You will collect more than you intended
Free-text input means people supply whatever they think is relevant: account details, health information, other people’s names. You did not design a field for it and you are holding it anyway, in conversation logs.
1. Decide retention before you accumulate
How long conversations are kept, in what form, and who can query them. This is far easier to set at launch than after three years exist, and it belongs alongside the decision about what to do with the data the feature generates.
2. Separate the useful signal from the raw text
Most of the value is in patterns — which questions failed, which answers were corrected — not in verbatim messages. Extracting that and retaining less of the original reduces exposure without losing the benefit.
Keep what teaches you something. Delete what only creates liability.
3. Know where processing happens
Which provider, which region, what they retain, and whether it may be used for training. These are contractual answers you need before you can make commitments to your own customers — the same diligence as any dependency on someone else’s model.
4. Make deletion actually possible
If a customer asks you to delete their data, conversation logs, retrieval indexes, and evaluation sets all count. Systems that cannot delete from all three have created a promise they can’t keep — and logs are the usual forgotten copy.
Redact at the boundary
Stripping obvious identifiers before storage costs little and removes most of the risk. It is not a complete control, and it is a much better position than retaining everything by default because nobody decided otherwise.