What happens to your text and customer details in builder AI

What you type into a builder's AI box leaves your browser. It goes to the maker, and sometimes on to another company's model. So the rule is simple: if you wouldn't post it publicly, don't put it in a prompt.

Where the words go

The UK National Cyber Security Centre explains the basic picture for chatbots. Whoever runs the language model can see your query. The centre says queries are stored and will almost certainly help develop the service or model at some stage¹.

The same centre says a worry people often have is partly wrong. An LLM doesn't, as of that writing, automatically add what you type to its model for others to query¹. The real risks are that staff at the provider or its partners can read queries, and that stored queries may be hacked, leaked or made public by accident¹.

Builders add a layer. Squarespace names OpenAI, Anthropic and Google as partners. It asks users to review those companies' terms and privacy policies². It adds that generated images and text are made with the aid of third-party AI software².

That means one prompt can fall under more than one set of terms. Check the maker's privacy policy, and the partners' policies if they're named.

What a maker may do with your content

Makers publish rules on training their own models. Wix's generative AI policy, effective 1 January 2026, lists user-generated content such as images and page layouts as a data source. It's used under a licence in the Terms of Use. The policy says its data sources may include personal information. It also lists removal of personally identifiable information among the steps for preparing datasets³.

Read your own maker's equivalent. It's usually found in the privacy policy or terms, and it changes. Look for whether your content is used to train models, and whether you can opt out.

Tools that act on your site

Some AI tools don't only write. They act. WordPress.com says a connected external agent can read from and write to your sites using natural language prompts, and that this access stays off until you enable it⁴. It also says its AI tools are entirely opt-in⁴.

Read what a tool can see and change before you switch it on.

What to keep out of the prompt box

Keep these out unless your business's own policy clearly allows it:

• Passwords, API keys and login codes
• Card numbers and bank details
• Customer records, such as names with addresses, phone numbers or order history
• Staff files, health details and anything covered by a confidentiality agreement
• Unpublished plans, contracts and legal advice

The NCSC advises against putting sensitive information into queries for public LLMs¹. A builder's AI isn't always a "public" chatbot, but the habit is a sound one anyway.

Instead, describe the situation in general terms. "A friendly reminder to a customer whose invoice is late" works without a name, amount or account number.

Rules by country

Privacy law differs by country, and by state in some places. This page can't tell you what your business must do with customers' details. Check the official privacy regulator where you trade, and follow your own business's policy.

Staff need a clear rule too. Write down what may go into builder AI, and tell everyone. See also what the AI features do and how to check plans and limits.