[{"data":1,"prerenderedAt":16},["ShallowReactive",2],{"blog-post-chatbot-data-retention":3},{"id":4,"slug":5,"title":6,"metaDescription":7,"heroImageUrl":8,"languageCode":9,"publishedAt":10,"updatedAt":11,"contentHtml":12,"faqJsonLd":13,"keywords":14},1047751,"chatbot-data-retention","Chatbot Data Retention: How Long to Keep Chats","How long should a website chatbot keep conversations? Learn what vendors store, what US and EU rules expect, and how to set a retention policy for your business.","https:\u002F\u002Fmedia.babylovegrowth.ai\u002Fblog-images\u002Forganization-42511\u002F1793543657731_Shop-owner-reviewing-chatbot-retention-settings.jpeg","en","2026-11-03T02:30:36.335Z","2026-11-03T04:08:51.898Z","\u003Cp>A website chatbot should keep a conversation only as long as you have a clear reason to. For most small businesses that means a short, written period for raw chat logs, a longer one for leads a person asked you to follow up on, and a routine for deleting the rest. No law gives one universal number. What the rules do expect is that you pick a period, tell visitors about it and actually delete on schedule.\u003C\u002Fp>\n\u003Cp>This guide covers what chatbots store, what happens when a chat is “deleted,” which rules apply to a US business with international visitors, and how to set a policy you can run without a legal team.\u003C\u002Fp>\n\u003Cdiv data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;box-sizing:border-box;\">\u003Cdiv style=\"border-radius:26px;padding:min(22px,3.2vw);background:radial-gradient(circle at 100% 0%,#d7f2fc 0 150px,rgba(255,255,255,0) 151px),radial-gradient(circle at 0% 100%,#d7f2fc 0 130px,rgba(255,255,255,0) 131px),linear-gradient(180deg,#e4f6fd 0%,#f2fbfe 100%);\">\u003Cdiv style=\"background:#ffffff;border-radius:18px;box-shadow:0 12px 34px rgba(0,0,0,0.13);overflow:hidden;\">\u003Cdiv style=\"padding:34px 30px;text-align:center;\">\u003Cdiv style=\"margin:0 0 18px;\">\u003Cspan style=\"display:inline-block;max-width:100%;box-sizing:border-box;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#1FB8EF;color:#ffffff;\">Konvuno\u003C\u002Fspan>\u003C\u002Fdiv>\u003Cdiv style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0;\">Keep Website Conversations Useful\u003C\u002Fdiv>\u003Cdiv style=\"width:56px;height:6px;border-radius:3px;background:#1FB8EF;margin:12px 0 14px;margin-left:auto;margin-right:auto;\">\u003C\u002Fdiv>\u003Cdiv style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto;\">Konvuno answers visitor questions from your website content and FAQs, captures leads in a built-in CRM, and hands off questions to a human when needed.\u003C\u002Fdiv>\u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002F\" style=\"display:inline-flex;align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#1FB8EF;color:#ffffff;\">Explore Konvuno\u003Csvg width=\"17\" height=\"17\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2.6\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"display:block;flex:0 0 auto;\">\u003Cpath d=\"M5 12h14\"\u002F>\u003Cpath d=\"m12 5 7 7-7 7\"\u002F>\u003C\u002Fsvg>\u003C\u002Fa>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\n\u003Ch2 id=\"tldr\" tabindex=\"-1\">TL;DR\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>There is no single legal retention number for chatbot conversations. You choose a period tied to a purpose, write it down and follow it.\u003C\u002Fli>\n\u003Cli>Deleting a chat from view does not always mean it is gone from every system. Large AI providers publish their own windows, from 30 days to years.\u003C\u002Fli>\n\u003Cli>Visitors type more than you expect: names, emails, phone numbers, even health details. Tell them what to leave out and keep the logs short-lived.\u003C\u002Fli>\n\u003Cli>Disclose your retention period in your privacy notice, and give people a working way to ask for deletion.\u003C\u002Fli>\n\u003Cli>Review your stored conversations on a fixed schedule, and move anything you must keep into your CRM instead of leaving it in raw transcripts.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"table-of-contents\" tabindex=\"-1\">Table of Contents\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"#what-chatbot-data-retention-actually-covers\">What “chatbot data retention” actually covers\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#how-long-do-chatbots-keep-your-data\">How long do chatbots keep your data?