What your AI agent does with customer data
Your customers' conversations pass through a model someone else runs. Nine questions to get answered in writing before they do.
General guidance, not legal advice. Your obligations depend on where you and your customers are; confirm your position with your own counsel.
When an AI agent answers a call, your customer's words leave your systems, pass through a speech provider and a model provider, and come back. That is several companies handling your customers' conversations, and you remain the one accountable for it.
Nine questions to get answered in writing before you switch anything on.
1. Who are the sub-processors, by name?
Not "industry-leading providers". Which speech vendor, which model provider, which cloud, in which countries. You cannot assess a risk described in adjectives.
2. Is our data used to train their models?
Ask about the model provider specifically, not just the platform. The platform may not train on your data while passing it to an API tier that does. The answer you want is a contractual no on the whole chain, and enterprise API tiers generally provide it — but "generally" is not your contract.
3. How long is it retained, and by whom?
Three separate retentions: the platform's, the model provider's, and the speech provider's. Model providers commonly retain inputs briefly for abuse monitoring. That is usually acceptable; not knowing about it is not.
4. Where is it processed?
If you have a data-residency requirement, raise it before you subscribe. Retrofitting residency is usually impossible, and the honest answer from most vendors is that inference happens where the model provider runs.
5. Are calls recorded, and who decided?
Recording is a choice with consequences. Consent rules vary sharply — some jurisdictions need all parties, some need an announcement. If you record, say so at the start of the call, and decide a retention period rather than keeping audio forever because storage is cheap. More on the operational checks.
6. Who at the vendor can read a conversation?
Support access is normal and necessary. What you want to know is whether it is scoped, logged, and whether anyone can browse rather than being granted access to a specific ticket.
7. Can we delete, and does it propagate?
If a customer exercises a deletion right, does deleting on the platform reach the sub-processors? Frequently it does not, and frequently nobody has asked. Get the actual answer, including how long backups persist.
8. What happens on termination?
Can you export everything yourself before the account closes? How long is data kept afterwards? This is a commercial question as much as a privacy one — migrations are where this bites.
9. What is the breach process?
Not whether they promise never to have one. Who tells you, how fast, and with what detail — because your own notification obligations start when you find out.
Two things that are yours, not the vendor's
What goes into the agent. If your prompt or knowledge base contains customer data, that data is now in every conversation. Keep the knowledge base to facts about your business, not facts about individuals.
What the agent is allowed to say back. An agent with a function that returns order details will read them to whoever is on the phone. Decide what identity check happens first — this is the most commonly skipped control on the entire list, and the easiest one to be embarrassed by.
The short version
Ask for the sub-processor list, a no-training commitment covering the whole chain, retention periods for each party, and the deletion path. Get them in the contract rather than the sales deck. A vendor that cannot answer these in one call has not thought about them, which is itself the answer.
Convarza's own positions are in the privacy policy — including what we deliberately do not promise.