What Customer Details Should I Share With My AEO Agency?

What business question is the information supposed to answer?

FTC business guidance recommends limiting unnecessary personal information and assessing service-provider security. AE’s request checklist is an editorial application, not transfer authorization. The following questions are our recommendations for applying that limited premise to this business decision.

Ask the agency to describe the decision it needs to make before discussing a file transfer. Improving a public service description, illustrating a customer question, measuring inquiries, and writing a case study are different purposes. Each may call for different information, and some may be addressed with public business facts alone. A broad request for customer data is not a sufficient explanation of what the recipient intends to do with it.

For a property management company, an agency might need to know which services owners ask about before a consultation. A summary of common questions may be enough to improve the page. That does not automatically justify sending owner contact details, tenant records, financial statements, or private correspondence. This guide helps you frame a responsible buying conversation. It does not decide whether a particular transfer is lawful, contractually permitted, or appropriate for your organization's systems and customers.

Evidence: privacy-premise

Can public business information meet the immediate need?

Our recommendation: Start with the business's published services, locations, eligibility descriptions, contact options, and approved explanations of its process. Ask the agency which specific question remains unanswered after reviewing those materials. If the need is to explain what a cleaning visit includes, an operations-approved scope description is more direct than a folder of customer messages. If the need is to clarify an appointment process, a verified description can avoid exposing individual appointment records.

The Answer Engine's current public audit intake asks for business context and instructs visitors not to submit sensitive customer, patient, case, or account details. That is a statement about this particular offer, not a universal assurance about every provider or engagement. Use it as a concrete example of a limited intake. When another proposed service requests more information, ask for the specific purpose and have the business's responsible person evaluate the request on its own facts.

Evidence: intake-premise

How do you turn a broad request into a reviewable request?

Our recommendation: Ask the requester to identify the categories of information, intended use, intended recipients, and expected output. A useful request explains why each category is relevant. It also identifies whether the information is intended for private analysis, public content, or another use. Do not assume that permission to inspect a record includes permission to quote it in an article or pass it to another service. Those are separate questions for the authorized decision maker.

Keep the conversation understandable to the business owner. A technical product name does not explain why a customer record is necessary. Ask for an ordinary-language account of what the agency cannot do without the requested information and whether a narrower alternative would work. If the answer remains vague, hold the transfer while the purpose is clarified. A pause for a specific answer is more useful than either sending everything or issuing an unexplained refusal.

Evidence: privacy-premise

Who within the business should make the decision?

Our recommendation: Identify the person responsible for the relevant records and the person authorized to approve the proposed use. They may not be the same person who manages marketing. An operations lead may understand the fields in a service record, while a privacy, security, legal, or compliance adviser may need to assess disclosure conditions. A marketing deadline should not be used to substitute one person's enthusiasm for another person's required decision.

Do not infer authority from possession. Someone who can export a file may not be authorized to disclose it for a new purpose. Likewise, an agency employee's promise that the material will help does not establish the business's permission to share it. Record who considered the request and what use was accepted. This is an organizational recommendation, not a statement about which legal role a particular company must appoint or what formalities apply in every jurisdiction.

Evidence: privacy-premise

What should you ask about summaries and examples?

Our recommendation: Ask whether the task can use an approved summary, a public example, or an explicitly hypothetical scenario instead of a customer-level record. A summary of recurring service questions can sometimes communicate the issue without reproducing personal correspondence. But do not assume that a smaller file is harmless. Ask the responsible person to assess the actual proposed summary; this article does not evaluate whether any particular material is anonymous.

If the agency proposes to call material anonymous, ask what that description is based on and who has reviewed it. Do not invent a legal or technical assurance from a quick visual inspection. A fictional illustration should be clearly labeled as hypothetical and should not be presented as a real success story. The objective is to answer the content question with appropriately limited material, not to disguise a real customer's situation so it can be used without resolving permission.

Evidence: privacy-premise

How do you distinguish private analysis from a public story?

