Privacy Questions Buyers Ask About AI Products

If you sell an AI product to businesses, you will meet the privacy questionnaire. It may arrive before the first call or just before signature. It may be a polite email with five questions or a spreadsheet with two hundred. Either way, your answers decide whether the deal goes forward, and slow or vague replies decide it negatively.

The way to handle this is to answer the common questions in advance, in plain words, on a page that buyers can find. This article lists the questions most often asked and shows how to prepare. It is general guidance, not legal advice, and your obligations depend on where you operate and what data you process.

Why AI raises the stakes

All software handles data. AI products add particular concerns. They may send content to a model run by a third party. They may keep inputs to improve the product. They may generate outputs that include or infer personal information. The ICO's guidance on AI and data protection covers principles such as accountability, transparency, lawfulness, accuracy, fairness and the protection of individual rights, and notes that organisations should consider data protection impact assessments when using AI systems. Buyers who know this will ask how you handle each.

Question 1: What data do you collect?

Buyers want a list. Distinguish:

• Content data. What the customer submits: documents, messages, images, recordings.
• Account data. Names, email addresses, billing details.
• Usage data. Logs, features used, performance statistics.
• Derived data. Outputs, embeddings or summaries you create.

For each, say whether it can include personal data, and who controls it. In many arrangements the customer is the controller and the vendor a processor, but that is for contracts and advice to determine.

Question 2: Is my data stored, and for how long?

Give a clear answer by category. For example: "Uploaded documents are stored until you delete them. Prompts and outputs are kept for thirty days for troubleshooting and then deleted. Billing records are kept for the period required by law." If retention depends on plan, say so.

Question 3: Is my data used to train or improve models?

This is often the first question. Be direct. State:

• Whether customer content is used for training your own models
• Whether it is used for evaluation or improvement in any form
• Whether customers can opt out, and how
• What your third-party providers do with data you send them

If the answer differs between free and paid plans, say so. Do not use vague phrases like "we may use data to improve services" without explaining what that means in practice.

Question 4: Who can access my data?

List the roles that can see content: engineers, support staff, subprocessors. Describe controls such as access logging, need-to-know principles and approval steps for support access. If staff can read content only when the customer initiates a support request, say that.

Question 5: Where is it stored and processed?

Buyers care about location because of legal requirements on international transfers and on regional hosting. Say where data is stored, where it is processed, and whether it leaves that region, for instance to call a model provider elsewhere. If you cannot guarantee a location, say so.

Question 6: Which third parties receive it?

Provide a list or categories of subprocessors: cloud hosting, model providers, analytics, email, payments. Explain what each receives and under what terms. Offer a way to be notified of changes.

Question 7: How do you secure it?

Describe your measures in specific terms: encryption in transit and at rest, access controls, multi-factor authentication for staff, vulnerability management, backups and incident response. Name certifications or audits you actually hold, with the scope and date. Do not claim ones you do not have.

Question 8: How can I delete or export my data?

Individuals have rights over their personal data, and customers need to honour them. The ICO explains the right to data portability as the ability for people to obtain and reuse their personal data across services in structured, commonly used, machine-readable formats, applying to data they provided where processing is based on consent or contract and carried out by automated means. Make sure customers can export their data in a usable format and that deletion is possible and explained, including how long it takes and what remains in backups.

Question 9: How do you handle personal data in outputs?

AI outputs can include or infer personal information. Buyers ask whether your system might reveal one customer's data to another, whether outputs can be traced and corrected and how you handle requests from individuals. Explain your isolation between customers, your processes for correction and your approach to accuracy and fairness.

Question 10: What happens if something goes wrong?

Describe your incident process: how you detect problems, how quickly you notify customers, what information you provide and how you learn. Buyers like to hear about regular testing and about past incidents handled well, if you can share them.

Question 11: Do humans review my content?

Say whether staff or contractors review content for quality, safety or support, under what circumstances and with what safeguards. If content may be sampled for review, say how and whether customers can opt out.

Question 12: How do you manage risks of the AI system itself?

Some buyers ask about governance. The NIST AI Risk Management Framework is voluntary guidance aimed at helping organisations manage risks to individuals, organisations and society and incorporate trustworthiness into AI systems. You are not required to adopt it, but being able to describe how you identify, measure and manage risks, such as testing for failure modes and monitoring in use, shows maturity.

Write the answers once, and keep them current

Create a single document with plain answers to all of the above, reviewed by someone who understands your systems and, where appropriate, by a legal adviser. Publish a public version on a clear page. Keep a longer version for security questionnaires. Put a "last reviewed" date on both. When something changes, update the document first and the sales material second.

Make the page easy to use

• Plain language. Avoid heavy legal wording where you can.
• Short sections with headings that match the questions.
• A contact route for specific queries.
• A change log or a notice policy.
• Links to your privacy policy and terms.

A buyer who can find what they need in five minutes is far more likely to proceed. Search engines and AI assistants will also find a well-structured page and can quote it correctly.

Common mistakes

1. Overstating privacy. "We never see your data" when staff can.
2. Burying the training question.
3. Forgetting subprocessors.
4. Inconsistent answers between the website, the contract and the questionnaire.
5. Outdated policies.
6. Delay. A slow reply signals poor organisation.

Using your listing

On a discovery listing, include a short data statement and link to the full page. On this site, the submit page guides you through the details a listing can carry, and the privacy and contact pages explain how this site handles information and how to reach it.

A worked example: answering a questionnaire in an afternoon

Imagine a small company that sells an AI tool for summarising legal documents. A prospective customer, a mid-sized firm, sends a questionnaire with sixty questions. Because the company prepared a data statement in advance, most answers can be adapted from it.

The founder opens the master document and works through the sections: what data is collected, retention, training use, access, location, subprocessors, security, deletion and export, incident response. For each question she copies the relevant paragraph and adjusts the wording. For the six questions she cannot answer immediately, such as whether staff are covered by specific confidentiality clauses, she checks with colleagues and records the answers in the master document so next time it is ready.

She is honest where the answer is less comfortable. When asked whether the company holds an independent security certification, she writes that it does not yet, and describes the measures it has in place and the plan to commission an audit. The buyer appreciates the candour and asks a follow-up question about the plan, which she answers. The questionnaire is returned within a day, and the conversation moves to a pilot.

Review your answers with fresh eyes

Every six months, ask someone outside the product team to read your public data statement as a sceptical buyer. Ask them to mark any sentence they do not understand, any claim that seems too good to be true and any question they expected to see answered but did not. Their notes are a free audit. Combine them with changes in your product and in the law, and update the statement. A statement that is reviewed regularly is evidence of a company that takes the subject seriously.

Frequently asked questions

Should I tell customers if I change a model provider? If it changes who receives their data or the terms, yes, and give notice as your contract requires.

Can I say my product is GDPR compliant? Be careful. Compliance is about how you operate and what you do, not a label. Describe the specific measures instead and take advice.

What if a buyer asks something I cannot answer? Say so, find out and reply promptly. Honesty beats guesswork.