The short answer
An AI agent sees what you open to it: the inbox, calendar, files or apps you connect, nothing more. That data is stored by the agent’s vendor and sent, for the length of a task, to an AI model. Before you connect anything, check four things: which access is requested, where data is stored and processed, whether it trains models, and how to revoke access.
We make Extra, an AI agent platform, so this article is written by an interested party. Facts about other tools and about the law come from the sources listed at the bottom, as of the date shown.
What can an AI agent see of your data?
An AI agent sees only what you give it: the services you connect (inbox, calendar, invoicing tool) and the files you send. It does not browse your computer, and it cannot see an app you never connected. So the real question is less “what can it see?” than “what am I opening to it, and for which job?”
Take a four-person accounting firm that hands its email to an agent. Once Gmail is connected, the agent reads every message in that inbox: client emails, but also bank statements sent as attachments and notes from a partner. That is the price of the service, since an agent that cannot read your email cannot answer it. Which is why you should know, for each connection, exactly what it allows.
| What you connect | What the agent sees | What it can do | Watch for |
|---|---|---|---|
| Inbox | Messages and attachments | Sort, draft, send | Sending: who decides? |
| Calendar | Events, attendees, locations | Suggest, create, move | Personal events in the same calendar |
| Files you upload | The file’s contents | Read, summarize, compare | Data about third parties (staff, customers) |
| Invoicing or bank tool | Invoices, payments, balances | Calculate, send reminders | Anything that moves money |
Where does your data go when an agent works?
Your data makes two trips. First it is stored by the agent’s vendor (and its hosting providers). Then, for each task, the relevant part is sent to an AI model that writes the answer. That model often belongs to another company, such as Anthropic or OpenAI.
That setup is normal, but it should be disclosed. A serious vendor tells you where data is stored, which models process it and in which country. If the answer is vague (“in the cloud,” “securely”), ask for it in writing.
Is your data used to train AI models?
With the major model providers, business use through the API does not train their models by default. OpenAI states that data sent to its API “is not used to train or improve OpenAI models” unless the customer opts in, and that abuse monitoring logs are kept for up to 30 days. Anthropic’s Commercial Terms, effective June 17, 2025, say: “Anthropic may not train models on Customer Content from Services.”
Two caveats. That applies to the API and business plans; a free consumer version of a chatbot can follow different rules. And the agent’s vendor has its own terms on top, which are the ones to read. The FTC has also warned vendors: in a February 2024 post, it said a company that quietly changes its privacy terms to start using customer data for AI training, through a retroactive update to its terms of service, may be acting unfairly or deceptively. Promises made when you signed up are supposed to hold.
Which US rules apply when you share customer data with an agent?
The US has no single federal privacy law for small businesses, but three things still apply. Your own privacy policy is a promise: if it says you share data only with service providers, the agent’s vendor must fit that description. Some sectors have strict rules (health information under HIPAA, financial data under the Gramm-Leach-Bliley Act), so a dental office should not send patient records to a general-purpose agent without a business associate agreement. And several states, such as California, give consumers rights over their data, which means you should be able to find and delete what you shared.
If the agent talks to your customers directly, by phone or message, tell them it is AI. It is the honest default, and an AI voice on outbound calls triggers federal consent rules under the TCPA.
What should you ask before connecting an AI agent?
- Which exact permissions do you request (read only, send, delete)?
- Where is my data stored, and with which hosting providers?
- Which AI models process my data, and in which country?
- Is my data used to train any model, yours or theirs?
- Can I give access to one agent without opening it to the others?
- What can the agent send or pay without asking me?
- Is there a log of what the agent did?
- How do I revoke access, and how do I delete my data if I leave?
A good test: ask to see the screen where you revoke a permission. If it does not exist, neither does the control.
How does Extra handle these questions?
Extra (hello-extra.com), the AI agent platform for small businesses, answers them this way, per its security page and FAQ. A permission applies to one agent and one specific tool: what you open to Pam, the executive assistant, is not open to Jade, the marketing agent. Google access tokens are encrypted, and Extra asks to read and send your email and to read and manage your calendar events, nothing more. Standing permissions are listed in your settings with a “Withdraw” button. The app keeps a log of every action: which tool, which action, when.
On storage, data is kept with Cloudflare and Supabase, mostly in Western Europe, and agents send the content of your requests to AI models (Anthropic, OpenAI) that process it in the United States. If your business needs a signed HIPAA agreement or on-premise hosting, Extra is not the right fit today. Our post on AI agents that ask before they send explains how permissions work day to day.
What data should you never give an AI agent?
Some data should stay out of reach of any agent:
- passwords and banking credentials (an agent never needs them);
- health information about customers or staff, unless the tool is built and contracted for it;
- personnel files (medical leave, discipline);
- anything a contract or professional duty forbids you to share with a vendor.
For the rest, start small: one inbox, one calendar, one agent. Widen access once you have seen, in the log, what it actually does.
Frequently asked questions
Can an AI agent delete my emails?
Only if the access you grant allows it. Look at the list of permissions requested when you connect: read, send and delete are different things. At Extra, the Google access requested covers reading and sending email and reading and managing calendar events.
What happens to my data if I cancel?
Ask in writing before you sign up. A good answer gives a deletion timeline, a way to export your data first, and what remains with model providers (for example, OpenAI keeps abuse monitoring logs for up to 30 days).
Do my customers need to know I use an AI agent?
Your privacy policy should say you use service providers to handle their data. And if the agent talks to them directly, tell them it is AI: it is honest, and it keeps you clear of the consent rules that apply to artificial voices.
Is a free chatbot account safe for business data?
Treat it with care. Consumer plans can follow different data rules from business APIs, and settings change. For anything involving customer or employee data, use a business plan or an agent platform whose terms say your data does not train models, and keep the written proof of those terms.
Key takeaways
- An AI agent sees what you connect, nothing more.
- Data is stored by the vendor, then processed by a model, often in the US.
- OpenAI’s and Anthropic’s business APIs do not train on your data by default.
- Your privacy policy is a promise, and the FTC holds companies to theirs.
- Insist on per-agent access, an action log and a way to revoke.
Read next: what an AI agent does for a small business and Extra pricing.
Sources
- FTC Technology Blog, “AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive,” 02/13/2024
- OpenAI, “Data controls in the OpenAI platform,” accessed 11/03/2026
- Anthropic, “Commercial Terms of Service,” effective 06/17/2025
- Cooley, “FCC Rules AI-Generated Robocalls Illegal Under the TCPA,” 02/15/2024
