What happens to the data a visitor types into the chat?

Kolbrún runs a small guesthouse in Akureyri and is adding the chat to her website. It takes one line of code. Before she pastes it in she stops on a fair question. Her guests are about to type real things into this chat, names, phone numbers, arrival times, sometimes that someone in the party has an allergy. She will be the one holding that information. Where does it go, and is she responsible for it?

Yes, she is responsible, and that is exactly why it is built the way it is. Her guests are her customers, and the conversations are her business's record, stored in the EU. In legal terms she is the controller of the data and we are the processor that handles it for her, with a data processing agreement between them. The conversations are not used to train AI models. She sees every single conversation and can have the data deleted. Control sits on her side, not ours.

The responsibility is yours, and you would not want it any other way

You cannot hand responsibility for your customers' personal data to software or a vendor, and you would not want to even if you could. These are your guests, your reputation, your relationship with them. Whoever holds the data should also be in charge of it. So the setup is about making it easy for you to carry that responsibility. You see everything that is said, you decide what Anna learns, and the data goes nowhere you are not overseeing. The same reasoning sits behind who answers for the replies themselves, which we cover in the piece on who is responsible for what the AI says.

What happens to a single message, in practice

When a visitor writes into the chat, this is what happens:

• The message becomes part of your conversation and is stored in the EU.
• It is used to answer that visitor and run the conversation, nothing more.
• It is not used to train AI models.
• You and your team see the conversation on your dashboard.
• Whatever Anna is to learn for next time goes through you for approval first.
• If you want the data deleted, it is deleted.

The data processing agreement, and exactly what it covers, you get in writing.

And most of the time the chat needs less than people expect. A visitor can ask about prices, opening hours, or anything else without signing up or giving up a thing about themselves. Only when there is a booking to make or a matter to hand to a team member does Anna ask for a name and phone number, what it takes to finish the job.

Frequently asked questions

Is what people type used to train AI? No. The conversations are used to answer your customers, not to train AI models.

Who is responsible for the data, me or you? You. You are the controller of the data and we are the processor that handles it for you, with a data processing agreement between us. Responsibility for customers' personal data does not transfer to a vendor, and that is how it should be.

Where are the conversations stored? In the EU.

Can I see conversations and have them deleted? Yes. You see every conversation on the dashboard and can have the data deleted whenever you want.

This is why Anna answers the way she does

Anna answers from your own knowledge, the conversations are stored in the EU, and they are not used to train AI models. Every conversation is logged so you can always see what was said, and what she learns goes through you first. When a matter is sensitive or calls for judgment, a team member can take over the conversation in real time. The data is yours, you see it, and you decide what is done with it, including having it deleted.

Privacy comes with the setup itself. The stance is simple. You are the business, so the data is yours.

See how Anna works or try the chat right now, no signup needed. Related reading: who is responsible for what the AI says and how you teach Anna your business.

← All articles