What Customer Data Does a Website AI Chatbot Collect?
See which messages, contact details and session records a website AI chatbot may handle, where they travel and how to collect only what the task needs.
A website AI chatbot may handle conversation text, details visitors choose to share, contact fields, session identifiers and information from connected services. The exact collection depends on the plugin, hosting, provider connection and enabled workflow. It is not safe to assume that every chatbot collects the same data or that an unnamed conversation is anonymous.
With Niwa on a WordPress website, start by separating the public business information used to answer a question from the customer's information used during the conversation. A published product description and a visitor's order reference have different privacy implications.
Map the information by its role
The most useful inventory follows the customer's task. For each category, record whether it is collected, why it is needed, where it is stored and who can access it.
- Conversation content includes messages and responses, plus any attachments the configured system accepts.
- Contact details may include a name, email address or phone number entered for a follow-up or reservation.
- Session and technical information may include a session ID, timestamps, device information or IP addresses in application or hosting logs.
- Connected records may include booking details, order information or support tickets read by authorised tools.
- Optional measurement can create additional records if analytics, tracking or other integrations are enabled.
These are categories to inspect, not a claim that Niwa stores every item listed. Check the actual installation and its connected services. Hosting logs can contain personal data even when the chat transcript does not display it.
A visitor can supply information you never asked for
A free-text box lets someone type a name, describe a health condition or paste another person's details. Removing a required email field does not eliminate all personal data from the conversation.
For EU GDPR purposes, personal data relates to an identified or identifiable person. GDPR Articles 4 and 5 cover the definition and principles, including data minimisation. A session reference linked to an account can remain personal data even if you remove the person's name.
Explain what the chat is for and discourage unnecessary sensitive details. Do not ask visitors to paste payment card numbers, passwords or medical records into a general business conversation. The instruction helps set expectations, but the business still needs a process for information people share unexpectedly.
Follow the data beyond the WordPress database
Niwa's website records can be held on the site's hosting, while relevant information is passed to the selected AI provider for a response. A connected messaging or booking service can receive other parts of the workflow.
Think of a customer asking whether a particular service is available. The model may receive the current question, conversation context and business information. If the customer later books, the booking record may include contact details and a selected time. Those records can have different purposes and retention periods.
Also distinguish model training from routine processing. A provider can exclude customer data from training while still processing and retaining it to supply the service. OpenAI's API data controls illustrate why retention needs to be checked at the feature and account level, rather than inferred from a training statement.
Test the real collection with fictional details
Create a small test plan before opening chat to customers. Use an invented name and test email address, without entering real health, payment or identity information.
First ask a public question such as "What are your delivery options?" Check what appears in the saved conversation and logs. Then test a supported task that needs contact information. Finally, test the contact route for a question the assistant cannot resolve.
Inspect the browser's network requests, the relevant WordPress records and the connected service's logs where you have authorised access. Record the fields present in the actual provider request, if your tools make that inspection available safely. Do not save credentials or real customer messages in a debugging report.
If you cannot inspect a supplier's handling directly, use its current documentation and agreement and ask the supplier to clarify the gap. "Not visible in our dashboard" is not evidence that the data is never processed.
Ask for data when the next action needs it
A shopper comparing two products generally does not need to identify themselves first. A visitor requesting an appointment may need to supply contact details when completing the booking.
Niwa can answer service questions and complete bookings directly in WhatsApp using the website's business context and connected booking workflow. Include both the messaging and booking services in the data map.
If your goal is only to answer published service questions, begin with that narrower task. The Niwa configuration guidance can help you identify which business functions you plan to enable. Review permission and data requirements before adding more.
Turn the inventory into customer information
Use the confirmed map to write the chatbot section of your privacy notice, decide retention periods and prepare a way to handle customer requests. Assign a named person in the business to keep the map current when the provider or integrations change.
Existing WordPress sites can use the standalone Niwa plugin. Discuss your intended workflow with Niwa and bring the task, required fields and connected services. If you also need a website or migration, Niwa Business is USD 150, including hosting, maintenance and business-specific AI adaptation.
The aim is a customer task you can explain clearly, with a data journey you can account for. Collection details should come from the installed system, not a generic chatbot checklist.
