AI Chatbots and Donor Privacy: What Canadian Non-Profits Must Know Before Launch

You like the idea of a chatbot answering donors at midnight. Then someone on your board asks, "Where do those conversations go?" and nobody in the room has a good answer.

That's the right question. AI chatbot privacy comes down to a short list of things you can ask any vendor before launch: where the data lives, who can read it, how long it's kept, how consent works, and whether your donors' words end up training someone else's AI. Get clear answers to those and you can launch with confidence.

This is practical guidance, not legal advice. Your situation depends on your province and the people you serve, so check with a privacy lawyer before you finalize anything.

Why donor conversations need extra care

People tell chatbots things they'd never put in a donation form. A donor asks about a memorial gift for their late mother. Someone else wants to know how to leave you money in their will.

Those messages are personal information. Once they're typed into a chat window on your website, your organization is responsible for them, even if a vendor stores them.

Question 1: Where is the data stored?

Get the country in writing. Many chatbot tools store conversations in the United States by default. That isn't automatically a problem, but many Canadian donors and funders expect their data to stay in Canada, and some public-sector partners require it.

If a vendor can't tell you where conversations are stored, treat that as your answer.

Question 2: Who can read the conversations?

With some tools, the vendor's own staff can browse your chat logs. With others, anyone on your team with a login sees every conversation.

Find out who has access by default, and whether you control it. The safest setup is private by default, where even the vendor's staff can't open a conversation unless you allow it.

Question 3: How long is data kept, and can you delete it?

Keeping every chat forever feels harmless until someone asks you to remove their information. Canadian privacy law generally expects you to keep personal information only as long as you need it.

Good follow-ups:

• Can we set how long conversations are kept?
• Can we delete one person's data if they ask?
• What happens to our data if we cancel?
• Can we export our records before deleting them?

Question 4: How does email consent work under CASL?

Many chatbots offer to collect email addresses. That's useful, but Canada's Anti-Spam Legislation (CASL) sets rules for consent before you send commercial messages. In practice, that means a clear opt-in the person chooses, and a record showing when and how they agreed.

Watch for pre-ticked boxes. An unticked opt-in with a saved consent record is the cleaner approach. If you're building your list through the bot, our guide to email marketing for non-profits covers what to do with those subscribers next.

Question 5: What about PIPEDA and Quebec's Law 25?

PIPEDA is the federal privacy law that covers many organizations' handling of personal information. Whether it applies to your charity depends on your activities, which is a good question for your lawyer. Quebec's Law 25 adds stricter rules for anyone handling Quebecers' information, including clearer consent and privacy impact assessments when data leaves the province.

At a practical level, both point the same way: know what you collect, tell people why, protect it, and be ready to delete it. Canadian storage and good deletion tools make that easier.

Question 6: Do our conversations train AI models?

Some tools use your chat data to improve their AI, so your donors' questions could shape a model other companies use.

You want a plain answer: never. The AI safety guide for non-profits covers the wider risks. If you're still weighing the bigger decision, read the honest checklist on whether your non-profit should use an AI chatbot.

How The Wow Bot answers these questions

We built The Wow Bot in Toronto for Canadian non-profits, so these answers were decided on day one:

• Conversations are stored in Canada and encrypted, so a copy of the database can't be read on its own.
• To write each answer, the question and the relevant parts of your website are processed by our AI providers in the US.
• Chats are private by default. Our staff can't read them unless you allow it.
• We don't use your conversations to train AI models.
• Email sign-up uses an unticked opt-in, with a consent record for each person.
• You set how long data is kept, and you can delete one person's data on request.

It also flags hacking attempts and answers only from your own website content. More on that in why charity chatbots make things up.

What happens if you skip these questions

A donor finds out their private message about a bequest was read by a stranger, or stored somewhere they didn't expect. They don't complain. They stop giving.

Picture the other version. Your bot answers donors kindly at any hour, and their data is stored in Canada, encrypted. When your board asks where conversations go, you have a one-line answer.

Launch with privacy you can explain

Try The Wow Bot on your own site and see the privacy settings for yourself. Start your 7-day free trial. Want help reviewing your setup with a team that knows non-profits? Book a consult with Wow Digital.