Data privacy and AI

Data privacy is foundational to how HoopAI builds and operates AI features. This page explains what data our AI systems access, how it is processed and stored, and what controls you have over your data. It also covers compliance considerations for GDPR and other privacy frameworks. For a broader view of HoopAI’s approach to responsible AI, see AI safety and responsible use.

​

What data AI agents access and process

HoopAI AI agents access different types of data depending on the feature and configuration. Understanding what data flows through your AI agents is the first step toward responsible data management.

​

Conversation data

When a customer interacts with your Conversation AI agent, the following data is processed:

• Message content: The text of messages sent by the customer and the AI agent’s responses
• Contact metadata: Name, email, phone number, and other contact fields stored in your CRM
• Conversation context: Previous messages in the current thread to maintain context
• Channel information: Whether the conversation is happening via SMS, webchat, email, Facebook Messenger, Instagram, or another channel

​

Knowledge base data

Data you upload to your knowledge base is processed and indexed to enable AI agents to answer questions accurately. This includes:

• Documents, PDFs, and text files you upload
• Website content you configure for crawling
• FAQ entries and custom training data
• Business information such as hours, services, and pricing

​

Voice AI data

For Voice AI interactions, additional data is processed:

• Audio recordings: Call audio may be recorded depending on your settings and consent requirements
• Transcriptions: Spoken words are transcribed to text for processing
• Call metadata: Duration, phone numbers, timestamps, and call disposition

​

Action and workflow data

When AI agents trigger actions, they may access:

• Calendar availability for appointment booking
• Pipeline and opportunity data for lead qualification
• Custom field values for personalization
• Workflow trigger data

​

Data retention policies

HoopAI provides configurable retention policies for AI conversation data. Understanding these policies helps you comply with privacy regulations and manage storage costs.

​

Default retention

​

Configuring retention

You can adjust retention settings for most AI data types in your account settings. When data reaches the end of its retention period, it is permanently deleted from HoopAI systems, including backups, within 30 days.

​

Data deletion requests

You can delete specific AI conversation data at any time through the conversations interface or via the API. For bulk deletion requests or account-wide data removal, contact HoopAI support.

​

How knowledge base and training data is stored

Your knowledge base is a critical component of your AI agents. Here is how that data is handled.

​

Storage architecture

• Isolation: Each account’s knowledge base data is logically isolated. Your data is never accessible to other HoopAI accounts.
• Encryption: Knowledge base content is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.
• Indexing: When you upload documents or configure website crawling, the content is processed into vector embeddings for semantic search. These embeddings are stored alongside the source content.
• Versioning: When you update knowledge base content, previous versions are overwritten. Deleted content is purged from the index within 24 hours.

​

What happens when you delete knowledge base content

When you remove a document or data source from your knowledge base:

1. The source content is marked for deletion immediately
2. The associated vector embeddings are removed from the search index within 24 hours
3. The AI agent will no longer reference that content in responses
4. Backup copies are purged within 30 days

​

AI data is not used to train third-party models

Your data is never used to train third-party AI models. This commitment applies to all data types:

• Customer conversation content is not shared with LLM providers for model training
• Knowledge base documents are not used to improve third-party AI systems
• Voice recordings and transcriptions are not shared for speech model training
• Contact data and business information remain within HoopAI systems

When HoopAI processes data through AI models, it is done solely to generate responses for your specific interaction. The data is processed and discarded by the model provider. It does not become part of any training dataset.

​

How HoopAI uses AI providers

HoopAI integrates with leading AI model providers to power features like Conversation AI and Content AI. When your data is sent to these providers for processing:

• Data is transmitted over encrypted connections
• The provider processes the data to generate a response and does not retain it
• HoopAI has data processing agreements with all AI providers that prohibit training on customer data
• No personally identifiable information is shared unless required for the specific AI function

​

User consent considerations

When your AI agents interact with customers, you have a responsibility to obtain appropriate consent for data collection and processing. Here is guidance for different scenarios.

​

Chat and messaging consent

• Inform users that their conversation may be processed by AI before or at the start of the interaction
• Include AI data processing in your privacy policy
• Provide an option for users to request a human agent instead of AI
• Clearly state what data is collected and how it will be used

​

Voice AI consent

Voice interactions require special attention due to recording laws that vary by jurisdiction.

​

Opt-out mechanisms

Provide clear mechanisms for individuals to:

• Opt out of AI interactions and speak with a human
• Request deletion of their AI conversation data
• Access a copy of their AI interaction data
• Withdraw consent for future AI processing

​

GDPR compliance

For businesses operating in the European Union or processing data of EU residents, GDPR compliance is essential. Here is how HoopAI supports your GDPR obligations regarding AI features.

​

Lawful basis for processing

AI data processing in HoopAI can be supported by several lawful bases under GDPR:

• Legitimate interest: Processing customer inquiries and providing support through AI agents
• Consent: Where explicitly obtained for AI interactions
• Contract performance: When AI processing is necessary to fulfill a service agreement

You are responsible for determining and documenting the appropriate lawful basis for your specific use case.

​

Data subject rights

HoopAI provides tools to help you fulfill data subject rights requests related to AI data:

​

Data processing agreement

HoopAI offers a Data Processing Agreement (DPA) for customers who require one under GDPR. The DPA covers:

• HoopAI’s obligations as a data processor
• Sub-processor disclosures, including AI model providers
• Data transfer mechanisms for international data flows
• Security measures and breach notification procedures

Contact HoopAI support or your account manager to request a DPA.

​

Data transfer mechanisms

When AI data is processed by providers outside the EU, HoopAI ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and, where applicable, supplementary security measures.

​

Data residency considerations

HoopAI’s infrastructure is primarily hosted in the United States. This means AI data, including conversation transcripts, knowledge base content, and analytics, is processed and stored in US-based data centers.

​

What this means for you

• If you operate in a jurisdiction with data residency requirements, ensure your use of AI features is covered by an appropriate legal mechanism, such as SCCs or user consent for international transfers
• HoopAI’s DPA includes provisions for international data transfers
• Voice AI call routing may involve processing in multiple regions depending on the call origin and destination

​

Future data residency options

HoopAI is evaluating expanded data residency options for customers with strict requirements. Contact your account manager for the latest information on available regions.

​

Best practices for AI data privacy

​

Next steps