Before you install a chatbot, ask the vendor where your visitors' data goes at each stage of its life: what the widget collects, who the conversation is sent to, how it is protected, how long it is kept, and how you delete one person's data when asked. Good answers are specific enough to check. Vague answers ("enterprise-grade security", "fully compliant") are the warning sign.
This list follows a single visitor's message from the moment they type it to the moment it is deleted. For each stage there is a question, what a good answer sounds like, and how SpideyChat answers it, taken from our privacy policy and the product itself. For the wider security side, such as tenant isolation and domain restrictions, see chatbot security questions to ask a vendor.
Stage 1: what the widget collects
Ask: "List everything the widget collects from a visitor, and whether it runs any analytics or ad tracking on my site."
A good answer is a list, not a category. Messages, anything the visitor chooses to share, timestamps, any identifier stored in the browser, and a clear yes or no on tracking.
Red flag: "Only what's necessary," with no list.
SpideyChat's answer: conversations between visitors and your chatbot, including any details a visitor chooses to share (such as an email or phone number left as a lead), plus timestamps and an anonymous visitor identifier stored in the visitor's browser. The widget doesn't load Google Analytics, and our own site analytics don't run inside it, so your visitors aren't tracked by us through the chat.
Stage 2: who the conversation is sent to
Ask: "Which third parties receive conversation text, what exactly do you send them, and why?"
A good answer names the AI provider and the other service providers, and says what is sent: usually the conversation and the passages retrieved from your content to answer it.
Red flag: "We use AI" with no provider named, or a refusal to say what leaves their system.
SpideyChat's answer: to generate a reply, the relevant conversation text and the retrieved passages from your knowledge base are sent to third-party AI providers, for example OpenAI, through their APIs. Hosting, email and payment providers also handle data to run the service, under agreements that limit their use of it. We don't sell personal information.
A follow-up worth asking every vendor: "Is my content or my visitors' data used to train AI models, yours or the provider's?" Get the answer in writing, and check it against the AI provider's own business terms.
Stage 3: how it is protected
Ask: "What is encrypted in transit, what is encrypted at rest, and what certifications do you hold, by name?"
A good answer separates the two kinds of encryption and names each certification, or says plainly that there isn't one.
Red flag: "Bank-level encryption" or "fully compliant" without specifics.
SpideyChat's answer: connections are encrypted with HTTPS. Passwords are hashed, stored credentials such as API keys are encrypted at rest with AES-256-GCM, and the database isn't exposed to the public internet. We don't claim that all stored data is encrypted at rest, and we don't hold SOC 2, ISO 27001 or HIPAA certification. If a certification is a hard requirement for you, that answer matters, and it is better heard now. Our GDPR checklist for a website assistant covers what you still need to do on your side.
Stage 4: how long it is kept
Ask: "How long do you keep conversations, and can I set that myself?"
A good answer is a setting you control, plus what happens to data when you delete a bot or close the account.
Red flag: "Indefinitely" with no way to change it, or no answer about account closure.
SpideyChat's answer: account and content data is kept while your account is active. In Settings, under Visitor data, you can set a retention period in days, and conversations older than that are deleted automatically by a daily job. By default nothing is deleted, because silently removing a business's history would be worse. When you delete a bot or your account, the associated data is deleted or de-identified within a reasonable period, except where the law requires us to keep it.
Stage 5: finding and deleting one person
Ask: "If a visitor asks what you hold about them, or asks for it to be deleted, how do I do that?"
A good answer is a tool, not an email to support: search by the visitor's email or phone, export what is held, delete it for real.
Red flag: "Contact us and we'll look into it," with no timescale.
SpideyChat's answer: in Settings, under Visitor data, you can look a visitor up by email, phone or visitor id, export what is held about them as a file, and erase it. Erasure deletes the records rather than hiding them. When you run the chatbot, you are the controller of your visitors' conversation data and we process it on your behalf, so these requests usually come to you first.
Stage 6: what you put in
The last questions are for you, not the vendor.
- What is in the knowledge base? Anything you upload may be sent to an AI provider when it is relevant to a question. Leave out staff details, internal pricing notes and anything you wouldn't want processed by a third party.
- Which sites can it run on? A chatbot should only answer on websites you approve. SpideyChat ties each chatbot's license to a set number of websites per plan, explained in chatbot licenses and website limits.
- What will you tell visitors? Update your own privacy notice to mention the chat and its providers.
Ask in writing
Send the six stages as one email and keep the replies. A vendor that answers every question specifically has probably thought about it. One that answers with adjectives probably hasn't.
To check our answers against the source, read the SpideyChat privacy policy in full: it is linked in the footer of every page on this site, it is short, and it is the document these answers come from. Then open a free account and look at the retention and visitor lookup settings for yourself.