Part 10 of the RemarkableTek series: AI for Your Business — Sub-series: AI on Your Website
A website chatbot’s whole job is to collect information. A visitor types their name, their phone number, what they need — and the chatbot captures it so it becomes a lead. That works. But it raises a question most owners never ask: once a customer types that information into the chat bubble, where does it actually go? The answer is usually a longer journey than “into my website,” through systems you do not own.
The data takes a trip
The visitor’s message leaves your site and travels to the chatbot vendor’s systems. To generate an intelligent reply, the vendor often sends that message on again — to whatever AI model powers the bot, which may be a separate company. The lead information gets stored somewhere in that chain, and may also be pushed into your CRM or emailed to your team. A single customer message can pass through your website, a chatbot vendor, an AI model provider, and your CRM — four systems, possibly three companies. That is how these tools are built, but it means your customer’s information is handled by parties you may never have evaluated.
Why this matters for your business
It is your customers’ information, and your reputation attached to it. A customer typing details into your chat believes they are dealing with you. If it is mishandled down the chain, they will hold your business responsible.
Some of what gets typed in is sensitive. Customers type whatever feels relevant — health details to a clinic, financial situations to a financial firm. Your chatbot may collect sensitive information simply because a customer volunteered it.
It connects to the safety rules from earlier in this series. Part 2 was about not putting sensitive information into AI tools. A website chatbot is an AI tool that invites the public to do exactly that — so it is essential to know it handles that information responsibly.
The questions to ask before launch
Where is the lead data stored, and for how long? Is the data used to train AI models? (As in Part 4, business-tier tools commit in writing that it is not.) Who along the chain can see the conversations? Is the data encrypted in transit and at rest? What happens to the data if you stop using the tool? Does the vendor have a clear, findable privacy policy? A tool handling customer data with no real privacy documentation is a warning sign on its own.
Tell your customers what is happening
A chatbot should make clear the visitor is talking to an AI tool, and your privacy policy should disclose, in plain language, that information entered into the chat is collected and how it is used. This is good practice everywhere and a legal requirement in some places — and it builds trust rather than eroding it.
What to do this week
If you already have a chatbot, find out where its data goes. If you are planning one, make these questions part of the decision, not an afterthought. This is exactly the kind of review an IT partner handles as routine.
In Part 11, we look at whether collecting customer information through an AI tool creates a formal compliance obligation — and how to tell if it applies to you.
Not sure where your website chatbot is sending customer data?
RemarkableTek can map the data flow behind your website’s AI tools, confirm it is handled safely, and flag anything that puts your customers or your reputation at risk.
Get in touch with RemarkableTek:
- Contact us: remarkabletek.com/contact-us
- Call: 1-602-726-8366
This series is educational and not legal advice; for compliance guidance specific to your business, contact RemarkableTek.