\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#training-review-and-opt-in-the-second-retention-clock\">Training, review and opt-in: the second retention clock\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#what-happens-when-a-chat-is-deleted\">What happens when a chat is deleted\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#which-rules-affect-your-retention-choices\">Which rules affect your retention choices\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#how-to-set-a-retention-policy-in-six-steps\">How to set a retention policy in six steps\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#what-visitors-should-avoid-sharing-with-a-website-chatbot\">What visitors should avoid sharing with a website chatbot\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#control-what-the-assistant-knows-and-keeps\">Control what the assistant knows and keeps\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#our-perspective\">Our perspective\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#try-it-on-your-own-site\">Try it on your own site\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#faq\">FAQ\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#sources\">Sources\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"what-chatbot-data-retention-actually-covers\" tabindex=\"-1\">What “chatbot data retention” actually covers\u003C\u002Fh2>\n\u003Cp>Retention is not only the chat transcript. When a visitor talks to a website assistant, several kinds of data can pile up:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>The transcript:\u003C\u002Fstrong> every question and answer, with timestamps.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Contact details:\u003C\u002Fstrong> names, emails and phone numbers the visitor typed in, or entered in a lead form.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Metadata:\u003C\u002Fstrong> the page the visitor was on, the language, the device and how the chat ended.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Derived data:\u003C\u002Fstrong> summaries, tags, lead scores and analytics built from the conversation.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Feedback and review data:\u003C\u002Fstrong> thumbs up or down, and conversations flagged for review.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Each layer can have its own lifespan. That is why a policy that says only “we keep chats for 90 days” is often incomplete. You also need to say what happens to the lead record created from that chat, and to the analytics derived from it.\u003C\u002Fp>\n\u003Cp>The layers matter because a conversation holds more than the visitor meant to share. A 2026 peer-reviewed review in Springer’s AI journal \u003Ca href=\"https:\u002F\u002Flink.springer.com\u002Farticle\u002F10.1007\u002Fs44163-026-02431-5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">describes conversations that contain names, email addresses, phone numbers, and financial, location and health information\u003C\u002Fa>. The same review says conversational systems can also reveal moods, political views and personality traits. Deleting the visible chat does not necessarily remove data that was derived from it.\u003C\u002Fp>\n\u003Ch2 id=\"how-long-do-chatbots-keep-your-data\" tabindex=\"-1\">How long do chatbots keep your data?\u003C\u002Fh2>\n\u003Cp>It depends on who runs the model and who runs the widget. Two layers are involved: the chatbot provider that hosts your assistant and its dashboard, and any AI model provider behind it. Each has its own retention terms.\u003C\u002Fp>\n\u003Cp>Published terms from major AI providers show how wide the range is:\u003C\u002Fp>\n\u003Cdiv class=\"kv-doc-table\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Provider practice\u003C\u002Fth>\n\u003Cth>What it says\u003C\u002Fth>\n\u003Cth>Source\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>OpenAI, consumer ChatGPT and API\u003C\u002Ftd>\n\u003Ctd>Deleted chats and temporary chats are scheduled for removal from its systems within 30 days, and API data is deleted after 30 days, unless a legal or security need applies.\u003C\u002Ftd>\n\u003Ctd>\u003Ca href=\"https:\u002F\u002Fopenai.com\u002Findex\u002Fresponse-to-nyt-data-demands\u002F\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">OpenAI\u003C\u002Fa>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Anthropic, feedback data\u003C\u002Ftd>\n\u003Ctd>Feedback data, including the associated conversations, can be stored for up to 5 years in secured back-ends.