JivoChat: What a Buyer Can and Cannot Establish From the Public Documents

Last updated: August 22, 2026

JivoChat sells customer communication software through regional websites: a chat widget, messenger and email channels, telephony, a CRM, and two AI products, priced per agent. Future Stack Reviews read the vendor’s published pricing pages, terms, privacy materials, and help documentation on 22 August 2026 and asked one question. Can a company approve this vendor from the public pages alone?

Short answer: you can shortlist JivoChat from its public pages. You cannot finish a security or EEA-connected procurement review from them.

The procurement evidence matrix

A vendor review normally asks whether a product is good. This audit asks something narrower and more testable: for each field a procurement file has to contain, can the buyer fill it in from the vendor’s public pages?

Four fields are fully answerable. Four are not answerable at all. Three are partial. That distribution is the finding this article exists to report, and everything below is the working for it.

Sources: JivoChat Terms of Service, accessed 22 August 2026 · JivoChat Privacy Policy, accessed 22 August 2026 · JivoChat Pricing, accessed 22 August 2026

Two Terms versions, one open question

JivoChat publishes Terms of Service on more than one domain, and the published versions are not identical translations.

The English Terms at jivochat.com carry an effective date of 11 April 2023 and send disputes to arbitration in Brasília, conducted in the Russian language, under Brazilian arbitration rules. The Portuguese Terms at jivochat.com.br carry an effective date of 1 January 2022 and send disputes to arbitration in Vitória, conducted in Portuguese. The Portuguese version includes LGPD provisions that the English version does not, and writes the entity granted the GDPR Article 28(2) processor authorization as JivoSite rather than JivoChat. Both name LLC Tecnology Distribution Ltda in the opening line.

Separate regional contracts are ordinary practice for a company selling in several markets, and the existence of two versions is not by itself a problem.

The question the public pages leave open is which one applies. The English Terms contain an Account Setup section listing twenty domains through which a subscriber may register, and jivochat.com.br is among them. A buyer registering on that domain therefore sits inside the scope described by one document while a second document with different provisions is published on the same site. Neither page carries a precedence clause, and neither explains what role the order form plays in selecting the governing version.

This is a contract selection question, not evidence of corporate structure. FSR located three company names across the vendor’s surfaces and did not obtain corporate registry records, so the article makes no claim about how those names relate to each other. The buyer-facing action is narrow: get the contracting entity and the Terms version written on the order form before signing.

Sources: JivoChat Terms of Service, Account Setup and Dispute Resolution, accessed 22 August 2026 · JivoChat Termos de Serviço, accessed 22 August 2026

The DPA you cannot download

The English Terms open with a scope condition. They apply only where the subscriber’s business activity falls outside the context of an EEA establishment and the subscriber is not offering services to data subjects in the EEA. A subscriber who falls inside either condition is required to sign an additional Data Processing Agreement before downloading and installing any JivoChat application. That agreement is obtained by writing to a privacy address.

For most buyers this is manageable friction. A DPA supplied on request during a sales conversation can be perfectly adequate, and many vendors handle it exactly this way.

It becomes a procurement blocker only for a specific reader: the reviewer whose process requires reading the governing agreement before a sales conversation starts. That reviewer cannot complete the step. The visible contract states that it does not apply to them, and the applicable one is not published.

Two related gaps sit alongside it. The Privacy Policy names an Article 27 representative in the EEA and describes that representative as registered in “United Kingdom and Wales.” FSR located no EU-wide register of Article 27 representatives against which the appointment could be checked, and takes no position on whether the arrangement satisfies any legal requirement. Separately, the Privacy Policy carries no effective date, no version number, and no last-updated line, while stating that changes take effect on posting. A buyer who wants to record which version they accepted has nothing on the document to record.

Sources: JivoChat Terms of Service, Application of these terms, accessed 22 August 2026 · JivoChat Privacy Policy, sections 2 and 19, accessed 22 August 2026 · EFTA, EEA EFTA States, accessed 22 August 2026

The AI Agent data path

JivoChat sells two AI products. The AI Assistant drafts and edits replies for a human to send. The AI Agent answers customers directly from an uploaded knowledge base.

