Customer History in AI-Drafted Replies: What Data Is Safe to Use Under GDPR

BOTrento Team8 November 20267 min read

Why customer history makes AI drafts better

An AI with no context writes generic replies. An AI that sees the last quote, the date of the previous event or the promise you made last week writes a reply that sounds like someone who remembers the customer.

Typical examples for an agency or equipment rental firm:

• A repeat customer asks for the same setup as last spring. The draft can refer to the earlier spec instead of asking everything again.
• A buyer went quiet after a quote. The draft can follow up on the exact open point.
• You said "I'll get back to you by Friday". The draft can acknowledge it.

None of this needs the customer's whole file. That is the key point of the rest of this article.

What counts as personal data in a B2B enquiry

Many teams assume B2B means GDPR does not apply. It does. A named contact at a company, their email address and their phone number are personal data, even if the relationship is purely commercial.

Usually fine to use for a reply

• Contact name, role and business email
• The enquiry text and your earlier replies on the same subject
• Previous quotes and orders relevant to the request
• Agreed deadlines and promises

Think twice, or leave out

• Internal notes about a person's character or mood
• Health, family or other sensitive details that slipped into an email
• Unrelated threads with the same customer
• Payment problems, disputes or complaints, unless the reply is about them
• Private phone numbers or personal social profiles

Data minimisation: the rule that does the work

GDPR expects you to use only the personal data you need for a stated purpose. For AI drafting, the purpose is replying to this enquiry. So the question to ask for every piece of history is: would a colleague need this to write this reply? If not, the AI does not need it either.

Minimisation also helps quality. A model given three relevant messages usually writes a sharper draft than one given a year of noise.

The legal basis for handling enquiries and quotes is usually the steps taken before or under a contract, or legitimate interest, but the right basis depends on your situation. Confirm it with your own advisor and keep it consistent with your privacy notice.

Checklist: before you feed history into an AI

1. Define the purpose. Drafting replies, quotes and follow-ups to enquiries.
2. Limit the scope. Same customer, same topic, recent period.
3. Strip what is not needed. Notes on personal matters, sensitive details, unrelated threads.
4. Check your privacy notice. Does it say customer correspondence may be processed by service providers, including AI tools?
5. Get processor terms. A data processing agreement with the vendor, and clarity on any sub-processors.
6. Ask where processing happens. Storage location and model processing are different questions. See what EU server hosting does and doesn't cover.
7. Keep a human in the loop. A person reads and approves every draft before it goes out.
8. Set retention and deletion rules. Know how to export and delete data when a customer asks or you leave the tool.

For the vendor side, the GDPR checklist for AI sales tools and the article on seven questions to ask a vendor before you sign go deeper, so we won't repeat them here.

Processor agreements and what to ask for in writing

If an AI tool handles your customers' personal data on your behalf, the vendor is normally your processor. You are the controller and remain responsible for the data. In practice, ask for:

• A data processing agreement
• A list of sub-processors, including the language model provider
• Confirmation that your data is not used to train models
• Where data is stored and where text is processed by the model
• How export and deletion work at the end

Be wary of the phrase "data stays in the EU". Storage on an EU server is not the same as closed processing if the tool calls an external AI API. Ask the question directly. The article on choosing an EU-hosted AI sales assistant shows how to read these claims.

Also remember your AI Act role. If you use AI for drafting, you are mostly a deployer: train your people, be open with customers and leave decisions to a person. See the AI Act overview for small businesses.

How BOTrento handles customer context

BOTrento Chief of Staff is a managed process for enquiries and quotes. It watches enquiries in your mailbox and in the data you upload, then prepares draft replies, quotes and follow-ups in four languages, using the text of the relevant emails. It does not read attachments.

• Nothing is sent without approval. A person reviews every draft. BOTrento sends nothing itself.
• Only text needed for the task goes to the language model, through a commercial provider's API. Commercial API providers do not use the data for training.
• Storage is on servers in Germany (EU). Because the model is called through an external API, this is not closed processing, and we say so plainly.
• Your own API key is optional. Today that means Anthropic (Claude). Keys are encrypted and can be removed at any time. See the help page on API keys.
• AI is included in the plan, with a monthly usage limit. You can compare plans on the pricing page.
• Exit is clean: export of data and outputs, and agreed removal of access and copies.

It does not replace your CRM or accounting. Keep using Pipedrive, HubSpot, Xero or QuickBooks for that. You can load CRM or spreadsheet data as CSV/XLSX, so you decide how much history goes in. Gmail, Google Workspace and Microsoft 365 connect by forwarding or import for now. Other mailboxes connect via IMAP.

Test it on your own data, deliberately small

The 14-day free trial needs no card and no API key of your own. The 14 days start with your first successful data upload, and you have 7 days to prepare. A person from our team contacts you within 24 hours on working days and helps connect your mailbox.

A sensible way to test the privacy side: upload one mailbox or one export limited to recent enquiries, check whether the drafts use the history you expected, then decide what else to add. Our process demo shows what a draft and the morning overview look like.