DPDP-Ready AI Chatbot for India
India's Digital Personal Data Protection Act creates new obligations for every business processing personal data of Indian residents. Boei gives you the chatbot privacy controls you need: erasure, retention, cookieless mode, transparent processing.
The DPDP Act changes the rules for every chatbot in India.
India's Digital Personal Data Protection Act (2023) creates real obligations for any business processing personal data of Indian residents. If your chatbot collects names, emails, phone numbers or chat messages from visitors in India, you are likely a Data Fiduciary under the Act.
The Rules use a phased commencement schedule ending in May 2027, with penalties reaching INR 250 crore per violation. Check current MeitY notifications for the provisions applicable to your organization.
Most chatbot providers leave compliance entirely to you. Boei builds core privacy controls into the product so your chatbot supports your DPDP obligations out of the box.
- ✓August 2023. DPDP Act enacted by Indian Parliament.
- ✓November 2025. DPDP Rules notified, with an 18-month phased commencement period.
- !2026-2027. Phased commencement of obligations, including Consent Manager registration (for registered intermediaries) and Data Fiduciary duties.
- !!May 2027. End of 18-month commencement window. Penalties up to INR 250 crore.
Exact per-provision dates depend on MeitY gazette notifications. Check meity.gov.in for the latest schedule.
Core chatbot privacy controls for DPDP readiness.
Boei's built-in controls address key chatbot-specific DPDP requirements. Your overall compliance also depends on your notices, lawful bases, internal processes and other systems.
Boei's cookieless mode means your chatbot widget works without setting any cookies or tracking. When you need personal data (email, WhatsApp opt-in), consent is collected explicitly in the conversation flow.
Set a retention period per domain. A daily automated process deletes all closed conversations older than your threshold, including messages, metadata and orphaned contacts. No data lingers.
Any contact can be fully erased with one click. All conversations, deals, metadata and files associated with that person are permanently removed. Supports the Data Principal's right to erasure.
Run your chatbot widget without cookies, tracking pixels or fingerprinting. This means no cookie consent banner is needed for the chatbot widget itself, reducing your compliance surface to data visitors actively share.
Self-service Data Processing Agreement included with every plan. Full sub-processor register with names, registered offices, processing locations and purposes.
Boei processes conversation data only to generate responses for your visitors. Conversations are not used for AI model training. This keeps processing within the purpose your visitors consented to.
Ready to see it in action?
An AI chatbot that learns your business. Privacy controls included.
Paste your website URL and Boei reads every page. It learns your products, services, pricing and FAQs. Then it answers visitor questions 24/7 in 95+ languages, with source citations on every reply. All with the DPDP controls described above.
- Trained on your website, PDFs and documents automatically
- Answers in 95+ languages, including Hindi, Tamil, Bengali, Telugu and more
- Source links on every answer so visitors can verify
- Live on your website in under 5 minutes
- 50+ channels: WhatsApp, contact forms, Instagram, Telegram, click-to-call
-
Hetzner · Servers in Nuremberg, Germany
-
Weaviate · Netherlands company, hosted in Frankfurt, Germany
-
Your choice of AI · Mistral (EU), OpenAI, Anthropic, Google
-
Mailgun EU · Transactional email
Full details: sub-processor register
Transparent cross-border processing.
The DPDP Act permits overseas transfers under Section 16, unless the Central Government restricts transfers to a specific country or territory. As of September 2026, the EU is not a restricted destination. Sector-specific localization rules may still apply to your business.
What makes Boei different: full transparency. Every sub-processor, its registered office, processing location and purpose is listed in our public sub-processor register. Your DPO or legal team can verify the chain in minutes.
If you prefer to keep AI processing in the EU, pick Mistral AI (France) as your model. If you want US-based models like OpenAI or Anthropic, that is your choice. Boei documents the sub-processor implications either way.
Privacy controls: Boei vs other chatbot providers
Most chatbot providers offer limited self-service privacy controls. Here is how Boei compares on features relevant to DPDP readiness.
| Privacy control | Boei | Intercom | Tidio | Chatbase |
|---|---|---|---|---|
| Configurable data retention | Yes, all plans | Enterprise only | No self-service | No self-service |
| One-click contact erasure | Yes | Support request | Support request | No self-service |
| Cookieless mode | Yes | No | No | No |
| Public sub-processor register | Yes | Yes | On request | Not published |
| Self-service DPA | Yes, all plans | Enterprise only | On request | Not available |
| Starting price | $19/mo | $74/mo | $39/mo | $19/mo |
Comparison checked September 2026. Sources: Intercom privacy · Intercom pricing · Tidio privacy · Tidio pricing · Chatbase privacy · Chatbase pricing. Competitor features and pricing may have changed since then.