The AI Agent page addresses data sharing in its own FAQ. It states that the AI Agent is powered by OpenAI technologies which require access to personal data, and links the reader to OpenAI’s privacy policy. Its implementation steps begin by instructing the buyer to accept the privacy policy of the technology provider. The AI Assistant page describes that product as using integrated OpenAI technology.

The Terms contain a section headed List of Processors naming three providers: hosting, telephony, and translation. The Privacy Policy names the same three with two written differently. Neither list mentions OpenAI, and neither describes the AI features.

That gap has several possible explanations that do not involve wrongdoing. Another entity may sit between JivoChat and the model provider. A separate agreement may cover the AI modules. The published lists may have a narrower scope than the whole service. The feature is optional, so it may fall outside the baseline disclosure.

What a reviewer can conclude is limited but real: the AI Agent data flow cannot be mapped from the published documents. The fields a security review needs are the recipient, the purpose, the data categories transmitted, the retention period, whether content is used for training, the transfer destination, the subprocessor chain, and the controls for opting out or requesting deletion. None appears on any page FSR read.

For a live chat product the stakes here are specific rather than abstract. The content passing through the AI Agent is customer conversation, which for many buyers contains names, order numbers, addresses, and complaint detail.

Sources: JivoChat AI Agent, FAQ and implementation steps, accessed 22 August 2026 · JivoChat AI Assistant, accessed 22 August 2026 · JivoChat Terms of Service, List of Processors, accessed 22 August 2026

Data residency: what is stated, what is missing

The Security page states that JivoChat uses OVHCloud data centers in three regions, the United States, South-East Asia, and the European Union, and that Service Data may be stored in any region. No region selection control is described. The Privacy Policy states, in its transfers section, that the personal data of EEA residents is stored in the EEA area.

An earlier version of this audit described those two statements as mutually exclusive. That was wrong, and the claim has been withdrawn. A permissive statement about where Service Data may sit and a restrictive statement about one category of it can both be true at once.

The usable finding is narrower. The public documents describe regional infrastructure at a high level and make one categorical statement about one class of data subject. They do not publish a residency map. A reviewer cannot determine from them where chat transcripts sit for a non-EEA data subject, where backups are held, from which region support staff access account data, whether a customer can pin storage to a region, or how the AI features affect any of this.

There is a separate tension in the language on the Security page. It states that personal data will not be lost when using the service, and that use on public networks is completely safe. The Terms disclaim all warranties, state that the vendor does not warrant that use of the service will be secure, and exclude liability for loss of information or data. Marketing language and contract language are doing different jobs here, and a reviewer should treat only the second as binding.

Sources: JivoChat Security, accessed 22 August 2026 · JivoChat Privacy Policy, section 13, accessed 22 August 2026 · JivoChat Terms of Service, Disclaimer of Warranties and Limitation of liability, accessed 22 August 2026

Regional price books

JivoChat publishes separate pricing pages per market, and the displayed figures differ by more than currency conversion. The English storefront is the reference point for everything below.

The Spanish page quotes in US dollars rather than euros and displays lower dollar figures than the English page. The Turkish page uses a different tier structure.

The add-on layer moves too. The Brazilian page sells two channel modules that the English page does not list. On the English page, only one add-on tile carries an inclusion marker. Videocalls is marked as included at no charge in the VIP plan, while the AI Agent tile at $69 per agent per month carries none. On that reading the AI Agent is additive on every tier, including the most expensive one.

None of this establishes that a buyer can choose which price to pay. FSR did not test whether the same company could purchase through more than one storefront, whether billing address or entity location controls eligibility, whether tax is applied differently, or which figure appears at checkout. What the evidence supports is narrower: JivoChat publishes several regional price books and does not publish an eligibility rule connecting a buyer to one of them.

