What happens to what customers tell your chatbot or AI receptionist?
What a customer types into a chatbot or says to an AI receptionist usually goes to the company that runs the tool, and copies often reach you as well. Treat it as customer data: decide who at your business can read it, keep only what you need, don't let the chat ask for card numbers, passwords or health details, and ask the vendor how to export and delete conversations before you sign. This is a plain summary, not legal advice.
Where the words go
A chatbot or AI receptionist is usually run by another company. What a customer types or says often goes to that company and may be kept as chat text, call audio, a transcript and contact details. Copies often reach you too, in an email alert, a text or a lead record.
How long each copy is kept depends on the vendor's terms and your settings. As general advice, list every place a conversation lands, because each is a place to protect and to delete from. The related answer on putting customer information into ChatGPT covers staff pasting details into a tool, not this.
Keep only what you need, and limit who reads it
The FTC's guide "Protecting Personal Information: A Guide for Business" (October 2016) covers personal information a business holds, so applying it to a chatbot is by analogy. The related answer on a website privacy policy covers its advice to collect only what you need. On how long to keep it, the guide says to keep what you need only as long as necessary, and for what you must keep for business or legal reasons, to develop a written records retention policy.
On who reads it, the related answer on what an internal AI assistant should be allowed to see covers the guide's point on limiting access. As general advice, not the FTC's: give each person a named login, and remove access when someone leaves.
What a chat should not collect
As general advice, a chat is a poor place for card numbers, health details, passwords or account numbers. Say so in the greeting and offer a call with a person. The guide says not to keep customer credit card information unless you have a business need for it. If someone types one anyway, ask whether the vendor can delete that message.
Recording calls may need the caller's consent; the related answer on recording customer calls covers it.
When a customer asks you to delete their details
Write down who handles the request and where to look: the vendor's dashboard, email alerts, texts and your lead list. Ask whether the vendor can delete one customer's conversations. Whether you must delete can depend on state law, other rules that apply to your business, and what your privacy policy promises, so ask an attorney if unsure; the related answer on a website privacy policy is a start. This is a plain summary, not legal advice.
Questions for the vendor
The related answer on what to ask before hiring someone to build AI covers where data is stored and who at the vendor sees it, and the related answer on getting a chatbot on your website covers exporting conversations and what canceling does. Add these:
- Can I set how long conversations are kept?
- Is call audio recorded by default, and can I turn that off?
Sources
Related answers
- Is it safe to put customer information into ChatGPT or another AI tool?
- Do you need consent to record calls with customers?
- Does a small business website need a privacy policy?
- What should you ask before hiring someone to build AI for your business?
- What should an AI assistant for your team be allowed to see?
- How do you get a chatbot on your website: build it, buy one or hire someone?
AI assistants and chatbots
A good assistant answers the question a customer asks at nine at night, in your words, from your information, and brings in a person when it should. We build that, and we test it on your real questions before a customer sees it.