\u003C\u002Ftd>\n\u003Ctd>\u003Ca href=\"https:\u002F\u002Fprivacy.claude.com\u002Fen\u002Farticles\u002F10023580-is-my-data-used-for-model-training\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Anthropic Privacy Center\u003C\u002Fa>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>The numbers are not comparable, because they describe different kinds of data. OpenAI’s 30 days applies to deleted chats. Anthropic’s five years applies to feedback data, which is a separate category from ordinary chats.\u003C\u002Fp>\n\u003Cp>OpenAI also notes that a court order once forced it to keep consumer chat and API content, and that it is \u003Ca href=\"https:\u002F\u002Fopenai.com\u002Findex\u002Fresponse-to-nyt-data-demands\u002F\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">no longer under that order since September 26, 2025\u003C\u002Fa>. The lesson for a business is practical: a deletion promise can be overridden by legal obligations, so your policy should say “unless the law requires us to keep it.”\u003C\u002Fp>\n\u003Cp>For your own site, the same logic applies. Ask your chatbot vendor three questions in writing:\u003C\u002Fp>\n\u003Col>\n\u003Cli>How long are conversation logs stored by default, and can you change it?\u003C\u002Fli>\n\u003Cli>Are conversations used to train models, and is that on by default or only by opt-in?\u003C\u002Fli>\n\u003Cli>When you delete a conversation or lead, how long until it disappears from backups?\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Ch2 id=\"training-review-and-opt-in-the-second-retention-clock\" tabindex=\"-1\">Training, review and opt-in: the second retention clock\u003C\u002Fh2>\n\u003Cp>Some conversations stay longer because they are used to improve models. Anthropic states that it may use chats to improve its models when \u003Ca href=\"https:\u002F\u002Fprivacy.claude.com\u002Fen\u002Farticles\u002F10023580-is-my-data-used-for-model-training\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">users opt in, when conversations are flagged for safety review, or when users otherwise explicitly agree\u003C\u002Fa>. Other providers draw the lines differently.\u003C\u002Fp>\n\u003Cp>If you want a plain-language look at when chat sessions may feed model improvement and how opt-in choices change that, this \u003Ca href=\"https:\u002F\u002Fblog.wvelabs.com\u002Fblog\u002Fai-chatbot-design\" target=\"_blank\" rel=\"noopener\">AI chatbot design guide\u003C\u002Fa> is a good companion read.\u003C\u002Fp>\n\u003Cp>For a small business, the safest setup is one where your visitors’ messages answer questions from your own FAQs, pages and product feed, and are not repurposed for anything else. When you evaluate any assistant, check whether your conversations are used beyond serving your visitors. If they are, your privacy notice must say so.\u003C\u002Fp>\n\u003Cp>The Council of Europe’s Consultative Committee has also noted that foundation models can memorize training data, which creates problems for data subject rights. The \u003Ca href=\"https:\u002F\u002Frm.coe.int\u002Fdraft-t-pd-2025-5-rev5-draft-guidelines-on-privacy-and-data-protection\u002F48802e6604\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">draft guidelines\u003C\u002Fa> recommend mitigation mechanisms and, where possible, extracting memorized data. In plain terms: once personal data has gone into a model, taking it back is hard. Keeping personal data out of training in the first place is far easier.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fmedia.babylovegrowth.ai\u002Fblog-images\u002Forganization-42511\u002F1793543694122_Training-review-and-opt-in-the-second-retention-clock.jpeg\" alt=\"Training, review and opt-in: the second retention clock\">\u003C\u002Fp>\n\u003Ch2 id=\"what-happens-when-a-chat-is-deleted\" tabindex=\"-1\">What happens when a chat is deleted\u003C\u002Fh2>\n\u003Cp>Three things can happen, and only one of them is real deletion.\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Hidden from view.\u003C\u002Fstrong> The transcript disappears from your dashboard, but the record still exists in the database or in backups.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Scheduled for deletion.