What customer data should an AI email assistant be allowed to access?

Give an AI email assistant access for a named task, not a standing invitation to the customer database. A campaign summary may need report totals; an order investigation may need a specific customer record. Neither requires permission to edit subscriptions or send a campaign. Before connecting a tool, record the fields it can read, the actions it can take, who approves changes, and how the receiving provider handles copied data.

An assistant that can answer a question about email performance may also be connected to profiles, orders and campaigns. The useful permission is the smallest one that lets it complete the particular job. The FTC’s general business guidance recommends limiting personal information, access and retention to what the business needs, and reviewing service providers that handle the data. For an email assistant, that means deciding the job before authorizing the connector.

This is a connection decision. If your assistant has already built an audience, use the AI segment audit to check who actually qualifies. If it has already produced a sales story, use the AI report audit to check its numbers and claims.

Match the data to the question

Start with one sentence: “The assistant will ___, and a person will use the result to ___.” Then write down what source data would let a human do that job. If an aggregate answers it, there is no reason to expose individual profiles merely because the connector offers them.

These are example access budgets, not claims about what a given product can technically restrict. A connected assistant may receive broader access than the row calls for. If it does, the permission screen has revealed a decision: accept that broader exposure for this job, choose a narrower connection, or give the assistant a prepared extract containing only what it needs. Do not call a broad grant “limited” because the prompt asks the model to ignore other fields. The grant, rather than the prompt, defines what the connector can reach.

When does it need a customer’s identity?

A campaign trend can often be discussed from counts and rates. A question about one missing order or one suppressed subscriber needs a record that can be matched back to the store or ESP. Keep the identifiable step tied to that investigation: name the record, the fields needed to resolve it and who can inspect the answer. An entire profile export is a different access decision.

Review custom fields before granting profile access. Klaviyo says its ChatGPT app is built for standard marketing data, including customer profiles, orders, segmentation and campaign history, but sensitive information stored in custom profile properties can be returned when the app can read profiles. A field’s home in an email platform does not make its contents safe to share with another service. If a custom property contains information the assistant does not need, remove or mask it from the material you supply, or use a route that does not expose profiles.

The FTC’s guidance also calls for keeping personal information only as long as there is a business need. That matters at the other end of the task: decide whether the assistant needs to keep a customer-level extract or whether a short-lived result and an internal record ID are enough for the person making the decision.

Check what the connection can actually read and change

Permission systems have more than one layer. For Shopify’s official third-party AI integrations, the approved data-access level and the interacting user’s staff permissions both limit what a tool can read or change. The authorization may be read-only or include write access. Check the selected store, account and user role as well as the requested data categories. Shopify says an increase in access prompts a new authorization; a scope already approved can be reduced only by uninstalling and reinstalling the integration.

The Klaviyo app for ChatGPT is a useful example of why the screen deserves a careful read. Its documented scopes include read and write access for profiles, events, segments, campaigns and subscriptions, among other objects. The FAQ notes that a scope does not mean every possible action on that object is available in ChatGPT: the app must support the action too. But if the job is a report summary, a broad write grant is still broader than the job calls for. An Owner, Admin or Manager must authorize the selected account through OAuth; that person should review the requested permissions before selecting Allow.

There may be a narrower setup for a different client. Klaviyo’s agency MCP guide documents an account-specific read-only=true connection option that hides and blocks tools that write or delete data. It also describes connector permission controls in Claude that can block tools, or require approval, for tools that write or delete data. Those instructions describe that MCP setup; do not assume the ChatGPT app, another client or another ESP offers the same control. Check the actual connection you plan to use.

Keep changes and sends behind a separate decision

Reading data, editing an account and contacting customers carry different consequences. A campaign-planning assistant can prepare a recommendation or draft while a person checks eligibility, content and timing. If the job later expands to editing a segment or scheduling a message, review that new permission explicitly.

The same MCP guide says the connector can schedule or send supported campaigns when write actions and permissions allow it. It tells users to review the account, audience, content and send time before confirming. A client approval prompt can create a useful pause, but it still permits the action after approval; a read-only connection blocks the write tools in the documented agency setup. Choose the control that matches the task. For a reporting or drafting job, keep send permission outside the connection.

For any customer-facing action, keep a short decision record: who approved the audience, which version of the content they reviewed and what send time they confirmed. If the assistant changes a segment definition after that review, the previous approval no longer describes the audience that would receive the message.

What happens to customer data after the connection ends?

Revoking access answers one question: can the tool continue to reach the source? It does not, by itself, answer what happened to information already transferred. Shopify says that after data is shared with a third-party AI integration, it leaves Shopify and is governed by the receiving provider’s terms and privacy policy. It also says uninstalling the integration revokes its further store access. The Klaviyo FAQ says OpenAI retains data accessed through the connector to enable it to work within ChatGPT, and directs users to OpenAI’s data controls for retention details.

Before approving a connection, identify the receiving provider, its data-use and retention terms for your account, who can see the conversation or outputs, and what happens to copied data after disconnection. Do not equate “read-only” with “no data shared”: read access can still return customer records. If those answers are unavailable or unacceptable for the proposed data, use a narrower source or an extract that omits customer identifiers.

Once connected, check what happened, not only what was requested. Klaviyo documents API logs that show recorded app calls, including source, method, path and status; request and response bodies are available when collected, though some are omitted. Those logs can help investigate whether the assistant read or wrote through the connector. They do not replace the access decision you make before connecting it.

A one-line permission record is enough to make that decision reviewable: job → required fields → identified records, if any → read or write actions → approver → access end date → receiving provider’s data terms. Revisit it when the task changes. If the actual grant exceeds the record, choose deliberately whether that exposure is justified before you connect.