.
Data minimization means a chatbot should only collect the personal data it genuinely needs to provide the service. An AI companion app needs an account and chat content to work — it does not need your full contact list, location history, or an open microphone. If a chatbot asks for more than it needs, that is a compliance concern.
Yes. The right to erasure (sometimes called the right to be forgotten) is one of the core rights under UK GDPR. A compliant AI chatbot must let you delete chats, clear memory, and close your account in a reasonable timeframe. Soriz honours erasure requests globally and provides self-serve deletion in Settings.
It depends on the processing activity. Running the core chat usually relies on contract (you signed up to use the service). Optional activities — analytics, marketing emails, model training on your data — require separate, specific consent. Bundled consent buried in a terms checkbox is not lawful consent under UK GDPR.
The UK Age Appropriate Design Code requires services likely to be used by children to default to high-privacy settings, minimise data collection, avoid dark patterns, and provide clear, age-appropriate information. AI companion apps should treat teen accounts with stricter defaults — Soriz keeps age-appropriate and non-sexual defaults on for all companions and does not profile users for advertising.
You can reach our data protection contact at hello@soriz.com. For UK and EU users, our privacy team handles data subject access requests, erasure requests, and concerns about processing. Full contact information and process details are in our privacy policy.
No. Soriz does not use your conversations to train its models. This is stated explicitly in our privacy policy and is the default for every account — no opt-out required. This approach meets UK GDPR expectations around purpose limitation and transparent processing.
No training on your chats. Self-serve deletion. A real privacy contact. Built with UK GDPR expectations in mind.
No credit card · Cancel anytime · $9.99 a month after trial
