A Buyer's Checklist for Chatbot Privacy and Hosting
An Australian website address does not tell you where chatbot data is processed. Use this checklist to ask a provider concrete questions about the service you are considering.
By AI Chatbot Australia · Updated
Map what information goes where
Ask what the chatbot collects, which information is needed for its task and where an enquiry is sent. Consider the website interface, management account, AI provider and any connected system separately. A diagram or written data-flow explanation can reveal assumptions before they become a problem.
Ask about locations and providers
- Where is conversation information stored?
- Which providers process prompts or responses?
- Do any subprocessors operate in other countries?
- Which arrangements apply to the exact plan or project?
- What evidence supports any local-hosting or certification claim?
Check access and retention
Clarify who can access conversations, how account permissions are managed and what happens when someone leaves the team. Ask about retention and deletion, including exports and backups. A provider should distinguish what the software supports from the business processes needed to use it responsibly.
Plan the content and human handover
Data protection is only part of a useful chatbot. Decide what information it may use, which questions it should not answer and how visitors reach a person. Avoid entering health, financial or other sensitive records into a general demonstration.
Use current authoritative guidance
The OAIC explains what a privacy policy should help people understand. The requirements relevant to your organisation depend on its circumstances; a checklist is not a legal compliance assessment.