AI and Customer Data: Privacy Rules for Small Businesses

Where customer data meets AI

Prompts: "rewrite this reply to Jane Doe about her missed payment".
Uploads: review exports, call notes, lead lists or appointment data.
Integrations: AI connected to email, help desk, calendar, point of sale or CRM.
Chatbot logs: names, complaints, account and sometimes health or money worries.
Vendor improvement data: some tools may use what you submit to improve their models unless settings or contracts say otherwise.
Derived data: profiles, scores, segments and predictions AI creates from the originals.

AI does not change the basic questions

What information are we collecting or entering, and why do we need it?
What did we tell customers we would do with it?
Who receives it, including AI vendors and their subcontractors?
How is it protected, and how long is it kept?
Can customers access, correct, delete or opt out where a law gives them that right?
Are we now using it for a new purpose, such as training, profiling or targeted advertising?

Keep the promises in your privacy policy

The FTC treats a company that breaks its own privacy promises as engaging in deception, and it has warned AI companies not to quietly change how they use data. For a small business that means:

Do not claim "we never share your data" if vendors process it for you.
Do not use customer data for AI training, profiling or marketing if you said it was only for providing the service.
When you promise deletion, check vendor logs, transcripts and backups too.
Configure vendor settings such as "do not train on my data" and retention limits to match what you promised.
Update your privacy policy before you start a new AI use, not after.

State privacy laws are broader than many owners expect

A growing number of states have comprehensive consumer privacy laws, including California, Colorado, Virginia and many others, each with its own thresholds, rights and rules on profiling and automated decisions. California's attorney general explains the California Consumer Privacy Act, and Colorado's attorney general explains the Colorado Privacy Act.

Whether a law applies depends on things like your revenue, how many residents' records you handle and whether you sell or share data. Check the states where your customers live, not just where you are.

Sensitive data needs extra care

Health information: medical, dental and therapy practices have specific federal rules; any business handling health details should keep them out of general AI tools.
Children's data: COPPA restricts collecting personal information from children under 13 online without verifiable parental consent.
Financial data: the Gramm-Leach-Bliley Act sets privacy and security duties for many businesses that offer financial products or services.
Biometrics and precise location: several states treat these as sensitive and require consent.

Read the vendor terms

What exact task will the AI perform, and on which data types?
Does it train on prompts, uploads, outputs or chat logs by default, and can you switch that off?
How long does it keep prompts, files and logs, and does deletion reach backups?
Which subcontractors help provide the service, and where is data stored?
Will it help you answer customer access, deletion and opt-out requests?
How fast will it notify you of a security incident, and what happens to your data when you cancel?

Minimize and set retention

Test tools with fake or sample records.
Remove names, emails, phone numbers and account numbers before summarizing themes.
Give a chatbot only what it needs, such as order status, not payment details.
Upload 30 days of tagged tickets, not every conversation ever recorded.
Limit which staff can run AI tasks on which data.
Keep a simple inventory of where customer data lives, including AI tools and transcripts, and how long each is kept.

Our list of what never to paste into ChatGPT and our private AI guide cover practical ways to keep sensitive data in your control.

Where ASL fits

Viavitna answers customer questions only from content you approve and keeps a tally of questions it could not answer without storing what visitors typed. For AI tools built on your own infrastructure with retention and access rules you set, see our custom software development service or contact us.

Frequently asked questions

Is it legal to put customer data into ChatGPT?

It depends on what you promised customers, which privacy laws apply and the tool's terms. As a rule, keep personal data out of public tools and use business plans with data controls when needed.

Do I need to update my privacy policy for AI?

If you use customer data in new ways, such as AI vendors processing it, profiling or training, update the policy before you start and make sure your practice matches it.

Which state privacy laws apply to my business?

It depends on where your customers live, your revenue and how much personal data you handle. Check each state where you have customers, starting with official attorney general guidance.

What data is sensitive under privacy laws?

Commonly health, children's, financial, biometric and precise location data, plus others in some states. Keep it out of general AI tools.

What should I ask an AI vendor about privacy?

Whether it trains on your data, how long it keeps it, who its subcontractors are, how deletion works, how it helps with customer requests and how fast it reports incidents.

Related guides

Explore the complete product

Read features, current access and limitations

AI and Customer Data: The Privacy Rules Small Businesses Need