Our recommendation: A request to understand common questions is not the same as a request to publish a named case study. For public use, identify the exact quote, image, facts, and context proposed for publication. Ask whether the business has the relevant authorization and whether the proposed wording stays within it. Prior permission for a different use should not be assumed to settle the new request. When the scope is unclear, hold the story and ask the responsible adviser.

Review the story for implication as well as literal accuracy. A customer may have achieved an outcome for many reasons; placing that outcome beside an agency claim can imply a causal result the evidence does not establish. Avoid presenting a selected example as a typical expectation. A useful service article can explain decisions and limitations without a customer success story. Removing an unsupported illustration is often clearer than surrounding it with qualifications that readers may overlook.

Evidence: claims-premise

What should you know about recipients and later use?

Our recommendation: Ask who will receive the information and whether the proposed work involves another provider or tool. The answer should be specific enough for the business to evaluate the requested use through its normal process. Do not treat a general statement that the agency uses secure technology as a complete explanation. This guide does not recommend a particular transfer method, provide credential-sharing instructions, or assess a vendor's security controls.

Clarify whether the request is limited to the current task or includes other purposes. Ask what the provider proposes to do with the information when the task is finished and how questions about retention or deletion will be handled. Applicable duties and contractual terms can vary, so obtain appropriate advice where needed. The business should not promise deletion, confidentiality, or unrestricted reuse to someone else unless it has a sound basis for that promise.

Evidence: privacy-premise

How do you respond when the agency says the work is blocked?

Our recommendation: Ask which part of the work is blocked and what limited alternative remains possible. An agency might still review public service descriptions, prepare a question list, or explain the gap without receiving the disputed records. A dependency should be described precisely enough that the business can make a decision. Avoid allowing a request for sensitive information to become an unexplained condition for every part of the engagement.

At the same time, do not demand that a provider claim to have measured something it could not observe. If the agreed analysis needs information that the business cannot authorize, the scope may need to change. Discuss the revised deliverable and any contractual implications rather than encouraging the agency to guess. A useful result can be an honest statement of what is known, what remains unknown, and which approved evidence would be needed to answer the remaining question.

Evidence: hiring-premise

What should be written down before anything is shared?

Our recommendation: Keep a record of the request, its business purpose, the material considered necessary, the authorized recipients and use, and the decision maker. Note any limitations or unresolved conditions. This record should not itself become an unnecessary copy of the sensitive material. The aim is to preserve the decision, not to build another unmanaged collection of customer information. Use the organization's existing approved handling process when a transfer is actually authorized.

Be clear about what a limited approval does not decide. Permission to use an approved summary in a private discussion does not automatically approve a public article, a new audience, or a later campaign. If the request changes, return to the responsible person. A concrete decision record makes that change visible. It also gives the agency a practical boundary within which it can work, instead of leaving different team members to infer incompatible permissions from a casual conversation.

Evidence: privacy-premise

What should you review after the work is delivered?

Our recommendation: Compare the output with the use that was approved. If the deliverable was a public page, inspect the actual text, imagery, examples, and contact invitation. If it was a private analysis, check that the report explains its evidence and limitations without claiming access to records it did not receive. Raise unexpected disclosure or reuse through the business's appropriate process. Do not treat this article as an incident-response plan or legal assessment.

For the next request, keep the lessons specific. Perhaps public service facts were sufficient; perhaps a better summary was needed; perhaps the proposed use could not be approved. The goal is not to make all information sharing impossible. It is to ensure that the business understands a concrete request and uses its authorized decision process before acting. Clear boundaries help the agency deliver useful work while keeping a marketing task from silently becoming a broader data-use commitment.

Evidence: privacy-premise

What should you record before the next step?

• Write down the specific question the requested information is intended to answer.
• Consider whether approved public business facts can support the immediate task.
• Identify the requested categories, recipients, use, and the responsible internal decision maker.
• Keep unresolved permissions or handling questions visible before any transfer.
• Review the delivered output against the use actually authorized by the business.

Use this editorial checklist to prepare a specific conversation with the agency; unresolved contractual or permission questions still need the business’s appropriate decision maker.