\u003C\u002Fstrong> The record is removed after a delay, such as OpenAI’s 30-day window for deleted chats, unless a legal or security exception applies.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Deleted everywhere, including derived data.\u003C\u002Fstrong> The transcript, the lead record, summaries and analytics entries built from it are all removed.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Most people assume the third, and most systems deliver the second at best. If a visitor asks you to erase their data, you need to know which of the three your tools do. Check each place a chat can end up: the chatbot dashboard, your CRM, email notifications sent to your team, and any spreadsheet someone exported.\u003C\u002Fp>\n\u003Cp>This is the most common small-business gap. The chatbot deletes the transcript on schedule, but a lead notification sits in three inboxes forever. Build the deletion routine around every copy, not just the original.\u003C\u002Fp>\n\u003Ch2 id=\"which-rules-affect-your-retention-choices\" tabindex=\"-1\">Which rules affect your retention choices\u003C\u002Fh2>\n\u003Cp>You do not need to be a lawyer, but you do need to know which rules your visitors bring with them. Your site may be American, yet your visitors can be anywhere.\u003C\u002Fp>\n\u003Ch3 id=\"united-states\" tabindex=\"-1\">United States\u003C\u002Fh3>\n\u003Cp>There is no single federal chatbot retention law. State privacy laws set the main expectations. The California Consumer Privacy Act requires businesses to \u003Ca href=\"https:\u002F\u002Fwww.oag.ca.gov\u002Fsites\u002Fall\u002Ffiles\u002Fagweb\u002Fpdfs\u002Fprivacy\u002Fccpa-nopa.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">provide ways to submit deletion requests and to honor them\u003C\u002Fa>, with exceptions for completing a transaction, security, debugging and legal obligations. If you are subject to the CCPA, a chatbot conversation containing a visitor’s personal information falls inside that process.\u003C\u002Fp>\n\u003Cp>Other states have their own privacy statutes, and thresholds for who is covered differ. If you are unsure whether a law applies to you, ask a privacy attorney licensed in your state. Do that before you launch, not after a complaint.\u003C\u002Fp>\n\u003Ch3 id=\"european-union-and-similar-frameworks\" tabindex=\"-1\">European Union and similar frameworks\u003C\u002Fh3>\n\u003Cp>If you serve visitors in the EU, the GDPR’s storage limitation principle applies. Organizations must keep data to a strict minimum, \u003Ca href=\"https:\u002F\u002Frm.coe.int\u002Fdraft-t-pd-2025-5-rev5-draft-guidelines-on-privacy-and-data-protection\u002F48802e6604\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">review it periodically for deletion, and tell users about retention periods in their privacy notices\u003C\u002Fa>. Personal data no longer needed for its original purpose has to be securely deleted or anonymized.\u003C\u002Fp>\n\u003Cp>The GDPR text itself adds a transparency duty: \u003Ca href=\"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN-HR\u002FTXT\u002F?uri=CELEX:32016R0679\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">information about processing must be easily accessible and understandable\u003C\u002Fa>, with clear identification of the controller and the purposes.\u003C\u002Fp>\n\u003Ch3 id=\"what-this-means-in-practice\" tabindex=\"-1\">What this means in practice\u003C\u002Fh3>\n\u003Cp>The rules point in the same direction, which makes a single policy workable:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Know why you keep each type of data.\u003C\u002Fli>\n\u003Cli>Keep it no longer than that reason lasts.\u003C\u002Fli>\n\u003Cli>Say so in plain words in your privacy notice.\u003C\u002Fli>\n\u003Cli>Delete on request, except where an exception applies.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>For help turning those points into notice language, this guide to privacy policy disclosures for small businesses shows how to make purposes, retention periods and user rights understandable.\u003C\u002Fp>\n\u003Ch2 id=\"how-to-set-a-retention-policy-in-six-steps\" tabindex=\"-1\">How to set a retention policy in six steps\u003C\u002Fh2>\n\u003Cp>This works for a small team with no dedicated privacy staff.