GDPR Support Bot
AI-drafted answers on GDPR, returns, chargebacks & shipping rules — for you to check.
What the GDPR Support Bot does
You type a compliance question in plain English. The model is asked to reply in a fixed shape — two or three paragraphs of explanation, a confidence label, the rules the answer leans on, a list of action items, a few related questions, and sometimes a block of template text you can adapt for a policy page — and the page renders whichever of those parts come back. It is built for the questions that stop a one-person store dead — a customer demanding a copy of their data, an argument about the 14-day withdrawal period, a chargeback with a deadline attached.
It is a reference desk, not a helpdesk. It does not connect to your inbox, read your orders, or answer anyone on your behalf. You ask, you read, you decide what to send.
How it works
- Pick one of the seven quick topics — data requests, returns, shipping, chargebacks, privacy policy, cookie consent, terms of service — or type your own question. Anything shorter than five characters is rejected.
- The server checks that you are signed in. Each question calls a paid model, so anonymous requests are refused before any money is spent rather than after. Registered access is free and has no daily cap.
- Your question goes to DeepSeek with a fixed system prompt that scopes it to EU and UK e-commerce compliance: GDPR, the Consumer Rights Directive and its 14-day right of withdrawal, cross-border shipping and tracking obligations, chargeback evidence, privacy policies and cookie consent, terms of service, and the Digital Services Act. Temperature is set to 0.2, which keeps answers close to the well-documented reading instead of the inventive one.
- The system prompt asks for a reply in a fixed JSON shape with six fields, rather than a wall of free text. The server takes the first JSON block out of the reply and passes it to the page as it is — nothing checks which fields actually came back.
- The page renders the answer with a confidence badge, the legal references underneath when the model supplied any, any template text in its own block, the action items as a checklist, and the related questions as chips. A field the model left out simply does not appear, except the badge, which shows "medium" when the model omits the confidence field. Clicking a chip asks that question as a new, standalone request.
- Each call to the model has a 20-second timeout and is attempted up to three times, pausing one second and then two seconds between attempts. If all three fail, or the reply comes back without a usable JSON block, a fixed fallback answer is shown instead. That fallback is generic text about the cooling-off period and GDPR Articles 15, 27 and 30, labelled medium confidence. It is a failure signal, not an answer to your question.
What you get back
The system prompt asks for six fields — answer, confidence, sources, action items, related questions and templates — but nothing validates the reply against that list, so a field the model leaves out is simply not rendered. The template field is explicitly optional. The example below is an illustration of the output shape, not a real user's session.
The confidence label is the model's own opinion of the answer, not a measurement against anything. Read a medium or low badge as an instruction to check the source text before you act.
When it helps and when it does not
It helps most at the moment a compliance email lands and you do not know whether it is routine or serious. The answer gives you the shape of the obligation, the deadline the model believes applies, and the steps it suggests — none of which is checked by anything, so read it as a starting point. It is also a decent way to draft a first version of a returns or privacy page before someone who knows your business reviews it.
It is not legal advice. No lawyer reviews the output, and no one here knows your jurisdiction, your entity, or your contracts. Treat it as a briefing that helps you ask better questions, not as a decision.
Citations are generated, not looked up. The references come out of the same model that wrote the answer. Nothing checks them against the real text of the regulation, so an article number can be wrong even when the substance is right.
It knows nothing about your setup. Whether you have an EU representative, where your processors sit, whether you sell through a marketplace or your own store — none of that is in the input unless you type it in. The answer is only as specific as your question.
No memory between questions. Each question is sent alone. If the answer depends on something you said earlier, say it again.
EU and UK focus. The prompt is built around GDPR, EU consumer law and the DSA. Ask about US state privacy law, Canada or Australia and you will still get an answer, but with far less behind it.
Nothing is filed or sent for you. There is no ticket queue and no deadline reminder. A data access request has a one-month clock and this tool does not watch it. Copying the answer into your own process is your job. What the site does record is its own usage log: the email on your account and the first 100 characters of each question you ask.
Watch for the fallback. If you get a medium-confidence answer about the 14-day cooling-off period and Articles 15, 27 and 30 that has nothing to do with what you asked, the model call failed. Ask again rather than acting on it.
Where it fits with the other tools
Most compliance questions arrive because of a decision made much earlier. Delivery complaints get quieter when you source closer to the buyer, which is what the Supplier Finder covers for the UK, DACH and Australia; if you sell into a market whose language you do not write, Cross-Border Translation handles the store copy customers read before they ever open a ticket; and the Product Validator flags risky items before you stock them. All of them run on the same free account.
Frequently asked questions
Is the GDPR Support Bot free?
Yes, and there is no credit card step. A free account is required because every question calls a paid AI model, so anonymous requests are refused with a 401 before anything is spent. Once you are signed in there is no daily limit on how many questions you ask.
Is this legal advice?
No. It is a language model answering in general terms about rules that apply differently depending on where you and your customer are. Use it to understand what a request means and what usually has to happen next. Anything with real money or a legal deadline attached should be checked with a lawyer in the relevant country before you act on it.
How reliable are the legal references it cites?
The sources list is written by the model along with the answer. It is not looked up in a legal database, and nothing verifies it. Well-known rules like the 14-day right of withdrawal or the Article 15 access request are usually cited correctly, but article numbers do get confused. Open the actual text before you quote it to a customer, a payment provider or a regulator.
Does it read my store, my tickets or my customer data?
No. The only thing sent to the model is the question you type. There is no helpdesk connection, no order lookup and no access to customer records. It also does not reply to anyone for you — you read the answer and write the reply yourself. This site does keep its own record: the email on your account and the first 100 characters of each question are written to our database when you ask.
Which rules does it actually cover?
The system prompt scopes it to EU and UK e-commerce: GDPR, the Consumer Rights Directive 2011/83/EU and its 14-day cooling-off period, cross-border shipping and tracking duties, chargeback handling, privacy policies and cookie consent, terms of service, and the Digital Services Act. Questions about other jurisdictions still get an answer, but with no particular grounding behind it.
Does it remember my previous questions?
No. Each question is sent on its own with no conversation history, so a follow-up has to repeat the context you care about. The related-question chips under an answer work the same way: clicking one puts that question in the box and asks it from scratch.