What happens to your customer data when you use AI.
Every AI request sends your data to a provider. In the systems I build, each request tells the provider not to store the data and not to train on it.
Where the data goes
When software uses AI, the text it works on leaves your systems. A sales call transcript, a contract draft or a customer email goes to the company that runs the model, and often through a second company that passes the request on.
What those companies may do with the text depends on their terms and on the settings of each request. Some keep requests for a period. Some use them to improve their models.
Two instructions with every request
In a system I build, every AI request carries two instructions. The first allows only providers that do not collect user data. The second allows only providers that keep nothing after they have answered. If no provider meets both, the request fails and is not sent anywhere else.
The same two instructions apply when the system indexes your documents so the AI can search them. That step sends text to a provider too.
InkDraft, my product for proposals and contracts, runs with these settings.
Web research is limited by default
Some systems look things up on the web, for example a client's website. By default I keep words from your own data out of those searches. They go to the search service only if you switch that on. You can also switch web research off.
For stricter requirements
Some companies may not send data to a public AI service at all. For them the system runs on a self-hosted model. InkDraft can run that way.
Four questions for any AI vendor
- Which companies receive our data, including the ones behind your product?
- Is it stored there, and for how long?
- Is it used to train models?
- Can we switch storage and training off, and is that the default?
Questions
Does Swiss data protection law apply to AI tools?
Yes. The Federal Data Protection and Information Commissioner stated in May 2025 that the Data Protection Act applies directly to AI. A provider that processes personal data for you is a processor under Art. 9: it may only do what you could do yourself, and you have to make sure it can keep the data secure.
May customer data go to a provider abroad?
Under Art. 16 of the Data Protection Act, personal data may go to a country that the Federal Council has found to offer adequate protection. The list in the Data Protection Ordinance includes all EU states and the United Kingdom. The United States is on it only for companies certified under the Swiss-US Data Privacy Framework, in force since 15 September 2024. For other recipients you need safeguards such as standard data protection clauses.
Do providers train on data sent through their API?
That depends on the provider and the service. OpenAI, for example, states that data sent through its API is not used to train models unless the customer opts in, and that logs are kept for up to 30 days by default. Read the terms of the exact service you use, because a chat app and an API of the same provider can differ.