Customers type all kinds of things into a shop chat: a phone number "so you can call me", a delivery address, sometimes a full card number. When an AI chatbot reads those messages, the question of AI chatbot customer data privacy stops being abstract. Where does that text go? Who sees it? How long is it kept? This article explains what personal data ends up in shop chats, which general principles apply, and what to check before you put any AI assistant on your site. It is a practical guide, not legal advice; for your specific obligations, talk to a lawyer.
What personal data ends up in a shop chat
Even a chat that is only meant for product questions collects personal data, because customers volunteer it:
- Contact details. Phone numbers and emails, often unprompted.
- Delivery details. Names, addresses, a Nova Poshta branch number.
- Payment data. Card numbers, sometimes with the expiry date. IBANs for refunds.
- Identity documents. Passport numbers, usually when someone wants an invoice or is confused about what the shop needs.
- Order details. Order numbers that link back to everything above.
People share more with AI tools than they probably should. In the 2024 Cisco Consumer Privacy Survey of 2,600 consumers in 12 countries, 30% of generative AI users said they enter personal or confidential information, including financial and health details, into these tools. At the same time, 84% were concerned that data entered into generative AI could become public. Your customers are in both groups at once: they type the card number, and they would be upset to learn where it went.
The principles that apply
Privacy laws differ by country, but a few principles show up almost everywhere. In the EU, the General Data Protection Regulation requires, among other things, that personal data be adequate, relevant and limited to what is necessary for the purpose. Ukraine's Law "On Personal Data Protection" also ties processing to a defined purpose and requires that the data not be excessive for it. In practice, for a shop chatbot, this comes down to four ideas:
- Collect only what you need. A bot that answers product questions does not need a passport number. It should not ask for one.
- Know who is responsible. Usually the shop decides why the chat exists and is responsible for the data (the "controller"), and the chatbot vendor processes it on the shop's behalf.
- Tell customers. Your privacy notice should say that a chat assistant is used and what happens to the messages.
- Do not keep data forever. There should be a clear retention period.
The Cisco survey also found that awareness of these laws matters: 53% of respondents knew their national privacy laws, and 59% said strong privacy laws make them more comfortable sharing information in AI applications. Being clear about how you handle chat data is not only a legal duty. It builds trust.
Where the risks are with an AI chatbot
A classic live chat stores messages in one place. An AI chatbot usually adds more stops on the way:
- The AI model provider. The message is sent to a language model to generate an answer. Does the provider use it for training?
- Logs. Many systems log the full text of every request for debugging. Personal data in logs is easy to forget and hard to delete.
- Notifications. Handover emails or messenger alerts often quote the customer's message, copying personal data into inboxes.
- The bot itself. A badly configured bot may ask for personal data, for example "Please give me your card number to check the payment".
Each stop is a place where personal data can leak or stay longer than it should.
A checklist for any AI chatbot vendor
Ask these questions before you install an assistant on your site. A good vendor answers them in writing, ideally in its privacy policy.
| Question | What a good answer looks like |
|---|---|
| Does the bot ask customers for personal data? | No, or only the minimum, for a stated reason |
| What happens to card and passport numbers a customer types? | They are masked on arrival and not stored |
| Does the AI model see phone numbers and emails? | No, they are hidden before the text reaches the model |
| Is chat data used to train AI models? | No |
| Is personal data used for advertising or sold? | No |
| Do notifications quote personal data? | No, messages are masked |
| How long are conversations kept? | A defined period, then deleted |
| Who is the controller and who is the processor? | Stated clearly in the terms |
| How is access to the dashboard protected? | Two-factor authentication or passkeys |
If a vendor cannot answer, assume the worst case.
How Vendigit handles AI chatbot customer data privacy
Here is what Vendigit does, as described in our Privacy Policy and built into the product:
- The assistant does not ask for personal data. Its rules forbid asking for addresses, card or bank details, passwords, passport or ID numbers, dates of birth or codes. If a customer shares any, it tells them not to.
- Card, IBAN and passport numbers are masked on receipt. They are replaced with
[hidden]before the message is stored, so they never reach the saved conversation, the AI models or the logs. - Phones and emails are hidden from the AI. They are masked in everything the AI models and logs see. Your team can still read them in the dialog, so a manager can get back to the customer.
- Handover emails are masked. When a conversation is passed to a manager, the email quotes the masked message, not the original.
- No training, no advertising. Data sent to AI model providers through their API is not used to train their models, and Vendigit does not sell personal data or use it for advertising.
- Clear roles. For conversations with your visitors, your shop is the controller and Vendigit processes the data on your behalf. You should mention the assistant in your own privacy notice.
- Defined retention. Dialogs are deleted 12 months after their last message. The assistant's working memory and tool logs are deleted after 90 days.
- Protected accounts. Every account can use two-factor authentication and passkeys.
The assistant also does not take orders or payments. Its job is to answer questions about products, delivery and payment terms from your own data, and to hand anything else to a person. Less functionality means less personal data to handle. When a conversation does need a person, see how it works in when a chatbot should hand over to a human.
What you should do as a shop owner
- Update your privacy notice to mention the chat assistant and the vendor.
- Tell customers not to share card data in chat. A short line in the welcome message helps.
- Limit dashboard access to the people who need it, and turn on two-factor authentication.
- Do not copy chat data elsewhere without a reason, such as pasting conversations into spreadsheets.
- Review the vendor once a year. Policies change; check that the answers to the checklist still hold.
Privacy is one part of good chat service. The other parts, speed and honest answers, are covered in our pillar article on the cost of slow replies.
FAQ
Is it legal to use an AI chatbot in an online store?
In general, yes, if you follow the privacy rules that apply to you: a clear purpose, minimal data, a privacy notice and a reliable vendor. The details depend on your country, so check with a lawyer.
Can the AI see my customers' phone numbers?
Not in Vendigit. Phones and emails are hidden before text reaches the AI models. Your team sees them in the dialog.
What if a customer types a card number into the chat?
Vendigit masks card numbers the moment they arrive. The number is not stored and not sent to the AI.
Does Vendigit use my customers' chats to train AI?
No. Data sent to AI model providers through their API is not used to train their models.