AI and Your Customer Data: Questions to Ask Any Vendor

By GetGood · July 15, 2026 · 5-minute read

Why this matters more with AI than with your last tool

You've handed customer data to software before — your booking system, your email list, your accounting app. AI tools feel different, and the instinct is correct. To be useful, an AI often needs to see the actual content: the email a customer wrote, the note about their job, the history of what they bought. That's a lot of real information passing through a system you didn't build. It's worth a few minutes of questions before you turn it on.

The good news: you don't need to be technical to ask the right ones. You're not auditing their servers — you're checking whether they'll tell you the truth plainly and put it in writing. The questions below are ones any owner can ask in an email, and the quality of the answers tells you most of what you need to know.

The six questions to ask any AI vendor

Send these before you upload anything real. Copy them into an email, or ask them on the call.

1. Where is my data stored, and for how long? You want a clear answer, not a shrug. "In our secure cloud, retained until you delete it" is a real answer. "It's all handled automatically" is not.
2. Do you use my data to train or improve your models? This is the big one. Some vendors clearly say business data isn't used to train; others use it unless you opt out. Get the current policy in writing — never take it secondhand.
3. Who else can see my data? Their own staff, and any other companies they rely on to run the service ("subprocessors"). A straight answer here separates the serious vendors from the rest.
4. Can I export my data and permanently delete it, on demand? You want a yes to both. If leaving means your customer list is trapped inside their tool, you don't really own it — a theme we cover in how to choose your first AI tool.
5. What happens to my data if I cancel? Is it deleted, and when? Kept "for a while"? This is the question most people forget, and it's exactly when data goes missing or lingers where it shouldn't.
6. Is there a written data agreement I can read? A vendor built for business use will have a policy page and, often, a formal agreement ready. Being handed one without a fight is a good sign.

What a trustworthy answer sounds like

You're grading two things: clarity and willingness. A good vendor answers in plain language, points you to a page you can read yourself, and doesn't act annoyed that you asked. A bad one talks around the question, buries the policy, or leans on reassuring words — "bank-level security," "fully compliant," "completely safe" — without anything you can actually check.

Watch for the guarantee. Any vendor who promises your data is "100% safe" or "can never be breached" is overselling, because no honest technologist would say that. Safety isn't a promise you can buy; it's a set of sensible choices — encryption, deletion on request, no quiet reuse of your customers' information — plus your own habit of sharing only what a task needs. A vendor who explains the trade-offs is more trustworthy than one who waves them away.

The training question, in plain terms

People fixate on "will my data train their AI?" — and it's a fair worry, but the answer isn't universal. It depends on the vendor and often on which plan you're on. That's precisely why you should never accept a secondhand answer, including from an article like this one. We can't tell you what any specific tool does with your data today, and we won't pretend to. What we can tell you is the move: ask the vendor directly, and get the answer from their own current policy page, in writing. If they can't point you to one, that itself is the signal.

The safest setup: keep the data close

There's a quieter option that sidesteps a lot of this. When your AI works out of a folder on a machine you control — reading your files locally rather than uploading your whole customer list into someone else's product — far less of your data ever leaves your hands in the first place. It's the same principle behind giving your AI your business context: the AI reads what it needs, where you keep it, and you decide what it ever sees. You still keep a person reviewing anything sensitive — the approval rule applies to data handling as much as to output.

That won't cover every tool — some jobs genuinely need a cloud service. But it reframes the goal. You're not trying to find a vendor you can trust with everything; you're trying to share as little as the task requires, with vendors who answer plainly when you ask.

Where we're biased — and where we stop

We install AI setups for a living, and the approach we prefer keeps your data on machines you own, using Claude Code — so weigh our tool preference accordingly. But nothing above is a pitch: these are the questions to ask any vendor, including ones we'd never touch. And note where we deliberately stop — we won't tell you what a specific company does with your data, whether you legally need a formal agreement, or whether a given tool meets your industry's rules. Those depend on your situation and often on a professional's advice. Our job here is to hand you the questions; the answers have to come from the vendor's own page and, where the stakes are real, your own advisor.