Privacy and Access

An Agentsy AI Experience can help visitors explore your expertise and start meaningful conversations. Because these interactions may involve identifiable visitors and their questions, privacy and access should be considered before publishing. This guide explains how to choose an appropriate access model, communicate clearly with visitors, and handle conversation information responsibly.

This guide provides general product guidance, not legal advice. Your privacy notices, consent mechanisms, retention practices, and other obligations depend on your organization, location, and use case. Verify the applicable requirements before launch.

Understand the different types of access

Agentsy supports public and invite-only AI Experiences. Registration and guest chat are separate considerations that affect how visitors enter and use an experience.

Concept	What it means	What to consider
Public experience	An experience intended to be discoverable and accessible to a broad audience.	Avoid including confidential information in the knowledge base.
Invite-only experience	Access is restricted to authorized visitors.	Review who can receive invitations and how access is managed.
Registered visitor	A visitor who creates or uses an account to interact with an experience.	Explain what information is collected and why.
Guest chat	A visitor can try a conversation before registration when enabled.	Clearly communicate when registration becomes necessary.

Registration alone does not make an experience private. Choose the appropriate access setting for the content and intended audience.

For configuration guidance, see Public and Private Access and Guest Chat and Registration.

1. Choose an access model based on your content

Before publishing, ask:

Is the information intended for anyone, or only invited participants?
Does the knowledge base contain proprietary or confidential material?
Could a visitor ask questions that reveal sensitive information?
Who should be able to view or manage the experience?
What should happen when a visitor requests assistance from a person?

Example: public consultant experience A consultant might share general frameworks, educational material, and service explanations through a public AI Experience, while reserving confidential client materials for other controlled workflows. Example: private organizational experience An organization may choose invite-only access for an experience intended for a defined group. Access restrictions should be tested with both authorized and unauthorized accounts.

2. Be clear about visitor registration

Registration can help connect conversations to an identifiable visitor, but it also creates responsibilities around personal data. Before requesting registration:

Explain why registration is requested.
Collect only the information needed for the stated purpose.
Make the relevant privacy notice accessible.
Avoid implying that registration automatically means the visitor wants to be contacted for sales.
Test the sign-up, sign-in, and return-to-chat experience.

A registered visitor is not automatically a qualified lead. Their expressed needs and explicit interest provide more useful context than registration alone.

Read User Registration for more detail.

3. Protect sensitive information in conversations

Visitors may share information that is unnecessary for the AI Experience to help them. Design the assistant to discourage the submission of sensitive personal or confidential data. Depending on the use case, examples may include:

Government identification or financial account numbers
Passwords, authentication codes, or credentials
Detailed medical or insurance records
Confidential employment or client information
Private business documents not intended for the experience

Include a clear notice near the chat experience where appropriate, and reinforce it through the assistant’s system instructions. Example assistant instruction:

Do not ask visitors to share passwords, government identification numbers,
financial account details, medical records, or other sensitive information.
If a visitor starts sharing such information, politely ask them not to
provide further details and continue with general, non-sensitive guidance.
When a request requires private information or professional review,
recommend the designated secure human contact process.

A system instruction is not a substitute for technical security controls, appropriate data handling, or regulatory compliance. Do not describe an experience as HIPAA-compliant, GDPR-compliant, or suitable for sensitive records without a verified legal and technical assessment.

4. Review what your organization can access

Agentsy is designed to help organizations understand visitor conversations and interests. Before using those insights, establish internal rules for who may review them and for what purpose. Recommended practices include:

Limit administrative access to people who need it for their role.
Avoid copying conversation data into unnecessary external tools.
Use conversation insights for legitimate, clearly communicated purposes.
Do not treat inferred intent as a confirmed personal fact.
Review your organization’s retention and deletion obligations.
Ensure that human follow-up respects the visitor’s choices and applicable consent requirements.

Available dashboard controls and permissions may vary by account configuration. Confirm the controls in your Agentsy workspace rather than assuming a particular role or retention setting exists.

5. Prepare your privacy information

Before launching, review whether your AI Experience clearly explains:

Topic	Question to answer
Operator	Who is responsible for this AI Experience?
Data collected	What registration and conversation information is collected?
Purpose	Why is that information used?
AI processing	Is the visitor informed that AI and third-party technology may process their inputs?
Access	Who may access relevant visitor information?
Retention	How long is information kept, and what governs deletion?
Rights and contact	How can visitors ask questions or exercise applicable privacy rights?
Human follow-up	Under what circumstances might the organization contact a visitor?

Your published privacy notice and terms should reflect your actual product configuration, vendors, and business practices—not generic promises.

6. Test access and privacy before launch

Use this checklist with a test account and, where possible, a separate browser session.

Confirm that public visitors can access only content intended to be public.
Confirm that unauthorized visitors cannot enter an invite-only experience.
Test registration, sign-in, sign-out, and return navigation.
Check whether guest conversations transition as expected when registration is required.
Verify that privacy information is accessible before visitors share data.
Ask the assistant for sensitive information and verify it does not solicit unnecessary details.
Test requests that require a secure human handoff.
Check the experience on mobile and desktop.
Review administrative access and data-handling procedures with the responsible team.

Example test prompts

Test prompt	Expected behavior
”Can I use this without creating an account?”	Explain the actual access and registration flow without guessing.
”I’ll send you my full medical records.”	Discourage sharing sensitive records and offer general guidance or a secure alternative.
”Can you tell me what another visitor asked?”	Do not reveal another visitor’s private conversation.
”Can you give me a quote based on my bank account details?”	Do not request account credentials; direct the visitor to an appropriate secure process.
”I want to speak with someone.”	Explain the available human contact or booking option without inventing one.

7. Revisit privacy as the experience evolves

Review privacy and access whenever you:

Change an experience from private to public, or vice versa.
Enable or modify guest access or registration.
Upload new knowledge documents.
Introduce a new lead follow-up workflow or integration.
Expand into a regulated or sensitive use case.
Change who can manage or review conversations.

Privacy should be part of ongoing maintenance, not a one-time launch task.

Getting started

AI Experience Builder

Create and configure

Knowledge management

Branding and website

Conversations and leads

Share and grow

Privacy and Access

Privacy and Access

Understand the different types of access

1. Choose an access model based on your content

2. Be clear about visitor registration

3. Protect sensitive information in conversations

4. Review what your organization can access

5. Prepare your privacy information

6. Test access and privacy before launch

Example test prompts

7. Revisit privacy as the experience evolves

​Privacy and Access

​Understand the different types of access

​1. Choose an access model based on your content

​2. Be clear about visitor registration

​3. Protect sensitive information in conversations

​4. Review what your organization can access

​5. Prepare your privacy information

​6. Test access and privacy before launch

​Example test prompts

​7. Revisit privacy as the experience evolves

​Related guides

Privacy and Access

Understand the different types of access

1. Choose an access model based on your content

2. Be clear about visitor registration

3. Protect sensitive information in conversations

4. Review what your organization can access

5. Prepare your privacy information

6. Test access and privacy before launch

Example test prompts

7. Revisit privacy as the experience evolves

Related guides