Determine where customer information goes, which products process it, how it is used and retained, and what current agreements say.
Identify the exact product and account
A consumer chat interface, business workspace, embedded feature, and API from the same company can have different controls and terms. Ask for the product, plan, account owner, settings, and agreement that apply to the actual workflow. A general statement about a provider is not enough.
Check current documentation rather than an old comparison page or an informal sales assurance. Record the answer and the date reviewed because providers, subprocessors, features, and controls can change.
- Is submitted content used to train or improve models or services?
- Can that use be disabled, and who controls the setting?
- How long are inputs, outputs, logs, and backups retained?
- Can the business export or delete the associated records?
Follow the information beyond the model
Call recording, transcription, workflow, customer-management, logging, analytics, and support products may each receive part of a conversation. Draw the route from collection through processing, storage, output, and deletion. Identify subprocessors and where information is handled when those details matter to the business.
Send less. A landscaping inquiry may need a service area and job description, not a full customer history. Use invented or carefully redacted records during design and testing, and avoid sensitive information in prompts, logs, and failure alerts unless the use is necessary and appropriately controlled.
No training does not mean no data risk
A provider may say that business content is not used for model training and still process or retain it to operate the service, prevent abuse, troubleshoot, or meet other stated purposes. Access controls, encryption, retention, incident handling, deletion, and contractual commitments still deserve review.
Regulated or contractually restricted information may require a separate assessment. Obligations depend on the business, location, data, and agreements, so seek qualified advice for the circumstances rather than treating a general article as legal guidance.
Better follow-up and less busywork for small businesses. Have a task like this? Tell me what happens today and what you’d like to change.
Book a 20-minute call