Contracting party
The Terms of Service are an agreement with Manychat, Inc., a US company.
ManyChat collects email addresses where people are already talking: in Instagram DMs, on Messenger, on WhatsApp. For Europe, an 'opted in' flag is not enough. The confirmation is missing, and so is the proof.
The Terms of Service are an agreement with Manychat, Inc., a US company.
According to its own security page, ManyChat stores all production data in AWS data centres in Frankfurt.
The sub-processor list (effective 21 September 2026) names Amazon Web Services for hosting and storage with location USA, as well as the error-logging services Rollbar and Sentry. Frankfurt does not mean EU-only.
Manychat, Inc. is on the official list. Status on 3 October 2026: 'Active - Re-certification under Review', next recertification due on 25 August 2027.
The data processing addendum (effective 24 April 2025) forms an integral part of the Terms of Service. It names Rickert Rechtsanwaltsgesellschaft mbH as the representative in the EU.
The help article on sending email describes no double opt-in. The 'Set Email Opt-In' setting in the data collection block marks the contact as opted in; ManyChat only suggests a confirmation email as an extra.
ManyChat documents 'Opted-in for Email' (yes or no) and 'Subscribed' (date of sign-up) as system fields. Confirmation time, IP address or form wording are not listed there.
The help centre lists native integrations for Klaviyo, ActiveCampaign, HubSpot, Kit, Mailchimp and Flodesk. beehiiv is not on the list and runs through Zapier, Make or the API.
Without your own domain, ManyChat sends email from an address on ManyChat's domain. For your own domain, ManyChat generates DNS records that you add at your domain provider.
This page is not legal advice and we are not a law firm. We report what the vendor itself documents, with a date. Vendors change their terms; the linked source in its current version always prevails.
A yes in the 'Opted-in for Email' field does not show who typed the address or whether it belongs to that person. Article 7(1) GDPR requires that you can demonstrate consent. The confirmation therefore belongs in the connected email tool, with timestamp and source in the log.
Someone who messages you on Instagram wants a conversation, not your newsletter. An email address collected in a chat needs its own explicit consent before it enters a marketing sequence. Austria's § 174 TKG 2021 requires that consent beforehand, not afterwards.
We check where ManyChat sends the addresses: into a tool with a native integration, or through Zapier, Make or the API. That decides where the confirmation happens.
The address from the chat lands in the email tool as unconfirmed. Only the click in the confirmation email activates it, with a timestamp and 'ManyChat' as the source in the log.
Data processing agreements with ManyChat and the email tool, an entry in your records of processing, and a paragraph for the privacy notice that keeps chat and newsletter apart.
No tool is compliant on its own; it depends on the setup. ManyChat provides the basics: hosting in Frankfurt, a data processing addendum in its terms and a listing under the EU-US Data Privacy Framework. What is missing is built-in email double opt-in. That has to happen in the connected email tool.
For email, ManyChat describes no built-in double opt-in. 'Set Email Opt-In' marks a contact as opted in, and ManyChat only suggests a confirmation email as an extra. For Austria and Germany we therefore build the confirmation in the email tool that ManyChat hands the address to.
beehiiv is not on ManyChat's list of native integrations. The route is Zapier, Make or the API. What matters is that beehiiv creates the new address with double opt-in and sends the confirmation email itself, otherwise the proof gets lost on the way.
According to its security page, in AWS data centres in Frankfurt. The listed sub-processors, including Amazon Web Services, have the location USA, though. A legal basis for transfers to the US is therefore still needed; ManyChat relies on the Data Privacy Framework.
The setup costs € 890 for your whole stack. The other tools we have checked the same way:
Tell us which tools you use and where your contacts come from. In the first call we will tell you whether € 890 covers it or whether more needs fixing, honestly either way.
Request the setup