What Should My Privacy Policy Say About an AI Chatbot?
Write a chatbot privacy section that explains real data use, suppliers, retention and customer rights, with an example and a practical review checklist.
Your privacy policy should explain what personal data the chatbot handles, why you use it, the applicable lawful bases, who receives it, how long it is kept and how people can exercise their rights. Describe the actual installation and connected services. A sentence saying "we use AI to improve your experience" does not explain the data journey.
For a Niwa assistant on WordPress, include both the website's records and the relevant information passed to the selected AI provider. Add the messaging, booking or support services used in your customer workflow. Do this from a verified map rather than copying another company's policy.
Identify the business and the specific purposes
For EU GDPR, Article 13 sets the information requirements when collecting personal data from the individual. Start with the controller's identity and contact details, plus representative and data protection officer details where applicable.
Describe concrete purposes. Answering service questions, responding to a contact request and optional marketing are distinct activities. State the relevant lawful basis for each. If relying on legitimate interests, explain those interests; if relying on consent, explain the right to withdraw it without affecting earlier lawful processing.
Avoid a catch-all purpose such as "anything needed to develop our business." Visitors should be able to understand why their message is being processed.
Describe the information and recipients accurately
Explain the categories that your setup actually handles, such as messages, contact details, session references and linked booking information. Include technical records where relevant. Do not claim you collect only anonymous questions if the logs contain identifiable information.
Identify recipients or recipient categories meaningfully. Your hosting provider, AI service and booking supplier do not all perform the same role. Explain the provider connection in language visitors can understand without listing credentials or internal infrastructure details.
Where applicable, include international-transfer information and the relevant safeguards or adequacy basis, along with how the person can obtain information about those safeguards. The website being hosted in one country does not establish where every connected supplier processes data.
Give a useful retention period or criterion
State the actual period or criteria used to determine it. Separate routine conversations from records that result from a customer task and have different obligations.
If the period depends on a complaint remaining open, explain that relationship. Do not put "we keep information as long as necessary" in the policy as a substitute for deciding how the business handles closed conversations.
Make the description match your technical and operational process, including relevant backup handling. If the system uses a manual review procedure, confirm who carries it out. Do not promise immediate deletion everywhere when a provider or backup process has a different timetable.
Explain rights and the route to use them
Describe the applicable rights, including access, rectification, erasure, restriction, objection and portability where their conditions apply. Include the right to lodge a complaint with the relevant supervisory authority.
Give a contact route that the business monitors. Staff should be able to recognise a request made in ordinary language, not only submissions using a special form. Do not suggest that every deletion request is unconditional or that a person must accept marketing to use support.
Explain whether providing particular information is a statutory or contractual requirement, or necessary to enter a contract, and the consequences of not providing it. This can be different for a public question and a requested reservation.
If the deployment involves relevant automated decision-making, including profiling covered by GDPR's disclosure requirements, provide meaningful information about the logic and the significance and envisaged consequences. Ordinary product assistance and consequential eligibility decisions should not be described as if they are the same process.
Use indirect-data information where it applies
Article 14 contains related requirements when personal data is obtained from elsewhere. That can matter when the workflow reads information from a connected source rather than asking the visitor directly.
Assess which source, categories and timing requirements apply to your process. Do not assume one chatbot paragraph replaces all the privacy information already needed for your orders, bookings or messaging service.
The ICO's right-to-be-informed guidance gives useful explanations for UK deployments. Apply it in that jurisdictional context and verify the requirements for other customer markets separately.
A short editing example for a fictional shop
The following example illustrates a purpose statement and data journey. It is not Niwa's privacy policy or a complete legal template:
"River Lane Store uses an AI assistant to answer questions about our published products and delivery information. We process the messages you send and the conversation reference needed to manage that exchange. If you ask our team to contact you, we also use the contact details you provide for that request. Relevant message content and business information are sent to our selected AI service to generate a response."
The shop would still need to supply its actual lawful bases, recipients, transfer arrangements, retention details and rights information. If its installation processes different fields or does additional work, this wording needs to change. The example is useful only when it reflects what happens.
Show a short notice where chat starts
Make the full policy available from the chat entry point, with a brief explanation of the immediate collection. The visitor should see it before sending personal information. Test the link on a small screen and when using the keyboard.
Identify the assistant as AI separately. Also keep optional marketing consent separate: asking someone to confirm they have read a privacy policy does not itself establish a valid choice for promotional messages.
Use the Niwa setup guidance to plan the assistant and the Niwa safety information for product context. Then test fictional enquiries and confirm that the policy matches the saved records and connected processing.
Keep the policy connected to your working setup
Review the text when you change the provider, enable a new channel or collect a new field. Date the internal evidence for those decisions. An accurate policy can become inaccurate without a single change to its wording.
Contact Niwa about your website's customer workflow with your intended task and provider connection. Existing WordPress owners can use the standalone plugin. Niwa Business is USD 150 for a custom WordPress site or migration, hosting, maintenance and AI adaptation to the business.
Legal references checked on 9 October 2026. Have the final policy reviewed for the actual business and jurisdictions it serves.
