Most AI data questions get answered with reassurance rather than specifics. These five have concrete answers, and a supplier who cannot give them in writing has not thought about it properly.
The five
-
1. Where is it processed, geographically?
Not which company, which region. UK or EU is a meaningfully different answer from wherever the provider defaults to. Ask for it in writing and ask them to show you the data-flow.
-
2. Who can read it?
Provider staff, subprocessors, the supplier own team. Every additional party is another agreement you are relying on. Ask for the subprocessor list rather than a general assurance.
-
3. What is retained, and for how long?
Many providers retain inputs for a period for abuse monitoring even when they do not train on them. That is often fine; not knowing about it is not. Get the retention window as a number.
-
4. Is it used for training?
Consumer chat products and business API tiers usually differ sharply here. If your supplier is running your customer data through a consumer product, that is a genuine problem and you should ask directly which tier they use.
-
5. What happens when we leave?
Deletion timeline, what you get back, and in what format. If the automations live somewhere only they can access, you are renting. Ask for exportable workflows in the contract.
The distinction that matters most
Business API tiers and consumer chat products are not the same product with a different price. They typically differ in training use, retention, and the contractual terms available to you. A supplier who cannot tell you which one your data touches has not designed for this.
What you should get in writing
A diagram showing what leaves your systems, where it goes, and what comes back. The processing region. The retention period. The subprocessor list. Whether a DPIA is needed and who is writing it. None of this is exotic; it is the paperwork any competent supplier already has.
Our answers are on the privacy page: UK or EU regions, business API tiers only, never consumer chat products, with the data-flow provided in writing.
Questions we get asked
Is using AI with customer data allowed at all?
Yes, with a lawful basis, appropriate safeguards, and usually a DPIA where the processing is high risk. It is a normal processing activity, not a special category of forbidden thing.
Do we need to tell customers?
Your privacy notice should reflect what actually happens, including categories of recipient. If personal data goes to a model provider, that belongs in the notice.
Can we keep data in the UK?
Often yes. Several providers offer UK or EU processing regions, and self-hosted components can be placed wherever you choose. It constrains model choice slightly and is usually worth it.
What about data we already sent to a chatbot?
Find out which tier it was, what the retention window is, and whether it was used for training. Then decide whether you need to tell anyone. Guessing is the worst option.