Customer conversations are personal data. An AI agent that handles them makes you the controller and its vendor a processor — which means the questions below are yours to ask, and any serious vendor should answer them concretely.
Ask how retention is enforced, not just promised
A retention policy is a sentence; retention enforcement is a scheduled job that actually deletes. Ask what runs, how often, and what it covers — transcripts, personal data, tickets. If the answer is a document rather than a mechanism, keep asking.
Ask for the subprocessor list before signing
Every AI vendor sits on other vendors: hosting, language models, speech services. You are entitled to know who they are and where they process, before signature — not after an incident. Transfers outside the EEA should be covered by Standard Contractual Clauses or an equivalent safeguard.
Ask what the AI providers see
Conversation content typically reaches a language-model provider to produce answers. Ask which providers, under what agreements, and whether your data trains anyone’s models. Vague answers here are answers too.
Ask how you would audit an answer
When a customer disputes what the agent said, can the vendor show which knowledge produced the answer? A source log per conversation turns arguments into lookups. Without one, every dispute is your word against a transcript-less bot.
Ask what happens on exit
Deletion or return of your data on termination should be contractual and mechanical. A vendor whose export story is fuzzy is telling you something about the switching costs they intend.