A DTC brand choosing a private AI implementation partner should ask five questions about its own customer data: where each copy of it will live, who can see it, what gets logged and for how long, whether any supplier can train on it, and how a deletion request reaches every copy. Brand Media Works offers this work, so these questions apply to us too. How to choose a private LLM partner covers the general checklist; this page covers the questions that come from running a store on Shopify, Klaviyo and a support desk.
Where will copies of our customer data live?
A private model is only one place customer data ends up. The pipeline that feeds it, the warehouse, the search index the model reads from, the test sets and the logs all hold copies. Ask the partner to draw that map before the build starts, and to name the owner and the retention period of each copy.
| Data | Where copies can appear | What to ask |
|---|---|---|
| Shopify orders and customer records | Pipeline tool, warehouse tables, search index for the model, test sets | Which fields are copied, and can names, emails and addresses be left out or masked? |
| Klaviyo profiles and events | Pipeline tool, warehouse, segment exports used as prompts | Does consent status travel with the profile, and is it checked before use? |
| Support tickets and chat transcripts | Search index, fine-tuning data, evaluation sets | Are payment details and free-text personal data redacted before indexing? |
| Ad audiences and hashed emails | Warehouse, audience sync tools | Do audience files stay out of the model's reach entirely? |
| Prompts and outputs | Model logs, monitoring tools, the partner's test environment | How long are they kept, in which region, and who can read them? |
Tools in the chain keep their own copies. Fivetran, a common pipeline tool, says its troubleshooting environments use obfuscation and pseudonymization with short retention, and that obfuscated data is retained for 1 week. On Amazon Bedrock, the retention setting applies only in the AWS Region where it is set, and with cross-region inference turned on, retained data is stored in the Region that processed the request. Neither is a problem in itself, but each belongs on the map. Amazon Bedrock vs a self-hosted LLM covers the Bedrock settings in detail.
Who will be able to see it?
Ask how access is enforced, not only whether it exists. Permissions should sit on the data itself, so a person who should not see a customer's record cannot reach it through any screen, search or prompt. Single sign-on, document-level permissions and audit logging that feeds the brand's own security monitoring should all be working before the system goes to the wider team, not added in a later phase.
For a DTC brand, the useful test is role by role. A customer service agent may need order history for the customer in front of them; a marketer building segments may need aggregates but not names; the partner's own engineers may need access during the build and none after it. Ask the partner to show those roles working before launch, and to say when its own access ends.
What gets logged, and for how long?
Two kinds of log matter. The first records who changed what: Airbyte, another pipeline tool, says its Pro and Enterprise Flex plans keep audit logs of who changed workspaces, connections, users and permissions, retained for 365 days. Ask for that kind of trail across the whole build. The second is the content of prompts and outputs, which will include order details and customer messages. Ask where those are stored, how long they are kept, and whether retention can be set to the minimum the use case needs.
Will any supplier train on our customer data?
Ask for the answer in writing for every supplier in the chain, not only the model. Most software terms do not answer it: a 2026 review of the terms of nearly 3,700 software products found that 87% said nothing about whether customer data is used to train AI. The large AI developers are clearer, with 19 of the 25 paid business plans and APIs reviewed stating that customer data is not used for training by default.
A private model on open weights removes the model maker from that question, but the pipeline, monitoring and support tools around it still have terms of their own. The risks of using public AI tools with customer data sets out what the large model providers' terms say.
How does a deletion request reach every copy?
When a customer asks a brand to delete their data, the request has to reach the warehouse, the search index, test sets and any stored prompts. Some stores keep data until someone removes it: OpenAI's platform documentation says objects that are not deleted through the API or dashboard are retained indefinitely. Deletion requests and data residency are not a one-off setup: they need engineering for as long as the system runs, and development firms estimate that meeting standards such as GDPR or SOC 2 adds 15% to 25% to a project's total budget. Ask the partner to show the deletion path working on a test customer before launch.
What should we keep at handover?
The data map, the access roles, the log settings and the deletion procedure should be written down and handed over with the code, prompts and test sets, so the brand can run the system or move it to another partner. AI data security on AWS covers the redaction, access control and logging a brand should expect in its own account, and private AI for business covers when a marketing team needs a private model at all.
Frequently asked questions
Does a private AI partner need access to our Shopify admin?
Usually not to the admin itself. A partner needs read access to the data the use case requires, through an API key or a pipeline scoped to those fields, and that access should end or be handed to the brand when the build is done.
Can customer names and emails be kept out of the model?
Often, yes. Many use cases, such as segmentation or product questions, work on masked or aggregated data. Ask the partner which fields each use case actually needs and to redact the rest before data reaches the model or its search index.
How long should prompt logs be kept?
No longer than the use case and the brand's own policies require. On Amazon Bedrock the retention setting is chosen per AWS Region, and in "none" mode AWS writes no request or response data to durable storage, so the shortest setting is available where the model runs.