that's the thing to sort out before the chat answers anything. where does that number go, who sees it, and how long does it stay?
a retune bot can mask those numbers before anything is saved, and before the ai model sees them. it's free if you run your own copy. it runs on your own computer, with an agent that builds what you ask for.
the shop in the video is nordlicht bikes, a bike shop i made up. lea, the visitor, is made up too. a bike shop gets fewer ibans than you will, but the masking is the same.
the privacy tab isn't switched on for new accounts by itself. sign up, then email me to switch it on. once it's on, a privacy tab shows up next to the capture tab, where you pick what the bot asks visitors for. masking starts off, so you switch it on there.
the client types their message and hits send. their own bubble already shows the card number as a short note like [card redacted]. the bot still reads the question around it and answers it.
it masks four kinds of details: card numbers, ibans, email addresses and phone numbers. it checks that a card number is a real card number, so a long invoice number stays as it is. most names get masked too, when they follow words like "i'm" or "my name is".
the masking happens before the message is saved, so the masked version is what sits in your chats. it's also what the ai model gets, and what the bot remembers.
those four kinds are the list. a tax id or a social security number isn't on it. some get masked because they look like a phone number, but don't count on that.
street addresses aren't masked at all. a name typed on its own, with nothing around it, can slip through, unless you switch on the ai name check in the privacy tab.
when the bot asks for an email so you can reply, the answer is kept as typed, because the client gave it on purpose. the privacy notice tells them so.
if clients often type tax ids, add a line to the bot's greeting asking them not to. give them your phone number for those.
the chat opens with a consent card, with your text and a link to your privacy policy. the box stays locked until they agree.
a shield in the chat header shows what's stored. they can download their chat, or delete it, and it's gone from your retune. if they email you instead, you search their email in the privacy tab, export their chats and erase them. every step goes in an audit log.
old chats can delete themselves too, after 7, 30, 90 or 365 days. chatbot consent and data retention has those steps one by one.
it fits a small firm that wants clients to ask the everyday things in a chat. are you open in january, where is your office, what's on your document checklist. it fits best when you'd rather have a card number masked than trust every client not to paste one.
the bot answers from what you give it, like your hours and your document checklist. anything about a client's own situation should end in a call-back.
if you want the wider picture first, what a gdpr compliant chatbot can mean goes through every part of the privacy tab.
if it's useful, take it. if it's missing something, like masking tax ids, tell me.
olive