\u003C\u002Fp>\n\u003Ch3 id=\"inventory-what-the-chatbot-collects\" tabindex=\"-1\">1. Inventory what the chatbot collects\u003C\u002Fh3>\n\u003Cp>Open your dashboard and list every field: transcript, email, phone, page URL, language, lead status, analytics. Add anything that gets copied elsewhere, such as notifications or CRM exports.\u003C\u002Fp>\n\u003Ch3 id=\"give-each-item-a-purpose\" tabindex=\"-1\">2. Give each item a purpose\u003C\u002Fh3>\n\u003Cp>Write one sentence per item. “Transcripts: to improve our answers and resolve disputes about what the assistant said.” “Lead records: to follow up on a request the visitor made.” If you cannot write the purpose, you probably should not keep the data.\u003C\u002Fp>\n\u003Ch3 id=\"choose-a-period-for-each-purpose\" tabindex=\"-1\">3. Choose a period for each purpose\u003C\u002Fh3>\n\u003Cp>There is no official figure to copy, so choose a period you can defend. A common pattern is short retention for raw transcripts, longer for lead records tied to an active sales conversation, and indefinite only for anonymized statistics. One of the pages ranking for this topic suggests 30 days for chat logs used for immediate service improvement, but that is a vendor’s suggestion, not a legal rule. Set what fits your business, then document why.\u003C\u002Fp>\n\u003Cp>As a starting framework:\u003C\u002Fp>\n\u003Cdiv class=\"kv-doc-table\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Data type\u003C\u002Fth>\n\u003Cth>Why you keep it\u003C\u002Fth>\n\u003Cth>Retention approach\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Raw transcripts\u003C\u002Ftd>\n\u003Ctd>Quality review, dispute resolution\u003C\u002Ftd>\n\u003Ctd>Short, fixed period you set and write down\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Lead records\u003C\u002Ftd>\n\u003Ctd>Follow-up on a visitor’s request\u003C\u002Ftd>\n\u003Ctd>Until the lead is resolved, then a defined review point\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Conversations with a human handoff\u003C\u002Ftd>\n\u003Ctd>Continuity for an open support case\u003C\u002Ftd>\n\u003Ctd>Until the case closes, then treat as a transcript\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Analytics on visitor questions\u003C\u002Ftd>\n\u003Ctd>Improving your content\u003C\u002Ftd>\n\u003Ctd>Anonymized, with no contact details attached\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch3 id=\"disclose-it-where-visitors-can-see-it\" tabindex=\"-1\">4. Disclose it where visitors can see it\u003C\u002Fh3>\n\u003Cp>Put a short notice in the chat window that links to your privacy notice. In the notice, state the retention period or the criteria you use to set it, who processes the data, and how to request deletion. Keep the wording simple. Our own guide on \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fchatbot-privacy\" target=\"_blank\" rel=\"noopener\">chatbot privacy tests before launch\u003C\u002Fa> walks through what to verify at this stage.\u003C\u002Fp>\n\u003Ch3 id=\"tell-visitors-what-not-to-type\" tabindex=\"-1\">5. Tell visitors what not to type\u003C\u002Fh3>\n\u003Cp>The greeting message is your first line of defense. Add a line such as: “Please don’t share payment card numbers, passwords or health details in this chat.” Visitors who type sensitive details into a free-text box create retention problems for you. For order questions, the assistant can ask for an order number instead of a full card or address. If the bot needs identity checks, route them to a secure form or a person.\u003C\u002Fp>\n\u003Ch3 id=\"schedule-the-review-and-the-deletions\" tabindex=\"-1\">6. Schedule the review and the deletions\u003C\u002Fh3>\n\u003Cp>Retention policies fail when nobody owns them. Put a recurring reminder in your calendar, monthly or quarterly, to purge old transcripts, check the lead list and reconcile copies in other tools. Our piece on \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fwebsite-chatbot-security\" target=\"_blank\" rel=\"noopener\">website chatbot security controls\u003C\u002Fa> covers the access side: who on your team can see and export conversations.\u003C\u002Fp>\n\u003Ch2 id=\"what-visitors-should-avoid-sharing-with-a-website-chatbot\" tabindex=\"-1\">What visitors should avoid sharing with a website chatbot\u003C\u002Fh2>\n\u003Cp>This list belongs in your help text and your greeting, not only in your policy.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Payment card numbers, bank details and passwords.\u003C\u002Fli>\n\u003Cli>Government ID numbers.