Your shop's data and AI: what to share and what to keep out
An admin copies a month of customer chats, names, numbers and addresses included, into an AI to find out what people complained about. The answer is excellent. But the data she sent wasn't only the shop's to send.
Key points
- Personal data customers give a shop, such as names, phone numbers and addresses, is given for a purpose like delivery or an appointment, so the shop needs to be careful about using it elsewhere or passing it on.
- AI services store and use what you type differently depending on the product, the plan and the settings. Owners should check for themselves before using one for shop work.
- Information that's already public, such as menus, prices, product details and sales figures without customer names, can go into AI without much worry.
- Names, phone numbers, addresses, ID numbers, bank details, health information and passwords should be removed before pasting anything into AI.
- Most tasks, like summarising what customers complain about, give the same answer after customer names are replaced with codes.
Wednesday afternoon. The admin at an online skincare shop has been asked by the owner to find out what customers complained about this month. She knows straight away how she'll do it.
She selects the month's chats, two hundred-odd conversations, copies the lot and pastes it into the AI app on her personal phone. Everything is in there: real names, phone numbers, delivery addresses, photos of bank transfer slips, and a photo of one customer's face, sent to ask which cream is safe for a rash like hers.
Thirty seconds later she has an excellent summary. Late deliveries early in the month, dented boxes, broken pump caps. The owner is impressed by the speed. Then she sees how it was done, and something feels off, though she can't yet say what.
What's off is that the data in those chats wasn't only the shop's to share.
Customer data in your chats isn't only yours
Customers gave their phone numbers and addresses so the shop could deliver. They sent a photo of a rash to ask which cream would be safe. They didn't give any of it so the shop could pass it somewhere else, even if somewhere else is just an AI helping with a summary.
That's the same thinking behind the PDPA, Thailand's personal data protection law, at the level of principle. Personal data is collected for a purpose the customer knows about, the business is responsible for keeping it from leaking, and some kinds, such as health information, count as sensitive data that needs extra care. Exactly what a shop has to do depends on the business, so if you're unsure, talk to a legal professional. There's a grounding in keeping customer data useful and PDPA-compliant.
The simplest test: if the customer were standing behind you as you hit paste, would they be fine with it?
Once you've typed it, where does the data go?
Everything you type or upload into an AI chat goes to the provider's servers. How long it's kept, who can access it and whether it's used to improve the AI depends on which product you use, which plan you're on and how it's set up. There isn't one answer that applies to all of them.
What a shop can do is look for itself. Open the data and privacy settings in the AI you use, read how conversations are stored and used, and switch off what you don't want. If you use it for the business, check whether the provider offers a business or team plan with different data terms from a personal one.
The blind spot is usually staff's personal accounts. When an admin uses AI on her own phone with the best intentions, the shop has no way of knowing what settings that account has.
What you can put into AI with peace of mind
The good news is that most of what AI can help a shop with doesn't need anyone's personal data at all.
Things the shop already makes public. Menus, prices, product descriptions, opening hours, the returns policy on your website. Anyone can see these already, so go ahead and have AI use them to help with posts or chat replies.
Numbers without names. Sales by product, orders per day, total costs. With no column that identifies a person, they're fine for analysis. How to ask questions that lead somewhere useful is in using AI to read your sales.
General questions. Instead of pasting one customer's chat, describe the situation. "A customer got their order three days late and is very upset. Help me draft an apology." You get the same answer without exposing anyone.
The shop's own internal information, like product costs, supplier contracts or promotions not yet announced, is the shop's own secret. Whether it goes in is the owner's call, but make that call after checking the settings above.
A checklist of what to remove before pasting into AI
Before you paste anything, look for the following. If it's there, delete it or swap it for a code first.
- Customers' names, identifying nicknames, LINE IDs and email addresses
- Phone numbers and delivery addresses
- National ID numbers, photos of ID cards or other identity documents
- Bank account numbers, transfer slips and card details
- Health information, symptoms, treatment history, and photos of customers' bodies or faces
- Passwords, back-office logins and API keys used to connect systems
It isn't a long list, but almost every item turns up in a typical online shop's customer chats. That's why copying chats wholesale is a habit worth breaking.
Take the names out and the answer stays the same
People worry that removing details will make AI less helpful. For most tasks it doesn't. Working out what customers complain about doesn't require knowing their names or house numbers.
The easiest way is to copy only the text customers typed, leave out the headers with their names, and number them Customer 1, 2, 3. Find-and-replace in any word processor helps. Then ask something like this.
Below are 120 customer messages to my shop from September. Names have been changed to Customer 1, 2, 3 and there are no phone numbers or addresses. Please group what customers complained about, count the messages in each group, and quote the clearest example from each.
If the answer suggests someone should get a follow-up, the shop can match the code back to the real chat in its own system. The personal data never has to leave the shop.
Set a few rules for the team before everyone starts using AI their own way
In a shop with several staff, sooner or later everyone will use AI their own way. What helps most is a few rules written down where people can see them: which account to use for shop work, what must never go in, who to ask when unsure, and the owner checking that account's data settings once. If the shop is also going to let AI answer customer chats, there's a bit more to think about in should AI answer your customer chats?
It also helps if customer data isn't scattered across everyone's phones to begin with. Shops that work with woowey keep their customer list in the shop's own system, backed up every day, with chats from the website and LINE in one inbox. The team works from one place, with no need to copy chats out anywhere else.
The following Wednesday, the same admin does the same job. This time she spends an extra ten minutes swapping names for numbers before pasting. The summary is identical, line for line: late deliveries early in the month, dented boxes, broken pump caps. The only difference is that the photo of that customer's rash is still where she sent it.
Frequently asked questions
Can I put customer data into ChatGPT?
Avoid anything that identifies a customer, such as names, phone numbers, addresses and health details, because customers gave it for another purpose. Most tasks work just as well once names are replaced with codes.
Does AI use what I type to train itself?
It depends on the product, the plan and the settings of each service. There's no single answer for all of them, so check the privacy settings and data terms of the service you use.
Is using AI with customer data a PDPA problem?
It depends on what data, for what purpose and where it's sent. In principle, a shop should use personal data for the purpose customers know about and protect it from leaking. For specific cases, consult a legal professional.
What shop information is safe to put into AI?
Information that's already public, like menus, prices, product details and opening hours, plus sales figures without customer names, can go in without much concern.
The woowey team
We build websites and systems for businesses
We build websites, booking systems, online stores and back offices for Thai businesses, then look after them every month. What we write here comes from what we see working with real shops.
Want this for your business? Tell us
Type what you need. The woowey team builds your website and systems, then looks after them every month.
Keep reading
AI for businessAI for small businesses: what it's actually good for in a shop
At half past ten at night, a bakery owner asks AI how to sell more and gets an answer she can't use. Meanwhile the work AI could really help with is sitting in 23 unread messages on her phone.
AI for businessUsing ChatGPT to write sales posts: why they all sound the same, and what to tell it
A maths tutor opens a new course and asks ChatGPT for a sign-up post. Every line is polished and nobody gets in touch. The problem isn't the AI. It's everything she didn't tell it.
AI for businessShould AI answer your customer chats? Which questions to hand over, and which need a person
At 10 pm, a clinic admin answers a dozen messages about this month's promo price. The one message asking whether a face should still be red after a laser treatment gets answered the next morning. That's the case for letting AI answer some chats, and not others.