Chatbot privacy basics for small businesses

A website assistant talks to your customers and may collect their names, e-mail addresses and phone numbers. That makes it part of how you handle personal information.

This is general information, not legal advice. Privacy rules differ by state, country and industry. Check with your attorney before you rely on any of it.

Tell visitors they're chatting with AI

People should know whether they're talking to a person or a program. Say it in the greeting, for example: "Hi, I'm the AI assistant for Rivera Plumbing. I can answer questions about our services and pass your request to the team." It is honest, and it sets the right expectations about what the assistant can decide.

Consent before saving contact details

Ask before you keep anything. On Allinaa, the assistant offers the inquiry form when a visitor wants to be contacted. The visitor sees the details that will be sent, can edit them, and must agree to be contacted before the inquiry is saved. At least one contact method is required, not all of them. The visitor then receives a confirmation e-mail.

Don't use chat inquiries for newsletters or marketing unless the visitor separately agreed to that.

Never ask for these in a chat

• Social Security numbers or other government ID numbers.
• Credit or debit card numbers, bank account numbers.
• Passwords or one-time codes.
• Health details, diagnoses or medications.
• Anything else you would not want in an e-mail.

Put a matching line in your assistant's knowledge: "Never ask for card numbers, ID numbers, passwords or health details. If a visitor offers them, tell them not to share them here." If you work in healthcare, law, tax or insurance, read using a chatbot in a regulated industry.

What the assistant knows about the page

Allinaa's assistant can answer based on the page the visitor is viewing. To limit what it sees, query strings and fragments are removed from the page address, and private paths such as checkout and account pages are not used. Premium file uploads are checked for malware and stored privately.

Update your privacy policy

Your website's privacy policy should mention the chat. In plain words, cover:

• That the website uses an AI assistant provided by a third party.
• What is collected: chat messages, and contact details if the visitor submits an inquiry.
• Why: to answer questions and respond to requests.
• That messages are processed by AI providers to generate answers.
• How visitors can ask for their data to be deleted.

You can read Allinaa's own Privacy Policy and data deletion instructions to see how we describe our side.

Deletion requests and cancelled services

If a visitor asks you to delete what they sent through the chat, handle it like any other request about their data. Tell Allinaa at info@allinaa.com so the conversation and inquiry can be deleted on our side.

Be aware of one practice: cancelling or pausing an Allinaa service does not delete anything automatically. Your conversations and inquiries are kept so a service can be resumed. If you want your business's data deleted after cancelling, send a deletion request to info@allinaa.com.

Questions to ask any chatbot vendor

1. Where are conversations stored, and who on your team can read them?
2. Which AI providers process the messages?
3. Is visitor consent collected before contact details are saved?
4. What happens to our data when we cancel? Is anything deleted automatically?
5. How do we request deletion of one visitor's data, or all of ours?
6. Which security or compliance claims can you back with documents? Ask to see them; don't accept a badge.

Allinaa answers these questions by e-mail. Allinaa does not claim HIPAA compliance or hold a SOC 2 report, and we would rather say so than let you assume otherwise.

Frequently asked questions

Do I have to tell visitors the chat is AI?

Rules vary, so ask your attorney. As a practice, saying so in the greeting avoids misunderstandings.

Is cancelled data deleted automatically?

No. Cancelling an Allinaa service deletes nothing automatically. Send a deletion request to info@allinaa.com.

Can visitors send documents through the chat?

On Premium, visitors can send photos, screenshots and documents. They are checked for malware and stored privately. Tell visitors not to send sensitive documents.