Privacy and your obligations
What your Aijent collects, what you need to tell your visitors, and the rules changing in 2026.
Your Aijent stores the conversations visitors have with it, plus any name, email, phone or company they give. It does not build profiles or track people across other websites. Two dates matter in 2026: from 2 August in the European Union people must be told they are talking to an AI at first interaction, and from 10 December in Australia privacy policies must disclose AI used in decisions that affect people.
This is guidance, not legal advice
We can tell you exactly what your Aijent does with data, which is the part you cannot easily find out yourself. What you are obliged to do about it depends on your business, where your customers are, and your own circumstances. For anything that matters, get proper advice.
What your Aijent collects
- What visitors type. The whole conversation, kept against your account so you can read it, export it and pass it to your CRM.
- Details they choose to give. Name, email, phone and company, when they offer them or when your Aijent asks.
- Nothing else about them. Your Aijent does not build a profile, track people across other websites, or buy in data about them.
You control how long you keep it. If you delete a conversation, or close your account, it goes.
What you should tell your visitors
Whatever your obligations turn out to be, three things are worth saying plainly in your own privacy policy, because they are true and easy to state:
- That you use an AI assistant on your website, and that conversations with it are recorded.
- What you do with what it collects, which is usually that you use it to respond to enquiries and that it may be stored in your CRM.
- Who else is involved. Your Aijent is provided by Aijency, and running it involves a small number of service providers. Ask us and we will give you the current list for your policy or a DPA.
The rules are changing, and two dates matter
From 2 August 2026, in the European Union, people must be told they are interacting with an AI, at the point they start interacting, rather than in a policy they will never open. If you have European visitors, this applies to you.
Two practical ways to cover it, and doing both is better than either.
Set a privacy policy address in your Aijent's settings. When you do, a small line appears at the bottom of the chat linking to it. Worth doing anyway.
Say it in your greeting. Something like "Hi, I'm Alex, an AI assistant for Acme" makes it unmissable and costs you nothing. People generally do not mind talking to an AI. They mind finding out afterwards. Set it in your greeting.
From 10 December 2026, in Australia, privacy policies must disclose where AI is used to make, or substantially inform, decisions that affect people. If your Aijent screens or qualifies visitors, that is worth reviewing against your policy.
Also in Australia, the long-standing exemption for small businesses is being removed, so many businesses that were previously outside the Privacy Act will now need to comply with the Australian Privacy Principles. If you have relied on that exemption, this is the year to check.
If you screen visitors, read this twice
Visitor Screening and SureGate make automated judgements about people. That is exactly the kind of thing the Australian change is aimed at. It does not mean you cannot use them. It means your privacy policy should say that you do.
Practical things you can do now
Say it in your greeting. Naming your Aijent as an AI takes one sentence, removes any argument about disclosure, and costs you nothing in trust. People generally do not mind talking to an AI. They mind being misled about it.
Link your privacy policy where visitors can find it.
Do not put highly sensitive information in your knowledge base. Your Aijent answers from what you give it, so only give it what you are comfortable being said to a stranger.
Decide how long you want to keep conversations and delete accordingly.
Ask us for the details you need. If you are filling in a privacy assessment, a DPA, or a customer's security questionnaire, get in touch. Tell us what has been asked and we will answer it directly rather than leaving you to guess.
Where your data lives
Your database is in Australia. Running your Aijent involves a small number of specialist providers, for:
- Hosting
- The database
- Generating replies
- Reading your website
- Payments
See security.
If a visitor asks you to delete their data
Find the conversation in your analytics and delete it. If you need help locating everything relating to one person, get in touch with their email address and the approximate date.