Your own chatbot transcripts: are they licensable?

Who owns chatbot transcripts?#

Chatbot transcripts are usually treated as the deploying company's records, but ownership alone does not settle whether they can be licensed. The vendor agreement, the privacy notice and your customer contracts each set limits, and any one of them can narrow what is possible.

Start with the vendor agreement. Look for how it defines your data, whether the vendor takes a license to use transcripts to improve its own service or models, what export rights you have, and what happens to transcripts when the contract ends. If the bot calls a third-party model, that provider's terms on inputs and outputs matter too.

This is general information, not legal advice. Privacy laws, and in some states wiretap or eavesdropping laws that require every party's consent to a recorded conversation, may apply to chat records, particularly where a third-party vendor processes the chat. How they apply depends on where visitors are and what they were told, and it is assessed deal by deal with counsel.

Which parts of a transcript carry value?#

The customer side of a chatbot transcript carries most of the value, because it shows how real people describe real problems in their own words. That phrasing, with its typos, half-explained context and follow-up questions, is hard to produce any other way.

The bot's own replies are a different matter. Scripted decision-tree menus repeat the same text in every conversation. Generative replies are another model's output, which buyers tend to discount and which some model terms restrict.

The handoff, where the bot gives up and a human agent takes over, is often the richest part. It marks exactly where automation broke down and shows how a person resolved the case.

What privacy preparation do chatbot logs need?#

Chatbot logs need heavier privacy preparation than most support records, because visitors type freely into a small box before anyone can warn them. Names, email addresses, phone numbers, order numbers and home addresses are common, and some visitors paste passwords or card numbers despite the warning text.

Detection services can catch many of these. An archived version of the Amazon Comprehend developer guide, for example, lists detectable entity types that include names, addresses, emails, phone numbers, card numbers, card security codes and passwords, which shows how wide the problem runs. No tool catches everything, so a human review of a sample remains part of the job.

• 1Drop technical metadata such as IP addresses, device details and cookie IDs unless a buyer has a clear need.
• 2Remove pre-chat form fields that capture name, email and company.
• 3Detect and remove contact details, account and order numbers, credentials and payment data.
• 4Replace human agent names with consistent pseudonyms.
• 5Exclude conversations about sensitive topics such as health or legal disputes.
• 6Record what was removed, and how, in the privacy record for the package.

Public website bots, portal bots and internal bots differ#

Chatbot transcripts fall into three groups, and each raises a different rights question. A public website bot talks to anonymous visitors and prospects, so the privacy notice carries most of the weight, and consumer privacy laws such as the CCPA may apply depending on the company and the visitor.

A bot inside a logged-in product or customer portal talks to users at your business customers. Those conversations may be customer data under your subscription agreements and data processing agreements, which often limit use to providing the service. An internal IT or HR helpdesk bot talks to employees, so employee notices and workplace policies decide what is possible.

Keep the three groups separate in any inventory. Mixing them makes it impossible to apply the right limits to each conversation.

Illustrative: a payroll software company reviews its bot logs#

Illustrative: a fictional payroll software company runs a website bot for prospects and an in-app bot for customers' payroll administrators, both from the same messaging vendor. When it decides to switch vendors, the general counsel asks whether the transcripts are worth keeping and whether they could ever be licensed.

The review finds that the website privacy notice said conversations were used to answer questions and improve the company's service, nothing more. The in-app chats fall under customer agreements that restrict customer data to providing the service, and many of them contain employee pay details pasted in by administrators. The vendor agreement allows full export but grants the vendor rights to use de-identified content for its own product improvement.

The company exports everything before the contract ends and keeps it under its retention policy. On counsel's advice it parks all in-app chats and all website chats collected under the old notice. It then updates the website notice to describe de-identified use for AI development, so website conversations from that date forward, especially handoffs to sales staff, can be assessed later. The vendor's retained rights are noted in the records inventory, so any future rights review starts with the facts in hand.

What to keep before you switch or shut down a chatbot#

Keeping the surrounding records at a chatbot switch matters as much as keeping the transcripts, because a later rights review will ask what visitors were told and how the bot behaved at each point in time. Those answers are hard to rebuild once the vendor account is closed.

• 1A full transcript export, including handoff events, tags and outcome fields.
• 2Each version of the privacy notice and chat banner, with the dates it was live.
• 3Each version of the vendor agreement and any data processing addendum.
• 4Bot configuration history: intents, flows, article sources and model settings by period.
• 5The vendor's confirmation of deletion once the contract ends.

How SourceX approaches chatbot transcripts#

SourceX treats chatbot transcripts as a rights-first record family: in the Rights step of the SourceX five-step transaction, vendor terms, privacy notices and customer contracts are reviewed before any preparation is scoped. A review may end with a narrower scope, such as handoff conversations from a period covered by a clear notice, or with no transcripts in scope at all.

Where a package proceeds, the SourceX Evidence Packet records which notice version applied to which conversations, what was removed during preparation and who authorized release. The supplier approves every step, and nothing is shared during the initial assessment.