AI chatbot privacy for small businesses

Putting an AI chatbot on your website means visitors will type things into a box that your business, and a software vendor, will store. Most of it is harmless: opening hours, prices, directions. Some of it will not be, because people overshare in chat. This guide covers the practical privacy questions a small business owner should ask before switching a bot on. It explains general principles, not the law where you are; privacy rules differ between countries and industries, so check with a qualified adviser if you handle health, financial or other sensitive information.

What a website chatbot actually collects

• The conversation. Everything the visitor types and everything the bot replies. This is the main thing, and it can contain anything the visitor chooses to write.
• Contact details, if the bot asks for a name, email or phone number so you can follow up.
• Technical details, such as the page the chat started on, the visitor's approximate location from their connection, and the time. Vendors differ in how much of this they keep.
• Your own content. The pages and files you give the bot to learn from. Anything confidential in those files can end up quoted to a visitor, so treat them as public.

Six questions to ask any chatbot vendor

1. Are conversations used to train AI models? Look for a clear yes or no in the vendor's own words, not a vague reference to "improving the service".
2. How long are conversations kept, and can you delete them? You should be able to answer a customer who asks you to remove what they wrote.
3. Who at the vendor can read them? Support staff access, subprocessors, and where the data is hosted.
4. What happens to uploaded files? Some tools keep the original document; some keep only the text they extract from it.
5. Can the bot be used on someone else's website? If the embed code is copied to another site, can that site run your bot and read your knowledge?
6. Are one visitor's chats kept separate from another's? A visitor should never be able to see another person's conversation.

For reference, here is how Botsmith answers several of these, taken from our own published summary: conversations are isolated per visitor and never used for model training; for uploaded documents we keep only the extracted text, and the file itself is never stored; and the snippet only works on your domains, and you can switch the public link off at any time. Ask every vendor on your shortlist for the same answers in writing. Our Chatbase alternatives guide links to detailed comparisons of twelve of them.

What is on your side of the line

A vendor's settings only go so far. Most of the privacy risk in a small business chatbot comes from how you set it up.

Do not ask for what you do not need

If the bot collects contact details, ask for the minimum: a name and one way to reach them. Do not ask for dates of birth, addresses or account numbers in a chat window. Write an instruction telling the bot never to request card numbers, passwords or identity document numbers, and to tell a visitor not to share them if they start to. Our guide to writing instructions for your support bot shows how to word it.

Check your files before you upload them

A price list is fine. A spreadsheet with a column of customer names is not, even if you only meant the bot to read the product column. Anything in the files you give a bot should be something you would be happy for any visitor to read.

Tell visitors what happens to their messages

Your privacy policy should mention the chat: what it collects, why, who provides it, and how someone can ask for their conversation to be deleted. A short line near the chat, such as "This assistant is automated; conversations are stored so we can follow up", sets expectations without getting in the way.

Limit who can read the transcripts

Conversations often arrive by email as well as in a dashboard. Decide who in your business needs to see them, and do not forward transcripts to personal email accounts.

If you work in a sensitive field

Clinics, law firms, accountants, financial advisers and migration agents receive more sensitive information than most, and visitors may start describing their situation before you have agreed to act for them. In these fields the safest pattern is a bot that talks only about your business, its services, fees and process, and firmly declines to discuss the visitor's own circumstances in the chat. You can see that pattern in our law firm, accounting practice and migration agency demos. It reduces what you collect as well as the risk of the bot giving advice.

A short checklist

• You know whether your vendor trains models on your conversations, in their words.
• You know how long conversations are kept and how to delete one.
• The bot has an instruction not to ask for or accept payment, password or identity details.
• Nothing confidential is in the pages or files the bot reads.
• Your privacy policy mentions the chat.
• Only the people who need to follow up can read transcripts.