For budgeting, treat any figure found through search as unverified until you have seen it on the storefront you will actually buy through, and then confirm it at checkout.

Sources: JivoChat Pricing, accessed 22 August 2026 · JivoChat Precios, accessed 22 August 2026 · JivoChat Preços, accessed 22 August 2026 · JivoChat Fiyatlandırma, accessed 22 August 2026

Seats and licences

Pricing is stated per agent. The clearest definition FSR located sits in the help center, which describes a licence as equivalent to one seat for an agent logged in at the same time, and notes that one agent may hold a desktop or web session and a mobile session concurrently under the same login.

The Terms add a second class of user that the pricing page does not mention. A subscriber has the right to add up to one hundred Employees to the account at no additional charge. The Terms define an Employee as an end user with an account and a limited ability to receive incoming dialogs, and list rights including internal chats, the CRM section, subscriber statistics, account settings, outgoing telephony calls, and access to the dialog archive.

An earlier version of this audit stated that no published document maps the two roles to each other. That claim has been withdrawn, because FSR did not search the help center systematically enough to support a negative finding of that kind. Documentation covering the role distinction may exist in pages FSR did not read.

What remains unresolved is the part a buyer needs for a purchase order: how role assignment is enforced in the product, how concurrency is measured, whether a role change mid-term affects the invoice, and which permissions each paid tier actually exposes. None of that is testable from documents.

One figure on the pricing page needs checking before you rely on it. The Free plan card shows a price and no agent count at all. In the comparison table lower on the same page, the header row for the Free column carries a note that it includes five agents, in the position the other columns use for a price, while the Number of agents row shows two in that same column position. The help center says five online at the same time. FSR did not verify header-cell association in the rendered comparison table and does not assert which figure is enforced. If the free tier is part of your evaluation plan, confirm the number in the account before building around it.

Sources: JivoChat Terms of Service, Application of these terms, accessed 22 August 2026 · JivoChat Help Center, purchasing a Pro license, accessed 22 August 2026 · JivoChat Pricing, accessed 22 August 2026

Renewal, cancellation, and exit

These clauses affect total cost more than anything else in the document set, and they are the part of the Terms that is actually complete.

Subscriptions renew automatically. Once payment information is submitted, the card is charged for subsequent periods unless the account is cancelled by the end of the current subscription period, and the Terms state in capitals that the subscriber authorizes charges without additional notice after the initial payment. Price increases and material feature reductions get at least ten days’ advance notice and take effect at the next renewal rather than mid-term. Changes to the Terms themselves become effective within ten days of posting, and the new version applies unless the account is cancelled within that window. Changes to the Privacy Policy take effect on posting, with the stated remedy being to stop using the service.

Cancellation is by contacting customer service and takes effect immediately. Access ends at that point, and fees already paid are not refunded. A separate clause allows a full refund within ten days of the initial payment, on the condition that the service was not used outside the free trial. That is a rule with a narrow exception rather than a contradiction, but the exception is narrow enough to be worth reading twice: it does not survive use.

Liability is capped at the amount paid in the preceding twelve months. For free accounts, the Terms exclude even direct damages. Any claim must be filed within one year of arising.

The exit path is where the documents stop. FSR found nothing published on the export format for conversation history, whether transcripts can be extracted in bulk, whether CRM records can be exported, whether telephone numbers can be ported to another provider, whether API access survives cancellation, how long backups are retained after deletion, or what migration assistance exists. The Privacy Policy states only that personal data is retained for as long as reasonably necessary. The pricing page states that chat history is unlimited on paid plans and two months on the free plan. On termination, the Terms require the subscriber to delete or uninstall the software.

For a system that accumulates several years of customer conversation, an undocumented exit is a real switching cost. It should be priced into the decision, and the answers should be obtained in writing before deployment rather than during a migration.

