What data reaches your chatbot vendor
Most of it sits in the conversations themselves, because customers type whatever they like there: an order number or an address, and sometimes things nobody asked them for. On top of that come any contact they leave and technical session identifiers.
This data lands in the vendor's tool, and from there it can travel on, for example to the company that supplies the language model. So the answer to "is the chatbot safe" starts with a list of the companies that can see the conversations.
The scope of data should follow from the task. To answer a question about the dimensions of a bookcase you do not need the customer's phone number. To check an order, though, you need data that confirms the person asking owns it, which is why CartBot checks order status by the order number and the email address from that order.
Chatbot and GDPR: how much data to collect and how long to keep it
The GDPR requires you to limit data to what is needed for a specific purpose and to keep it only as long as necessary. It does not ban every form at the start of a conversation. The trouble begins when you cannot justify why you need a phone number for a question about color, or when you collect data "for later" with no concrete purpose.
Set the retention period separately for conversation history and for other records in the tool. "Indefinitely, because it might come in handy" is not a retention period. Ask about exports and backups too, because a conversation deleted from the panel view does not have to disappear from every copy.
The legal basis for processing conversations
Answering a question about a product does not automatically require the customer's consent. Depending on the purpose, the basis may be taking steps at the customer's request before a contract is concluded, or the shop's legitimate interest, after you assess its conditions. Write down which basis you chose, with a short justification.
Marketing is a separate matter. Article 398 of the Polish Electronic Communications Law requires the recipient's prior consent to commercial information, and an address given to handle an order is not such consent in itself. If you want to invite chat customers to a newsletter, ask for that consent separately and plainly.
Then there are cookies. Article 399 of the same law, which covers storing information on the customer's device, including cookies and localStorage, allows exceptions from consent for what is strictly necessary for a service the customer asked for. The mere presence of a chat does not justify firing ad tracking without consent, though. And a consent clicked in the cookie banner does not settle the basis for processing the content of conversations either, because separate rules apply.
The vendor's role and the processing agreement
If the vendor processes data solely on your behalf, it is a processor and you need a data processing agreement under Article 28 of the GDPR. The agreement can be in electronic form. If the same vendor wants to use conversations for its own purposes, which your shop does not set, its role in that operation has to be assessed separately.
"Server in the EU" sounds reassuring, but it does not tell you who can reach the data from other countries, and a transfer outside the European Economic Area needs a proper transfer mechanism and safeguards. The right to erasure also has conditions and exceptions, so do not promise customers you will delete everything the moment they ask.
Put the questions below to the vendor in writing. Keep the answers with the contract, because a year later nobody remembers what was said on the phone.
- Where are conversations stored and how long do you keep them, backups included?
- Will we sign a processing agreement under Article 28 of the GDPR and what exactly will it cover?
- Who else sees the content of conversations, including which AI model provider, and will I get a written list of sub-processors?
- Are my customers' conversations used to train any model, and can that be switched off?
- How will you help when a customer wants to see or delete their data?
- Does data leave the EEA and, if so, on what basis?
Privacy policy and telling people it is AI
You give the Article 13 GDPR information at the moment you collect the data, and the link to your privacy policy is best placed right inside the chat window, so it can be opened on a phone as well. From it the customer should learn who the controller is and how to contact them, for what purposes and on what basis you process data, who receives it and how long you keep it. Then come their rights, including a complaint to the President of the UODO, the Polish data protection authority, and information about transfers outside the EEA if there are any.
From 2 August 2026 the transparency obligations in Article 50 of the AI Act also apply. A provider of a system intended for direct conversation with people must make sure the person knows they are talking to AI, at the latest at the first interaction, unless that is obvious from the circumstances. At setup, check with the vendor how the bot introduces itself, because a sentence such as "You are talking to the shop's AI assistant" at the start of the conversation removes any doubt.
Is a chatbot safe? Test it with dummy data
It is as safe as you configure it and as the agreement with the vendor makes it, so check it yourself. Open the chat as a new visitor and ask about a product. If the bot asks for data that the question does not need, you have your first thing to fix. Then trace where the conversation was saved and how to delete it, and see how the tool behaves after you decline optional consents.
If the chat is meant to profile customers or collect health data, for example in a clinic, you need a separate assessment of those operations, ideally with someone who knows data protection law. This article cannot replace that advice. You can put the same six questions to us before you decide on CartBot.