Chatbase

Overview

Chatbase is an AI chatbot builder that enables businesses to create custom chatbots trained on their own content — documentation, FAQs, knowledge bases, PDF files, and website pages. The resulting chatbot is powered by large language models (primarily OpenAI's GPT models) and answers visitor questions based on the business's specific content rather than general knowledge. When Chatbase's scripts appear on websites, they embed an AI-powered chat widget in the corner of the page. Chatbase is popular with SaaS companies, e-commerce merchants, service businesses, and content publishers as a low-code alternative to building custom AI support tooling.

What This Script Does

Chatbase's embed script (cdn.chatbase.co/embed.min.js initialized with a chatbot ID) loads the chat widget:

Widget rendering:

• Renders a floating chat button in the page corner (typically bottom-right) that expands into a full chat interface when clicked
• The chat interface displays the chatbot's configured name, avatar, and greeting message
• The widget loads the conversation history for returning visitors (if persistence is configured) to provide continuity across visits

Message processing pipeline:

• When a visitor submits a message, the widget POSTs the message text to Chatbase's API endpoint (www.chatbase.co/api/v1/chat)
• Chatbase's backend retrieves relevant content chunks from the business's trained knowledge base using vector similarity search
• The retrieved context plus the visitor's message is sent to the underlying LLM (GPT-4 or similar) for response generation
• The generated response is streamed back to the chat widget and displayed to the visitor in real time

Session and conversation state:

• Sets cb_session_[chatbot_id] (first-party, session cookie) to maintain the active conversation state and message history during the visit
• If "lead capture" is configured, Chatbase can collect visitor email addresses or names through the chat interface during the conversation — these are stored in Chatbase's dashboard for the business owner

Conversation logging:

• All conversation transcripts are stored on Chatbase's servers and accessible to the business owner through the Chatbase dashboard
• The business owner can review conversations, identify common questions, and use transcripts to improve the chatbot's knowledge base

Analytics (if enabled):

• Tracks conversation volume, message counts, and user satisfaction ratings for the business owner's analytics dashboard

Consent & Compliance

• Category: Functional
• GDPR: Conversation data constitutes personal data processing. Every message a visitor sends is transmitted to Chatbase's servers and the underlying LLM provider (OpenAI). Chatbase acts as a data processor; OpenAI is a subprocessor. The visitor-initiated nature of chatbot interactions supports a functional or legitimate interest basis. The business's privacy policy should disclose the use of AI chatbot processing and name Chatbase and OpenAI as processors. A DPA with Chatbase is required. Chatbase is incorporated in the US — EU data transfers rely on Standard Contractual Clauses.
• ePrivacy Directive: Session cookies for active conversation state are strictly necessary for the service the visitor explicitly initiated by clicking the chat widget.
• Lead capture: If Chatbase is configured to collect email addresses or names through the chat interface, this personal data collection requires appropriate disclosure and a clear lawful basis.
• AI transparency: Visitors should be made aware they are interacting with an AI system, not a human agent. Many jurisdictions are developing requirements for this disclosure.
• LLM subprocessing: Visitor messages are processed by a third-party LLM provider (OpenAI). Sensitive information that visitors share in chat conversations will be processed by OpenAI's API. Consider adding guidance in the chat interface about not sharing sensitive personal data.

Should You Block This Without Consent?

No. Chatbase's AI chatbot serves a functional purpose — providing automated information assistance that visitors actively initiate. Session cookies are strictly necessary for the conversation. There is no marketing tracking or behavioral profiling. However, ensure your privacy policy discloses the AI processing chain.