Customer memory

What the AI employee may remember about a known customer between conversations: a few lasting facts, never sensitive ones, and only once the shop has switched it on.

Customer memory is off for every workspace until the platform team, or the agency that looks after the workspace, switches it on — after the workspace has signed the data processing agreement that covers it. Until then nothing is stored, and nothing in this page happens.

Who is a known customer

Only someone whose identity was proven: a customer who writes on WhatsApp (the channel verifies the number), or a customer signed in to the shop whose id the shop's own server signed with the workspace's identity secret (Identify signed-in customers); soon also one who confirmed their e-mail address with a code in the chat. A name or an address a visitor merely types is never enough — it may be someone else's.

Three levels of trust

Every chat session gets a level when the widget starts, carried in the session's signed token, so nothing later has to look it up again:

Level	Who	What may happen
0 — anonymous	A visitor with a cookie and nothing else.	The conversation as it always was.
1 — named by the page	The page put a name or an address in window.aiAssistantUser without a valid signature.	The lead form is pre-filled with them, nothing more. Anyone can write a name in a page, so it is a hint, not an identity: no contact is made, no earlier conversation resumes, and no fact or order ever appears — also when the address belongs to a known customer.
2 — proven	The site's server signed the customer's id (signed-in customers), or — coming — the customer confirmed their e-mail address with a code in the chat.	The contact and their conversations on every device; and, once those parts ship, their facts and orders in the answers.

What is kept

• At most 20 short facts per customer that help answer them later: sizes and fit, preferences, what they own or ordered, an open return or question, how they like to be addressed. Each fact says where it came from (the conversation) and when.
• A fact is forgotten twelve months after it was last confirmed or used; when the 20 are full, the fact that was used (or learned) longest ago goes first.
• How the customer likes to be spoken to (language, formal or informal, short or long answers), once that is known.

What is never kept

Anything about health, religion, politics, finances (income, debts, benefits), sexuality, ethnicity, union membership or criminal matters, and never passwords, codes or payment details. Two checks: the model that reads the conversation labels such facts, and a word list in Dutch, English, German and French checks every fact again on its own. A fact is kept only when both say it is harmless; the rest is dropped and only counted.

When it happens

Ten minutes after a conversation of a known customer has gone quiet, a job reads its new messages against the facts already known, merges them (a new fact can update an old one) and stores the result. Nothing runs while the visitor is chatting, and a test chat from the dashboard is never read.

Orders

A proven customer's last five orders come from the shop itself, not from memory: when their chat starts, a job fetches them from the shop system and keeps a copy for ten minutes while they type; the reply reads that copy only, so a slow shop never slows an answer. Nothing is stored beyond those minutes, and nothing is fetched for a visitor the page merely named (level 1) or for a stranger.

• WooCommerce: through the WordPress plugin's signed order endpoint — the one the lookup_order tool already uses; no extra setting.
• Shopify: through the Admin API with a custom app's access token, pasted under Integrations › Shopify orders.
• Botble and other Laravel shops: through the Botble plugin's signed order endpoint on the shop itself, signed with the workspace's identity secret; the plugin ships with the Botble work.

Each order: number, date, status, total, the items with their variant and quantity, the tracking link and — where the shop reports one — a return in progress. Never the address or the payment details. The lookup_order tool also recognises a customer signed in through the signed identity, not only the WordPress shopper token.

What the customer and you see

For now, nothing yet: this page describes the foundation. The AI employee does not use the facts in its answers yet, and the dashboard does not show them yet — both follow, with a page per customer, a "what do you know about me?" answer in the chat and a "forget me" that deletes everything at once.

Forgetting

• Expired facts are removed every night.
• A data subject request that erases a visitor also deletes the customer records (identities and facts) of the conversations that visitor had; the conversations keep their text without a link to anyone.

Switching it on

• Agency: the client's Access page in your partner dashboard has a Customer memory section with the switch — once that client's data processing agreement is signed.
• Platform team: Admin → Workspaces → the workspace, Customer memory. Each change is in the audit log.
• The shop itself: Settings → General shows whether it is on; the shop cannot switch it on by itself.