Is AI safe with your customer data? What we send, and what we never send
“Will your AI see my customer data?” It is the question we get asked most, and the one that should be asked. We do not answer “don’t worry, it’s safe”. We answer where the data goes, how long it stays, and who can see it.
What customers actually worry about
Not how smart the AI is, but three simpler questions: will my customer list leak, will you train on my data, and who is liable when something goes wrong?
- Does my customer list leave? Ask the back office “which customer bought the most this month”. If that answer has to be computed by a third-party AI, the list can leave your company.
- Will you train on my data? Most SaaS contracts are vague. Ask about the opt-out, the retention period and cross-border transfer.
- Who is liable? Under Hong Kong’s Personal Data (Privacy) Ordinance, the data user — that is you — answers to the regulator. “The AI decided” is not a defence.
Our answer: the numbers stay in your database
The back-office assistant is SQL-first by default. The AI only turns your question into SQL; the counting happens on your own server. What leaves is the question and the column names — never orders, customer names or revenue figures.
For the storefront, only the current product, shipping rules and policy excerpts are sent, and they are de-identified. The API key lives in your own OpenCart database: the call goes from your server to the provider, and we never see the key.
Four pillars, not promises
- Traceable — every action is logged append-only: when, what was asked, which model, whether the database was queried.
- Restrictable — each AI has boundaries: which tables it may read, whether it may write, whether it may call out.
- Stoppable — one switch stops everything, or just one capability.
- Human-approved — price changes, deletions and refunds wait for a person.
Three things we will not claim
- “AI is always safe” — safety is architecture, permissions, logging and contract combined.
- “Local is always safe” — local solves egress, not insider risk.
- “A GDPR module means compliant” — compliance needs records of processing, a DPA, transfer mechanisms and a breach process.
Hong Kong has no standalone AI law at present; it relies on the PDPO, guidance from the Privacy Commissioner, and sector regulators. Roles decide liability: you are the data user, we act as a service provider with obligations in the contract and DPA.
Practical guidance only; not legal advice.