\u003C\u002Fli>\n\u003Cli>Health information, unless the business is set up to handle it lawfully.\u003C\u002Fli>\n\u003Cli>Details about other people, such as a colleague’s or child’s information.\u003C\u002Fli>\n\u003Cli>Anything confidential that you would not put in an email to a stranger.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The Springer review mentioned earlier is a reminder that \u003Ca href=\"https:\u002F\u002Flink.springer.com\u002Farticle\u002F10.1007\u002Fs44163-026-02431-5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">a conversation can reveal more than the person typed\u003C\u002Fa>, through inference about interests, health status and emotional state. Short, focused conversations that answer a product or service question are safer for everyone than open-ended ones.\u003C\u002Fp>\n\u003Ch2 id=\"control-what-the-assistant-knows-and-keeps\" tabindex=\"-1\">Control what the assistant knows and keeps\u003C\u002Fh2>\n\u003Cp>Retention is easier when the assistant is built around content you own. An assistant that answers from your FAQs, pages and product feed does not need to store a visitor’s personal life story to be useful. See how to \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fcontrol-chatbot-sources\" target=\"_blank\" rel=\"noopener\">control chatbot sources on your website\u003C\u002Fa> and how to \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fconnect-data-to-chatbot\" target=\"_blank\" rel=\"noopener\">connect your data to a website chatbot\u003C\u002Fa> for the setup side. When you review analytics on what visitors ask, you can aggregate the questions and drop the personal details. Our \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fchatbot-analytics-setup\" target=\"_blank\" rel=\"noopener\">chatbot analytics setup guide\u003C\u002Fa> shows how to do this on a small site.\u003C\u002Fp>\n\u003Cp>Transport matters too. If the widget loads over an insecure connection, retention policy is the least of your problems. See the \u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fchatbot-https-requirements\" target=\"_blank\" rel=\"noopener\">HTTPS requirements for chatbots\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2 id=\"our-perspective\" tabindex=\"-1\">Our perspective\u003C\u002Fh2>\n\u003Cblockquote>\n\u003Cp>We built Konvuno for owners who have a website and no support team, so we think about retention the way those owners do: it has to be something you can manage from a dashboard in a few minutes, not a project for a developer.\u003C\u002Fp>\n\u003Cp>Our view is that the best retention policy starts with what the assistant needs to know. Konvuno answers from your own FAQs, website content and product catalog, and the catalog stays current by syncing from WooCommerce or a Google Merchant or Facebook product feed. Because the answers come from content you control, the assistant does not depend on collecting personal details to be helpful.\u003C\u002Fp>\n\u003Cp>When a visitor does leave contact details, they go into the built-in CRM, where you can see them next to the conversation. Having conversations, captured leads and knowledge management in one hosted dashboard gives you one place to review and clean up, instead of data scattered across inboxes and spreadsheets. That is the practical foundation for any retention routine.\u003C\u002Fp>\n\u003Cp>We also believe you should be able to configure and preview everything before paying. Test what the assistant says about your data, your handoff to a human and your greeting message, then decide. A policy you have actually tried is better than one you only wrote.\u003C\u002Fp>\n\u003Cp>\u003Cem>Konstantin\u003C\u002Fem>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch2 id=\"try-it-on-your-own-site\" tabindex=\"-1\">Try it on your own site\u003C\u002Fh2>\n\u003Cp>If you want an assistant you can configure, preview and manage without developers, Konvuno installs with a single script tag and runs from a hosted dashboard. Plans start at €29 per month for Starter, with Growth at €79 per month and Business at €199 per month, and there is no per-seat pricing. Every plan includes full conversational catalog capabilities.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fcsuxjmfbwmkxiegfpljm.