Is my data shared with AI vendors?

Software is assembled rather than built. A product you buy from one company runs on infrastructure from several others.

A vendor's privacy policy usually describes the layer they operate. The services behind it have their own terms.

That is why a general reassurance is worth much less than a specific list, and why mature vendors publish one.

Ask for the list of third parties in the path, by name. A vendor who has thought about it can produce one.

Ask what each is contractually permitted to do with what passes through, and specifically whether any of them may use it to train on.

Ask whether you get notice before a new one is added, because that clause is what stops the answer changing quietly.

Ask where each runs, if you are subject to any residency requirement. The main database's location says nothing about the speech or language services.

A vendor who answers those four plainly is telling you something about how they operate, whatever the answers turn out to be.

Say a caller to your plumbing company says: "My name is Tom Reyes and my basement's flooding at 88 Carver Road." Follow that sentence through an AI phone system.

First a carrier delivers the sound of his voice. The speech service receives that audio and returns text, so it has now handled his name and address. Next, a language model gets the text along with your brief and drafts the reply. Then a voice service is sent the reply to speak, and if that reply is "Thanks Tom, I've got 88 Carver Road", the voice service has seen both details too. Finally the transcript is written to storage.

That's four or five companies in under two seconds, for one sentence. It's how every product in this category works, ours included, and none of it is improper. It does mean that "is my data shared?" always has the same one-word answer, which is yes. What you can usefully ask is who receives it and what terms they're bound by.

How hard to push on this depends on what comes down your phone line. A plumber's calls contain names, addresses and leaks. That's personal data, but it's close to what a work order already holds. A family lawyer's calls can contain privileged details, and a therapist's can contain health information. Those businesses should take the subprocessor question to their counsel or their professional body before signing with anyone.

Some protections don't depend on any vendor. Tell the assistant not to ask for what you don't need. A booking rarely requires a date of birth, and nothing on a first call requires a Social Security number. If your brief never asks, those details mostly never enter the chain.

Look at your own privacy notice. If your website says you don't share customer information with third parties, that sentence is now inaccurate for phone calls, as it already was for your email provider. A line saying you use service providers to handle calls and messages brings it back in step with reality.

GreetKeeper is new and does not yet publish a subprocessor list. That is a gap rather than a position, and it is better said here than discovered during a review.

Ask us directly and you will get the path described rather than deflected.

It is also why we make no HIPAA claim. Compliance there is contractual and requires agreements with every layer touching patient information, which we do not hold.