Sources: JivoChat Terms of Service, Subscription Fees, Renewals and Cancellations, Term and Termination, Limitation of liability, accessed 22 August 2026 · JivoChat Privacy Policy, section 16, accessed 22 August 2026 · JivoChat Pricing, accessed 22 August 2026

Document defects worth noting

These are maintenance defects. They do not establish a product or compliance failure, and none of them carries the argument above. They are recorded because a reviewer who spots one on their own should know it is not isolated.

The Terms incorporate the Privacy Policy by reference to a URL that does not resolve; the policy is published at a different path linked from the footer. The Privacy Policy’s transfers section is headed as though the company were based in the United States, while the same document places it in Brazil, and it cites the California Consumer Privacy Act to a Civil Code section number that does not correspond to that statute. The Terms describe a named telephony processor as certified under the EU-US Privacy Shield; that framework was invalidated in July 2020 and replaced by the Data Privacy Framework in July 2023, while the Terms carrying the description are effective April 2023. The bug bounty page names one address for submitting reports and a different address in the clause restricting disclosure, without explaining the relationship between them. The list of prohibited conduct in both the English and Portuguese Terms runs (a), (b), then (d).

Sources: JivoChat Terms of Service, accessed 22 August 2026 · JivoChat Privacy Policy, sections 5 and 13, accessed 22 August 2026 · JivoChat Bug Bounty, accessed 22 August 2026 · Congressional Research Service R46724, accessed 22 August 2026

What to request before approval

FAQ

Methodology and limitations

This is a Tier C document audit. FSR did not open an account, reach a checkout screen, purchase a plan, or test any feature. Nothing here describes product quality, reliability, support responsiveness, AI accuracy, or implementation effort, because none of those was measured.

Vendor pages were the primary evidence: the English and Portuguese Terms of Service, the Privacy Policy PDF, the Cookie Policy, the Security page, the Bug Bounty page, the AI Agent and AI Assistant pages, the affiliate program page, the Enterprise page, one help center article, and the pricing pages on jivochat.com, jivochat.com.br, jivochat.es, and jivochat.com.tr. Two external official sources were used for jurisdictional and legal-history context only, and are cited where they appear. No aggregator, directory, or review-site figure was used, including as corroboration.

Where two vendor statements address different scopes, this audit says so rather than calling them contradictory. Where a question is unanswered, it is recorded as unanswered rather than inferred.

Three limits should shape how the article is read. Displayed prices are displayed offers; FSR reached no checkout and cannot state what any buyer is charged. Dynamic comparison tables were read as rendered text, and header-cell associations were not independently verified, so any claim depending on column position is flagged in the text rather than asserted. FSR makes no statement about corporate ownership, control, or group structure beyond the company names printed on the pages cited.

Three claims from earlier versions of this audit have been withdrawn. The first stated that no published document maps the agent role to the Employee role… The second described the Security page and Privacy Policy statements on data location as mutually exclusive… The third stated that the Free plan card lists five agents; screen capture shows the card carries a price and no agent count, and the five-agent note appears in the comparison table header instead. None appears above. FSR publishes retractions rather than editing silently.

Verdict

JivoChat is straightforward to shortlist. The product scope is clearly described, the channel list is broad, and entry pricing is visible without a sales call.

Approval is a different exercise, and the public evidence does not complete it. Of the eleven fields a procurement file needs, four can be filled from the website, three partially, and four not at all. The four that cannot be filled are the ones that tend to matter most in a security or EEA-connected review: which agreement governs, what the data processing agreement says, where each category of data sits, and what happens to that data on the way out.

None of this means the product is unsafe, non-compliant, or poorly built. It means the evidence for those judgments is not on the website. A vendor conversation may resolve every open field in an afternoon.

The recommendation is therefore conditional rather than negative. Shortlist JivoChat if the capabilities fit and the budget works. Do not sign until the contracting entity, the governing Terms version, the DPA, the AI data path, the residency answers, the eligible price, and the export terms exist in writing. If those answers arrive quickly, the friction documented here was a website problem. If they do not, that is itself a procurement signal.

Contact Future Stack Reviews