You Gave Away the List
The AI is the part on the website. The clause that hands over your customer list is on page nine.
A vendor wants to connect their AI to your customer list. You say yes, because that is the entire point. The thing cannot answer your phone or chase your follow-ups unless it can see who your customers are. So you click connect. What you just did, in the language that actually governs it, is hand a company you have never met a copy of every name, number, and conversation your business owns, under terms you did not read. The AI is the part they put on the website. The data clause is the part they put on page nine.
I wire these tools into other people's businesses for a living, and the data terms are the part I slow down for. Not because they are interesting. Because that is where the real deal is. The marketing page says "we take your privacy seriously." That sentence is not in the contract and cannot be enforced. The thing that can be enforced is the clause three scrolls down that says they may use "customer data" to "improve and develop our services." Translate it: your customers' information helps train their product, and you agreed to that by clicking a button that said connect.
Here is why it lands on you specifically, not in the abstract. Your customers did not give their phone number to a software company in San Francisco. They gave it to you. They trusted the window cleaner, the accountant, the clinic, the shop with their name on the sign. Somewhere on your own site there is probably a line promising you respect their privacy, and you meant it. Then you plugged in a tool, moved their records into it to make the automation work, and quietly turned that promise into something you can no longer keep. Not on purpose. That is exactly the problem. Nobody told you the connection was also a disclosure.
"We don't sell your data" is not the same promise as "we don't use it." Read which one is actually in the contract.
The gap between those two sentences is where the whole game lives. Selling data is gauche, and most reputable vendors genuinely do not. Using it is standard, and most of them absolutely do. Your records can sit on servers in a country you cannot name, get processed by subcontractors you never approved (the word is subprocessors, there is always a list, and the list is always long), feed a training run, and stay retained after you cancel, with not one line of that counting as a "sale." The vendor keeps a spotless privacy page. They also keep your customer list.
The failure I have watched up close is not a dramatic leak. It is quieter than that. A business connects an AI tool to their email and CRM to automate follow-ups. Works great for months. Then they switch vendors, cancel the old one, and assume the data walked out the door with the login. It did not. There is no delete button, because deletion was never in the terms, only "retention for legitimate business purposes," which carries no end date. The customer list now lives in two companies' systems, one of which you no longer pay and can no longer reach. When that company gets acquired, or breached, or served with a subpoena, your customer does not hear the vendor's name. They hear yours, because it was your form they filled out.
And "the software did it" is a defense that holds up with nobody. Not a customer, not a state privacy regulator, not the insurer reading your policy after a breach. In the law you are the data controller. That term means what it sounds like: the responsibility is yours. The vendor is a processor acting on your instruction, and "connect it to everything" was the instruction you gave.
So before you connect an AI tool to anything real, do one unglamorous thing. Find the data-use clause. Not the privacy page, the actual terms or the data processing agreement. Then put three questions to the vendor and make them answer in writing, because a sales call is not a contract. Do you train your models on my data or my customers' data, yes or no. Who are your subprocessors, and where does the data physically live. When I cancel, is my data deleted, on what timeline, and will you confirm it in writing.
Watch what happens when you ask. A vendor who has actually sold to businesses that care has these answers loaded, because enterprise buyers have been grilling them for years and they are sick of it. A vendor who waves you off with "we are fully compliant" or "security is our top priority" is hoping you will not go read the thing that contradicts the brochure. Compliant with what, exactly. Name the standard or it is just a mood.
I sell this stuff, and I am telling you the connection is the risky part, not the robot. The AI answering your phone is a novelty. The copy of your customer list it needed to do that is an asset you may have given away, possibly for good, to a company your customers will never hear of and will absolutely blame you for. Automate anyway. Plenty of it earns its keep. Just read the clause that decides who owns the thing your business is actually made of, which was never the software.
It was the list.