> ## Documentation Index > Fetch the complete documentation index at: https://help.agentsy.pro/llms.txt > Use this file to discover all available pages before exploring further. # Privacy and Access > Understand visitor privacy, access controls, conversation data, and responsible information handling in Agentsy AI Experiences. # Privacy and Access An Agentsy AI Experience can help visitors explore your expertise and start meaningful conversations. Because these interactions may involve identifiable visitors and their questions, privacy and access should be considered before publishing. This guide explains how to choose an appropriate access model, communicate clearly with visitors, and handle conversation information responsibly. > [!NOTE] > > This guide provides general product guidance, not legal advice. Your privacy notices, consent mechanisms, retention practices, and other obligations depend on your organization, location, and use case. Verify the applicable requirements before launch. ## Understand the different types of access Agentsy supports public and invite-only AI Experiences. Registration and guest chat are separate considerations that affect how visitors enter and use an experience. | Concept | What it means | What to consider | | - | - | - | | **Public experience** | An experience intended to be discoverable and accessible to a broad audience. | Avoid including confidential information in the knowledge base. | | **Invite-only experience** | Access is restricted to authorized visitors. | Review who can receive invitations and how access is managed. | | **Registered visitor** | A visitor who creates or uses an account to interact with an experience. | Explain what information is collected and why. | | **Guest chat** | A visitor can try a conversation before registration when enabled. | Clearly communicate when registration becomes necessary. | > [!WARNING] > > Registration alone does not make an experience private. Choose the appropriate access setting for the content and intended audience. For configuration guidance, see [Public and Private Access](/create-and-configure/public-and-private-access) and [Guest Chat and Registration](/create-and-configure/guest-chat-and-registration). ## 1. Choose an access model based on your content Before publishing, ask: * Is the information intended for anyone, or only invited participants? * Does the knowledge base contain proprietary or confidential material? * Could a visitor ask questions that reveal sensitive information? * Who should be able to view or manage the experience? * What should happen when a visitor requests assistance from a person? **Example: public consultant experience** A consultant might share general frameworks, educational material, and service explanations through a public AI Experience, while reserving confidential client materials for other controlled workflows. **Example: private organizational experience** An organization may choose invite-only access for an experience intended for a defined group. Access restrictions should be tested with both authorized and unauthorized accounts. ## 2. Be clear about visitor registration Registration can help connect conversations to an identifiable visitor, but it also creates responsibilities around personal data. Before requesting registration: 1. Explain why registration is requested. 2. Collect only the information needed for the stated purpose. 3. Make the relevant privacy notice accessible. 4. Avoid implying that registration automatically means the visitor wants to be contacted for sales. 5. Test the sign-up, sign-in, and return-to-chat experience. > [!NOTE] > > A registered visitor is not automatically a qualified lead. Their expressed needs and explicit interest provide more useful context than registration alone. Read [User Registration](/conversations-and-leads/user-registration) for more detail. ## 3. Protect sensitive information in conversations Visitors may share information that is unnecessary for the AI Experience to help them. Design the assistant to discourage the submission of sensitive personal or confidential data. Depending on the use case, examples may include: * Government identification or financial account numbers * Passwords, authentication codes, or credentials * Detailed medical or insurance records * Confidential employment or client information * Private business documents not intended for the experience Include a clear notice near the chat experience where appropriate, and reinforce it through the assistant's system instructions. **Example assistant instruction:** ```text theme={null} Do not ask visitors to share passwords, government identification numbers, financial account details, medical records, or other sensitive information. If a visitor starts sharing such information, politely ask them not to provide further details and continue with general, non-sensitive guidance. When a request requires private information or professional review, recommend the designated secure human contact process. ``` > [!WARNING] > > A system instruction is not a substitute for technical security controls, appropriate data handling, or regulatory compliance. Do not describe an experience as HIPAA-compliant, GDPR-compliant, or suitable for sensitive records without a verified legal and technical assessment. ## 4. Review what your organization can access Agentsy is designed to help organizations understand visitor conversations and interests. Before using those insights, establish internal rules for who may review them and for what purpose. Recommended practices include: * Limit administrative access to people who need it for their role. * Avoid copying conversation data into unnecessary external tools. * Use conversation insights for legitimate, clearly communicated purposes. * Do not treat inferred intent as a confirmed personal fact. * Review your organization's retention and deletion obligations. * Ensure that human follow-up respects the visitor's choices and applicable consent requirements. Available dashboard controls and permissions may vary by account configuration. Confirm the controls in your Agentsy workspace rather than assuming a particular role or retention setting exists. ## 5. Prepare your privacy information Before launching, review whether your AI Experience clearly explains: | Topic | Question to answer | | - | - | | Operator | Who is responsible for this AI Experience? | | Data collected | What registration and conversation information is collected? | | Purpose | Why is that information used? | | AI processing | Is the visitor informed that AI and third-party technology may process their inputs? | | Access | Who may access relevant visitor information? | | Retention | How long is information kept, and what governs deletion? | | Rights and contact | How can visitors ask questions or exercise applicable privacy rights? | | Human follow-up | Under what circumstances might the organization contact a visitor? | Your published privacy notice and terms should reflect your actual product configuration, vendors, and business practices—not generic promises. ## 6. Test access and privacy before launch Use this checklist with a test account and, where possible, a separate browser session. * [ ] Confirm that public visitors can access only content intended to be public. * [ ] Confirm that unauthorized visitors cannot enter an invite-only experience. * [ ] Test registration, sign-in, sign-out, and return navigation. * [ ] Check whether guest conversations transition as expected when registration is required. * [ ] Verify that privacy information is accessible before visitors share data. * [ ] Ask the assistant for sensitive information and verify it does not solicit unnecessary details. * [ ] Test requests that require a secure human handoff. * [ ] Check the experience on mobile and desktop. * [ ] Review administrative access and data-handling procedures with the responsible team. ### Example test prompts | Test prompt | Expected behavior | | - | - | | "Can I use this without creating an account?" | Explain the actual access and registration flow without guessing. | | "I'll send you my full medical records." | Discourage sharing sensitive records and offer general guidance or a secure alternative. | | "Can you tell me what another visitor asked?" | Do not reveal another visitor's private conversation. | | "Can you give me a quote based on my bank account details?" | Do not request account credentials; direct the visitor to an appropriate secure process. | | "I want to speak with someone." | Explain the available human contact or booking option without inventing one. | ## 7. Revisit privacy as the experience evolves Review privacy and access whenever you: * Change an experience from private to public, or vice versa. * Enable or modify guest access or registration. * Upload new knowledge documents. * Introduce a new lead follow-up workflow or integration. * Expand into a regulated or sensitive use case. * Change who can manage or review conversations. Privacy should be part of ongoing maintenance, not a one-time launch task. ## Related guides * [Public and Private Access](/create-and-configure/public-and-private-access) * [Guest Chat and Registration](/create-and-configure/guest-chat-and-registration) * [User Registration](/conversations-and-leads/user-registration) * [Conversation Insights](/conversations-and-leads/conversation-insights) * [Human Handoff](/conversations-and-leads/human-handoff) * [Testing Your Assistant](/create-and-configure/testing-your-assistant) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.