Quick answerTreat a customer's export request as a data access request scoped to that one customer: compile stored conversation history, any derived preference or personalization data, and a plain-language summary of how that data has been used, then deliver it in a portable, human-readable format within a defined turnaround time. This is distinct from deletion, which removes the data, and from vendor-switching portability, which moves data between companies rather than to the individual who is the subject of it.
Three related but different requests, and why this one is its own thing
It is easy to conflate three requests that sound similar but require different handling. A right-to-be-forgotten request asks you to remove data, covered in what happens to an AI agent's conversation history when a customer asks to be forgotten. Vendor-to-company data portability is about your company moving its own operational data if it switches AI vendors, covered in contract terms for AI agent data portability if you switch vendors, and has nothing to do with any individual customer's personal request.
This post covers the third case: a customer who wants a copy of what the agent has stored and learned about them, while their account and the underlying service relationship continue as normal. They are not asking you to delete anything, and they are not a party to any vendor contract. They just want to see it.
What actually needs to be included
Scope the export to two categories. First, raw conversation history: the actual messages exchanged, in a readable transcript format, not a raw database dump. Second, derived data: any preference, segment, or personalization signal the system has built from that customer's interactions, since this is often the part customers are most curious about and most likely to be surprised by. A response that only includes chat transcripts and omits derived personalization data is technically incomplete and will read as evasive if the customer specifically asked what the agent "remembers," since memory implies the derived layer, not just the raw log.
This overlaps with, but is broader than, the data privacy and PII considerations that apply to any system handling customer records. The export-specific piece is packaging that data for the individual it concerns, not just securing it against unauthorized third-party access.
From the team
We build production AI systems for startups.
LLM pipelines, RAG, and agent workflows that hold up under real traffic — not just in the demo.
Format, turnaround, and verification
Deliver the export in a format a non-technical person can actually read, not a raw JSON export of internal tables. A structured document or a simple downloadable file with clear labels is far more useful, and far less likely to generate a confused follow-up request, than a literal database extract. Commit to a specific turnaround window and hold to it consistently; many privacy regulations already set an outer bound for this kind of request, and building your internal process around a tighter, predictable internal target avoids scrambling case by case.
Verify the requester's identity before releasing anything, using the same account verification standard you already apply to other sensitive account actions, since an export request is functionally a data disclosure and deserves the same care against impersonation.
FAQ
Does this request also require deleting the data afterward?
No, unless the customer separately requests deletion. An export request and a deletion request are independent; fulfilling one does not imply the other.
Should the export include data from before the customer's account existed, like anonymized training contributions?
Generally no, since that data is not tied to their identifiable account record in the same way. Scope the export to identifiable account-linked data.
What if the derived personalization data is hard to explain in plain language?
Summarize it in plain terms even if the underlying signal is a technical feature vector or score; the goal is customer understanding, not a literal export of internal model representations.