What happens when a visitor in India asks your chatbot a question.
- 1Message received. Your visitor's question arrives at Boei's servers (Hetzner, Nuremberg). In cookieless mode: no cookies, no tracking pixels.
- 2Knowledge search. Weaviate (Frankfurt, Germany) searches your documents and website content for relevant context.
- 3AI generates a response. Your chosen AI model processes the question with your context. Mistral (France), OpenAI, Anthropic or Google, your choice.
- 4Response delivered. The answer goes back to the visitor through Hetzner servers.
- 5Retained per your rules. The conversation is stored until your retention period expires, then auto-deleted. Or erased on request at any time.
- Step 1: With cookieless mode, no passive data collection. Only data the visitor actively shares.
- Step 2-3: Data processed only for the stated purpose (answering questions). Not used for model training.
- Step 4: Cross-border transfer to EU permitted under DPDP Section 16. All sub-processors documented.
- Step 5: Configurable retention supports the "erase when purpose fulfilled" obligation.
"The AI actually answers customer questions from our own content instead of dumping them into a generic form. Setup was under an hour and it's been converting visitors to WhatsApp chats every day since."
DPDP-Ready AI Chatbot FAQ
What is the DPDP Act and does it apply to my chatbot?
The Digital Personal Data Protection Act (2023) is India's comprehensive data protection law. It applies to any digital processing of personal data of individuals in India, regardless of where the processing happens. If your chatbot collects names, emails, phone numbers or chat messages from Indian visitors, the Act likely applies to you as a "Data Fiduciary" with obligations around consent, purpose limitation, retention, erasure and breach notification.
When does the DPDP Act become enforceable?
The DPDP Rules were notified in November 2025 with an 18-month phased commencement period ending May 2027. Different provisions take effect on different dates through gazette notifications. Penalties reach up to INR 250 crore per violation. Check current MeitY notifications for the provisions applicable to your organization.
Is Boei a Data Fiduciary or a Data Processor?
For your website visitors' conversations, you are typically the Data Fiduciary (you decide why and how the data is processed). Boei is your Data Processor. We process data only on your instructions, under a Data Processing Agreement. For Boei's own account holders, Boei acts as Data Fiduciary for their account data.
Does Boei store data in India?
Boei's servers are in Germany (Hetzner, Nuremberg). The DPDP Act permits cross-border transfers under Section 16 unless the Central Government restricts a specific destination. As of September 2026, the EU is not a restricted destination. Sector-specific localization rules may still apply. All sub-processors and their locations are listed in our public sub-processor register.
Does Boei use my customer conversations to train AI models?
No. Boei processes conversation data only for generating responses (inference). Conversations are not used for AI model training. Under the DPDP Act, using chat data for training would be a separate purpose requiring its own consent, so this separation matters for your compliance posture.
How do I handle a Data Principal's erasure request?
Open the contact's profile in Boei and click the delete button. All conversations, deals, metadata and files linked to that person are permanently removed. No support ticket needed, no waiting period. You can also set automatic retention periods so data is deleted after a set number of days without manual intervention.
Does Boei support Indian languages?
Yes. Boei's AI chatbot answers in 95+ languages including Hindi, Tamil, Bengali, Telugu, Kannada, Malayalam, Marathi, Gujarati, Punjabi and Urdu. The chatbot auto-detects the visitor's language and responds in the same language. Your training content can be in English and the AI will still answer correctly in any Indian language.
What does it cost?
Boei starts at $19/month (Starter plan) with 50+ channels, configurable retention, and a self-service DPA. All DPDP-related privacy controls are included in every plan, not locked behind an enterprise tier. See pricing for plan details and AI message limits.
How do I get started?
Sign up for a free 7-day trial (no credit card needed). Paste your website URL to train the AI. Install a one-line script on your website. Your chatbot is live in under 5 minutes. Configure your retention period in Settings to start with DPDP-ready defaults.
Get DPDP-ready before enforcement starts.
AI chatbot with built-in privacy controls that support your DPDP obligations. Erasure, retention, cookieless mode, DPA, all included from $19/month.
This page describes Boei's product features that support compliance with India's Digital Personal Data Protection Act, 2023. It does not constitute legal advice. Your organization's DPDP compliance depends on your specific processing activities, notices, lawful bases, internal processes and other systems beyond any single vendor's controls. Consult qualified Indian privacy counsel for advice specific to your situation. DPDP Act section references are based on the official text. Enforcement dates and cross-border transfer status are as of September 2026 and subject to change by government notification. Page last reviewed: September 2026.