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fblog-images\u002Forganization-42511\u002F1786796293645_konvuno.jpg\" alt=\"Konvuno\">\u003C\u002Fp>\n\u003Cp>You can review the plans and set up your assistant at \u003Ca href=\"https:\u002F\u002Fkonvuno.com\" target=\"_blank\" rel=\"noopener\">konvuno.com\u003C\u002Fa>, then work through the retention steps above before you go live.\u003C\u002Fp>\n\u003Ch2 id=\"faq\" tabindex=\"-1\">FAQ\u003C\u002Fh2>\n\u003Ch3 id=\"how-long-should-a-website-chatbot-keep-conversations\" tabindex=\"-1\">How long should a website chatbot keep conversations?\u003C\u002Fh3>\n\u003Cp>No law sets one number for every business. Choose the shortest period that serves a purpose you can name, write it in your privacy notice and follow it. Keep raw transcripts for a short, fixed time, and keep lead records only while the follow-up is active.\u003C\u002Fp>\n\u003Ch3 id=\"does-a-chatbot-use-my-conversations-to-train-its-ai\" tabindex=\"-1\">Does a chatbot use my conversations to train its AI?\u003C\u002Fh3>\n\u003Cp>It depends on the provider and your settings. Anthropic, for example, says it may use chats for improvement if users opt in, if conversations are flagged for safety review, or if users otherwise explicitly agree. Ask any vendor in writing whether your visitors’ chats are used for training and whether that is on by default.\u003C\u002Fp>\n\u003Ch3 id=\"are-deleted-chats-really-gone\" tabindex=\"-1\">Are deleted chats really gone?\u003C\u002Fh3>\n\u003Cp>Not always immediately. OpenAI says deleted consumer chats are scheduled for removal from its systems within 30 days, unless a legal or security need applies. Check whether your own tools also remove copies in your CRM, email notifications and exports.\u003C\u002Fp>\n\u003Ch3 id=\"do-i-have-to-delete-a-visitors-chat-if-they-ask\" tabindex=\"-1\">Do I have to delete a visitor’s chat if they ask?\u003C\u002Fh3>\n\u003Cp>If the CCPA applies to your business, you must offer a way to submit deletion requests and honor them, with exceptions such as completing a transaction, security, debugging and legal obligations. If you serve EU visitors, the GDPR adds its own rights. Ask a privacy attorney in your state which laws cover your business.\u003C\u002Fp>\n\u003Ch2 id=\"sources\" tabindex=\"-1\">Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fprivacy.claude.com\u002Fen\u002Farticles\u002F10023580-is-my-data-used-for-model-training\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Is my data used for model training? (Anthropic Privacy Center)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fopenai.com\u002Findex\u002Fresponse-to-nyt-data-demands\u002F\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How we’re responding to The New York Times’ data demands (OpenAI)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Flink.springer.com\u002Farticle\u002F10.1007\u002Fs44163-026-02431-5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Systemic privacy risks of personal data exposure through conversational AI (Springer)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Frm.coe.int\u002Fdraft-t-pd-2025-5-rev5-draft-guidelines-on-privacy-and-data-protection\u002F48802e6604\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Draft guidelines on privacy and data protection (Consultative Committee, Council of Europe)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.oag.ca.gov\u002Fsites\u002Fall\u002Ffiles\u002Fagweb\u002Fpdfs\u002Fprivacy\u002Fccpa-nopa.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Notice of Proposed Rulemaking Action, CCPA (California Attorney General)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN-HR\u002FTXT\u002F?uri=CELEX:32016R0679\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Regulation (EU) 2016\u002F679 (EUR-Lex)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fblog.wvelabs.com\u002Fblog\u002Fai-chatbot-design\" target=\"_blank\" rel=\"noopener\">AI chatbot design guide\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"recommended\" tabindex=\"-1\">Recommended\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fwebsite-chatbot-security\" target=\"_blank\" rel=\"noopener\">Stop Data Leaks: 7 Website Chatbot Security Controls for SMBs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fkonvuno.com\u002Fblog\u002Fchatbot-privacy\" target=\"_blank\" rel=\"noopener\">5 Chatbot Privacy Tests SMBs Must Run Before Launch\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>",null,[15],"chatbot data retention",1794110721752]